Edit tour

Windows Analysis Report
http://154.61.80.57

Overview

General Information

Sample URL:	http://154.61.80.57
Analysis ID:	1428482
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Uses known network protocols on non-standard ports

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2332,i,7269247368579551505,3659595296345597256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://154.61.80.57" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: http://154.61.80.57/

HTTP Parser: Number of links: 0

Source: http://154.61.80.57/

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: http://154.61.80.57/

HTTP Parser: Title: HOOKBOT PANEL does not match URL

Source: http://154.61.80.57/

HTTP Parser: Has password / email / username input fields

Source: http://154.61.80.57/

HTTP Parser: <input type="password" .../> found

Source: http://154.61.80.57/

HTTP Parser: No <meta name="author".. found

Source: http://154.61.80.57/

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.25.241.18:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.25.241.18:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.25.241.18:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.25.241.18:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.25.241.18:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.25.241.18:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.25.241.18:443 -> 192.168.2.6:49753 version: TLS 1.2

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 3434
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 3434 -> 49733

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57
Source: unknown	TCP traffic detected without corresponding DNS query: 154.61.80.57

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /country-flag-icons/3x2/US.svg HTTP/1.1Host: purecatamphetamine.github.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://154.61.80.57/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /country-flag-icons/3x2/US.svg HTTP/1.1Host: purecatamphetamine.github.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fontawesome/css/fontawesome.min.css HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fontawesome/css/all.min.css HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fonts/icons/style.css HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fonts/icons/permissions/style.css HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fonts/mulish/style.css HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/main.397ec292.css HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fonts/mulish/1Ptyg83HX_SGhgqO0yLcmjzUAuWexZNR8aevGw.woff2 HTTP/1.1Host: 154.61.80.57Connection: keep-aliveOrigin: http://154.61.80.57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://154.61.80.57/assets/fonts/mulish/style.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fav/favicon-32x32.png HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/main.63007f25.js HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/main.397ec292.css HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fav/favicon-32x32.png HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/hook.svg HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/login_poster.jpg HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/fontawesome/webfonts/fa-solid-900.woff2 HTTP/1.1Host: 154.61.80.57Connection: keep-aliveOrigin: http://154.61.80.57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://154.61.80.57/assets/fontawesome/css/all.min.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/main.63007f25.js HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=Oxpd5At HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Origin: http://154.61.80.57Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/login_sd.mp4 HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: identity;q=1, ;q=0Accept: /*Referer: http://154.61.80.57/Accept-Language: en-US,en;q=0.9Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=Oxpd5Ry&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Origin: http://154.61.80.57Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/hook.svg HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/login_poster.jpg HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=Oxpd5At HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=Oxpd5Zt&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Origin: http://154.61.80.57Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/login_sd.mp4 HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: identity;q=1, ;q=0Accept: /*Referer: http://154.61.80.57/Accept-Language: en-US,en;q=0.9Range: bytes=6258688-6265757If-Range: "661f72f3-5f9b9e"
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=Oxpd5Ry&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/login_sd.mp4 HTTP/1.1Host: 154.61.80.57Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: identity;q=1, ;q=0Accept: /*Referer: http://154.61.80.57/Accept-Language: en-US,en;q=0.9Range: bytes=76051-6258687If-Range: "661f72f3-5f9b9e"
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdAZR&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Origin: http://154.61.80.57Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdAK-&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=Oxpd5Zt&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdFXb&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Origin: http://154.61.80.57Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdFR_&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdAZR&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdKYL&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Origin: http://154.61.80.57Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdKQj&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdFXb&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdPgR&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Origin: http://154.61.80.57Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdPR0&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdKYL&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdUjt&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Origin: http://154.61.80.57Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdUZ5&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /socket.io/?EIO=3&transport=polling&t=OxpdPgR&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: unknown

HTTP traffic detected: POST /socket.io/?EIO=3&transport=polling&t=OxpdAK-&sid=72 HTTP/1.1Host: 154.61.80.57:3434Connection: keep-aliveContent-Length: 3Accept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: text/plain;charset=UTF-8Origin: http://154.61.80.57Referer: http://154.61.80.57/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Data Raw: 31 3a 32 Data Ascii: 1:2

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2332,i,7269247368579551505,3659595296345597256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://154.61.80.57"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=2332,i,7269247368579551505,3659595296345597256,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
www.google.com	64.233.185.104	true	false	high
purecatamphetamine.github.io	185.199.108.153	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
windowsupdatebg.s.llnwi.net	69.164.42.0	true	false	unknown

Name	Malicious	Reputation
http://154.61.80.57/assets/fav/favicon-32x32.png	false	unknown
http://154.61.80.57/	false	unknown
http://154.61.80.57/assets/fonts/mulish/1Ptyg83HX_SGhgqO0yLcmjzUAuWexZNR8aevGw.woff2	false	unknown
http://154.61.80.57/images/hook.svg	false	unknown
http://154.61.80.57/assets/fontawesome/css/fontawesome.min.css	false	unknown
http://154.61.80.57/assets/fonts/icons/style.css	false	unknown
https://purecatamphetamine.github.io/country-flag-icons/3x2/US.svg	false	unknown
http://154.61.80.57/assets/images/login_poster.jpg	false	unknown
http://154.61.80.57/assets/fonts/mulish/style.css	false	unknown
http://154.61.80.57/assets/images/login_sd.mp4	false	unknown
http://154.61.80.57/assets/fonts/icons/permissions/style.css	false	unknown
http://154.61.80.57/assets/fontawesome/webfonts/fa-solid-900.woff2	false	unknown
http://154.61.80.57/static/js/main.63007f25.js	false	unknown
http://154.61.80.57/static/css/main.397ec292.css	false	unknown
http://154.61.80.57/assets/fontawesome/css/all.min.css	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
154.61.80.57	unknown	United States	58678	INTECHONLINE-INIntechOnlinePrivateLimitedIN	false
185.199.109.153	unknown	Netherlands	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.199.108.153	purecatamphetamine.github.io	Netherlands	54113	FASTLYUS	false
64.233.185.104	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428482
Start date and time:	2024-04-19 01:47:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://154.61.80.57
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus22.troj.win@17/74@6/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.6402239289418516
Encrypted:	false
SSDEEP:	3:SIyJEVv:NPVv
MD5:	AE31559601BD556088DD3150FC2A7D1F
SHA1:	F299F94E0D0345A1052260784AF3EFCAB9EA2A94
SHA-256:	80D15EAC574263C64DCC7DED97607A7DEDE624A0D73B97CFC717C67ECFAF13F7
SHA-512:	6D18E7FFF57DD9C0E6F1F12B321CE366D756CE8A85D285E21EDEAFE75E83ACE3E01B285E50B19C4CD8925E910F056BE540F7BD89D23D2C078766F4DF7308AA99
Malicious:	false
Reputation:	low
Preview:	write: overlap.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 01:48:06.328645945 CEST	53	59392	1.1.1.1	192.168.2.6
Apr 19, 2024 01:48:06.342618942 CEST	53	50251	1.1.1.1	192.168.2.6
Apr 19, 2024 01:48:06.980278015 CEST	53	52351	1.1.1.1	192.168.2.6
Apr 19, 2024 01:48:09.983143091 CEST	62312	53	192.168.2.6	1.1.1.1
Apr 19, 2024 01:48:09.983814001 CEST	57267	53	192.168.2.6	1.1.1.1
Apr 19, 2024 01:48:10.088248968 CEST	53	62312	1.1.1.1	192.168.2.6
Apr 19, 2024 01:48:10.088313103 CEST	53	57267	1.1.1.1	192.168.2.6
Apr 19, 2024 01:48:13.224281073 CEST	60646	53	192.168.2.6	1.1.1.1
Apr 19, 2024 01:48:13.224642038 CEST	63754	53	192.168.2.6	1.1.1.1
Apr 19, 2024 01:48:13.328907013 CEST	53	60646	1.1.1.1	192.168.2.6
Apr 19, 2024 01:48:13.330522060 CEST	53	63754	1.1.1.1	192.168.2.6
Apr 19, 2024 01:48:13.330862999 CEST	53	53556	1.1.1.1	192.168.2.6
Apr 19, 2024 01:48:14.173858881 CEST	62304	53	192.168.2.6	1.1.1.1
Apr 19, 2024 01:48:14.174019098 CEST	65161	53	192.168.2.6	1.1.1.1
Apr 19, 2024 01:48:14.279050112 CEST	53	65161	1.1.1.1	192.168.2.6
Apr 19, 2024 01:48:14.279282093 CEST	53	62304	1.1.1.1	192.168.2.6
Apr 19, 2024 01:48:24.378720045 CEST	53	61736	1.1.1.1	192.168.2.6
Apr 19, 2024 01:48:43.460973024 CEST	53	63735	1.1.1.1	192.168.2.6
Apr 19, 2024 01:49:05.736773968 CEST	53	62054	1.1.1.1	192.168.2.6
Apr 19, 2024 01:49:06.014081955 CEST	53	64089	1.1.1.1	192.168.2.6
Apr 19, 2024 01:49:34.474419117 CEST	53	61701	1.1.1.1	192.168.2.6

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:07.707267046 CEST	427	OUT	GET / HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:08.055957079 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:07 GMT Content-Type: text/html Last-Modified: Wed, 17 Apr 2024 07:01:30 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f73ca-1e9a" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 63 34 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 59 0b 73 db b8 11 fe 2b 34 73 f1 91 35 45 3d 1c 39 36 69 da c9 e5 32 4d da a4 c9 5c dc 99 76 5c f7 06 12 57 12 12 12 50 01 50 b6 4f e2 7f ef 02 e0 4b 0f 67 da 38 b1 45 00 8b dd c5 3e be 5d 50 97 47 29 9f aa c7 25 38 0b 95 67 57 97 fa af 93 11 36 4f 5c 60 2e 8e 81 a4 57 97 39 28 e2 4c 17 44 48 50 89 5b a8 59 ef dc ed 57 d3 8c e4 90 b8 2b 0a f7 4b 2e 94 eb 4c 39 53 c0 90 ec 9e a6 6a 91 a4 b0 a2 53 e8 99 41 40 19 55 94 64 3d 39 25 19 24 c3 40 2e 04 65 df 7a 8a f7 66 54 25 8c 6b a6 8a aa 0c ae de 7d fa f4 d7 5f 3e dd 38 9f 5f ff ed ed 87 cb be 9d bc cc 90 da 11 90 25 ae 54 8f 19 c8 05 00 4a 5c 08 98 25 6e 9f 48 d4 4e f6 67 28 9f dc 83 e4 39 f4 a7 72 6b 1c e6 94 85 38 e7 fe 18 27 92 65 3f c0 41 f6 29 9a 44 f6 0d d5 0f ee 5d 82 c8 a9 94 f4 c7 f9 e4 45 46 e5 e2 89 cd 64 b9 cc 00 bd 50 4c 17 3d 2d d0 75 24 fd 03 64 e2 0e cf 07 0f f8 bb c7 92 ac fa bb 7b c2 25 9b 6f 31 b5 8c 74 68 e1 73 4e e6 d0 d7 14 35 e7 d3 d1 c3 e9 e8 10 5f fc d5 3b 7b 86 e0 ff 64 3a 3c 7b 18 9e 7d 8f a9 21 d8 63 9a 13 46 67 20 f7 2d 87 3b 25 55 10 de c3 a4 a1 d9 de 28 bf 55 06 3b b0 93 cc 88 a0 bd 25 65 0c d2 9e 22 93 50 ae e6 3a 3d 32 2e 12 f7 d9 78 32 21 e9 d8 dd 4a a2 5c 6a ab d2 29 51 e8 e9 de 0d cd e0 8d a6 ee e4 d4 b3 94 8c 4f 47 d3 ed 6d 6a 01 39 f4 a6 bb a4 33 f3 83 a4 c6 e9 57 13 9e 3e 06 3a bd d7 39 11 73 ca a2 41 bc 24 69 4a d9 3c 1a 94 cf 26 9c ab 8c 93 14 c4 3a a5 72 99 91 c7 68 96 c1 43 4c 32 3a 67 3d 34 42 2e a3 29 f2 05 11 7f 2d a4 a2 b3 c7 5e 25 a9 9e d6 e4 bd 94 0a 98 6a ed 23 54 a7 c8 59 6c f2 3e 1a 0e 06 ab fb 78 01 74 be 50 66 b0 88 15 3c a8 9e e1 de 30 40 7e bd 19 c9 69 f6 18 7d 34 e1 1a 48 c2 64 4f 82 a0 b3 78 2e 68 da 13 fc be 37 27 cb 68 38 5e 3e c4 13 32 fd 36 17 bc 60 a9 3d 7b f4 6c 38 1d ce 46 a7 71 35 c2 c3 c7 4b 8e 0e d4 ea a0 bf d0 aa 2b 88 ff e8 51 96 c2 43 74 71 71 51 3e 5b 0a 3e 17 20 e5 7a 9f ae 52 76 74 7e 58 d2 99 fe 57 9d 6e 74 36 40 22 0c 90 dc 38 2e 92 0b 92 f2 fb cf 45 26 c1 21 19 1e 8d 11 05 ce 58 3a 40 24 a0 f8 1e 2f 94 43 d9 4c a3 21 b4 4a fc ae 04 ca 69 55 21 13 89 36 54 10 d7 86 fe f9 e7 58 f1 25 fa 6d c2 95 e2 39 3e 64 30 53 7a bc a7 df 98 5c a4 a7 a3 ee 82 c9 96 08 63 17 88 e8 cd 05 49 29 b2 f4 7a 2f c6 29 cc 03 31 9f 10 6f 34 1e 07 f5 6f 38 f2 9d d1 f8 79 80 2a 31 b9 24 02 69 f7 c6 e3 c1 f3 c3 1b 9f 5c 78 b9 c3 61 67 ec 77 f5 d5 29 6d ac ef 18 17 b4 d6 cd f9 ca 18 d3 1e a5 b1 63 6c 18 55 96 cb 32 27 1c 6e d9 bb 7c f5 0d 1e 67 02 f3 45 3a 1d ff ac 07 cf d7 Data Ascii: c48Ys+4s5E=96i2M\v\WPPOKg8E>]PG)%8gW6O\`.W9(LDHP[YW+K.L9SjSA@Ud=9%$@.ezfT%k}_>8_%TJ\%nHNg(9rk8'e?A)D]EFdPL=-u$d{%o1thsN5_;{d:<{}!cFg -;%U(U;%e"P:=2.x2!J\j)QOGmj93W>:9sA$iJ<&:rhCL2:g=4B.)-^%j#TYl>xtPf<0@~i}4HdOx.h7'h8^>26`={l8Fq5K+QCtqqQ>[> zRvt~XWnt6@"8.E&!X:@$/CL!JiU!6TX%m9>d0Sz\cI)z/)1o4o8y*1$i\xagw)mclU2'n\|gE:
Apr 19, 2024 01:48:08.055999994 CEST	1289	IN	Data Raw: 13 fe d0 b3 53 d1 c0 19 38 a7 e8 4c fc c0 03 78 17 03 67 38 7e 89 e7 71 fa ce 68 f0 dc 2f 31 74 f7 e8 cf 0f d3 6b 52 bf ec 8a d5 8a 1b 79 ed 21 1b 5f 23 a3 8a f9 81 c5 c6 0a 65 27 58 56 24 2b 20 8a c8 0c e3 6b 5d 47 08 51 4a 78 29 51 a4 87 15 43 Data Ascii: S8Lxg8~qh/1tkRy!_#e'XV$+ k]GQJx)QC_mfn&mX<nb/={U7i5/mATWGH&EhUF\&d<RE/gqU\|x~6zQXl6^bdyr<zZ$\|{Hi
Apr 19, 2024 01:48:08.056042910 CEST	1048	IN	Data Raw: ab 64 80 d5 fb ca db 8d ae 5b b8 d3 c6 d7 85 7b 7f 05 d5 39 ea 18 1d 03 e0 49 61 75 61 d2 5c ea 13 55 c9 89 7b e5 1e 77 bf 76 ab b7 dd 77 d5 fa 9e c0 96 2e ec ae f4 83 6d 55 7e c9 f8 e4 7b 56 ef 6a a2 13 17 55 cf a9 ec 0a 14 88 0e 6b 0b 0e 9a e0 Data Ascii: d[{9Iaua\U{wvw.mU~{VjUk?Sj.(&!?qu\.1ABoWT@5?sfJ->E7*o$t,NuU{Z-]hBB}(d<0P q\|{JW0#"\|?7zD
Apr 19, 2024 01:48:08.129185915 CEST	353	OUT	GET /assets/fontawesome/css/fontawesome.min.css HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:08.482214928 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:08 GMT Content-Type: text/css Last-Modified: Wed, 17 Apr 2024 06:57:54 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f72f2-13b0b" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 34 34 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 5b 8f dc 4a 72 e6 bb 7f 85 76 8c 01 8e 8c 2e 0d c9 2a 56 55 4b c0 c2 eb 01 0c 0c e0 c5 3e ec 3e ec 00 fb c2 4b b2 8a 6a 16 c9 c3 4b b7 5a 82 fe fb e6 ed 4b 66 92 11 d5 d2 f1 18 8b 1d 1f 18 9e a3 ce 64 f1 92 19 19 f7 f8 e2 4f ff f4 5f fe e1 dd 3f bd fb d7 ae 9d de fd b7 17 31 76 37 f1 ee 5f 07 21 de 1d 3f 24 1f a2 77 f9 eb bb 7f ae e4 5c 66 a7 76 ef ae d3 d4 8f 1f ff f4 27 6f f4 43 d1 dd d4 4d fe ad 2e 44 3b de b9 e8 4f 8d b9 e2 4f 95 7a c2 2f 7f 29 ba 76 fc f8 ee cf 7f 7e f7 2f 7f 7d 77 f8 10 3d e8 d7 90 23 ff f3 2f ff f6 ee 7f fc eb bf bd 8b 3f c4 0f ef fe dc 95 e2 e3 bb ff fe 97 ff 85 fb bf 57 cf fa 73 d7 bf 0e f5 e5 3a bd 4b a2 24 d1 3f ac d5 ed 1e de fd a5 2d 3e c8 2b fe f4 0f 1f aa ec 9b 7a 81 5d 95 dd ea e6 f5 e3 73 36 fc b2 93 7f ec c6 e9 b5 11 76 f4 e1 0f c1 a7 1f f5 c7 ff e1 fd 27 fd c3 17 a1 9e b0 fa e1 c3 63 14 bd ff 2e 6f fe 20 ff 7f 97 0f 59 5b 8e fa 9f 45 93 8d 63 5d e8 7f 0f e2 32 37 d9 a0 ff 3d 5e b3 a1 37 ff ea 9a ba 54 ff ca d5 ff e8 d9 f1 db ee d6 7d dd 75 e3 97 9d 7e e4 78 eb ba e9 5a b7 97 8f 97 21 7b 1d 8b ac 11 9f e4 7b e4 4f f5 b4 be 20 93 9f 9c 35 75 36 8a f2 53 59 8f 7d 93 79 df 68 07 1e ea b6 a9 5b b1 cb 9b ae 78 b2 5f a5 bf e2 63 db 0d b7 ac 31 23 f2 57 b5 bc 1b c6 f4 2f ae e6 db e3 4f 93 f8 32 c9 ef 69 4b 31 e8 a7 ce 53 f7 fd ee e7 e2 23 ed f7 f9 5b 40 2e f6 f7 70 1d f3 bb bf f8 17 7d 9d f9 4d fc c5 5c 3a d6 5f c5 c7 58 dc f4 60 e2 0f 26 76 70 ef 0f ee ed e0 c1 1f 3c d8 c1 d4 1f 4c ed e0 d1 1f 3c da c1 93 3f 78 b2 83 67 7f f0 6c 07 1f fd c1 47 3b 18 47 c1 db 47 ee f5 47 6f f8 c3 31 91 ef 10 6c c8 07 f9 a1 9f 9e c5 20 c9 3d 6b 76 72 ff 2f ed c7 0f 49 82 57 0d 7f 7e da fc 3a 3a ef f7 7b e2 0e b1 bb c3 78 f3 ef 70 26 6e 71 8a 0f d4 2d a2 74 9f 62 1d 9a 8b ff 71 1f b6 5f 11 a5 db 3b ec e4 ad dd 77 34 c1 0d b6 bf 3f c4 c7 13 75 8b e5 43 92 e0 1e c9 e6 0e 7b 7d 29 71 87 b3 7b 8b ea e5 9b 26 7f 33 25 b9 cf 24 86 4f 2f 75 39 5d ed 47 e9 ab e6 e6 5b 53 8f f6 60 ed a6 d7 5e 9d ae 56 7c ba 65 c3 a5 6e 77 8d a8 3c 1e d2 d4 3b 33 fe 90 a8 af 7a ff a9 cf ca 52 1e 2c 73 59 64 6f f8 5f 9b fa 5b df 8d f5 54 77 ed c7 41 34 d9 54 3f 0b b3 b2 f5 37 7d a5 7c e3 e2 17 ff ae fa b5 1e de c9 ef 7c ff 4f bb 58 de 17 3f cf 72 79 24 e7 49 7c e2 3e 65 7b 17 75 93 60 b5 ea f6 2a 8f ff 64 8e 6a 37 48 5e f0 cd fc 67 37 64 65 3d 8f cb 3d 82 e1 07 45 ad ef 3f 99 b1 cd 35 e6 59 92 24 e5 35 ef d6 93 86 d7 6a 66 b2 9d 2c ba a6 1b 1e fe 51 08 e1 d6 6f 73 77 3b fe f0 41 Data Ascii: 44cb}[Jrv.VUK>>KjKZKfdO_?1v7_!?$w\fv'oCM.D;OOz/)v~/}w=#/?Ws:K$?->+z]s6v'c.o Y[Ec]27=^7T}u~xZ!{{O 5u6SY}yh[x_c1#W/O2iK1S#[@.p}M\:_X`&vp<L<?xglG;GGGo1l =kvr/IW~::{xp&nq-tbq_;w4?uC{})q{&3%$O/u9]G[S`^V\|enw<;3zR,sYdo_[TwA4T?7}\|\|OX?ry$I\|>e{u`dj7H^g7de==E?5Y$5jf,Qosw;A
Apr 19, 2024 01:48:08.482256889 CEST	1289	IN	Data Raw: 7e cc 3b bd 59 ef 3e c4 6a c5 f5 47 f4 73 d3 e8 25 ff 56 35 5d 36 7d 54 ff c4 86 0d 21 d7 d7 97 da 3d fb b0 0f 6e a0 af b4 77 d0 ff a6 f7 9c be 43 2e b2 e9 1b 78 7b d6 d6 b7 4c 6d d7 ae cd 6e e2 a3 9d fe c4 0c 6f 7f 55 8a 80 fd af 26 1e a2 f1 fd Data Ascii: ~;Y>jGs%V5]6}T!=nwC.x{LmnoU&xB=BCL><~H<y2v!G}Z-WDauUA]T]JsN`7O/$"V3;Ns^}\|xpH\|Gj e=
Apr 19, 2024 01:48:08.482296944 CEST	1289	IN	Data Raw: 4f cd 86 a1 7b 19 77 53 b7 2b ea a1 68 c4 f6 5a 71 c8 4b 73 6d 71 15 cf 83 8a 70 e8 2b 6d b2 b7 b9 de 94 f1 98 71 5c e6 cf fb cf 8e f1 ee 19 31 7b b0 fb 25 0f d1 78 95 64 17 3c c0 0c 16 59 4b dc 35 11 f6 2d 35 bd 5a 02 db 5e 16 61 93 e6 51 0c 2a Data Ascii: O{wS+hZqKsmqp+mq\1{%xd<YK5-5Z^aQ%Fz-G`ILn,X,a&_!9f)V.ytwydfG!.< 1u;%{Vs6Pq']>?E-FWt4
Apr 19, 2024 01:48:08.482347012 CEST	1289	IN	Data Raw: b8 49 f5 6b da a0 38 bb b3 e4 84 d6 24 a5 cf ac 4d dd 45 5f 5e 84 17 35 1b 10 c3 39 83 84 18 b2 57 c6 01 92 e6 c1 79 b1 b2 8a da ec bd 65 5d 2f db c9 14 b2 42 5a 32 d7 5d 56 c9 2f cd 82 d7 6d ba 5c 84 e3 c1 3b 9c ec 51 1a b2 ba cd 3b e2 01 d5 29 Data Ascii: Ik8$ME_^59Wye]/BZ2]V/m\;Q;)CtN@7N;]Vi"%+gyn$<I2'=`W,D=puQq"R^%M9,.4BwCmW(dJX;<kCcY1q)nQ+H Ks!(j
Apr 19, 2024 01:48:08.482387066 CEST	1289	IN	Data Raw: 3f e0 00 72 36 91 64 b5 cb 0a 5b 15 3b f1 9f b5 0c 5f b3 86 74 96 c2 78 d7 ee 17 2e 0d e9 18 db 97 1a a5 62 4d bc 46 04 bd 2d cf 2e 4a bf e9 fb 95 7b 1d 63 ea 02 ea 2d 1e ed fd 3d 6f ea d7 5d e0 2d d4 0e d3 ac e9 af 19 ed 4b b5 53 f7 3c a9 31 be Data Ascii: ?r6d[;_tx.bMF-.J{c-=o]-KS<1tSn-$j"~x}YVIes~%2rEZo1_$NI~JS([Pvx=^Ehg+r*E=ODf\eLQ/!\B
Apr 19, 2024 01:48:08.482444048 CEST	1289	IN	Data Raw: 42 b8 62 3a 69 b0 f6 b6 50 09 c5 c9 d4 6d 33 24 ae f4 35 ad e3 9c 62 cf d7 34 6a 28 28 3a 8a e5 17 31 d4 ed 73 a7 3c 16 ac 43 d9 a5 ea ea 32 85 1f 13 a9 29 6c e5 2f ca d7 48 91 ab 4b 14 ee 75 96 1a 13 0e 3b 43 9e 70 ce c6 13 b2 dc 55 f8 70 56 0a Data Ascii: Bb:iPm3$5b4j((:1s<C2)l/HKu;CpUpV&ES?O'-DSFF-`@JN9UrPtdow@~Nbd=]5zN0JFw3a=mTP[38UBLl[LYUGkh`1pN3fHlxz
Apr 19, 2024 01:48:08.482485056 CEST	1289	IN	Data Raw: d7 60 9c 4a a7 ca 79 d8 43 9b 02 57 0b 3e c4 67 a4 40 9c 64 6d 9b e5 35 49 85 00 41 73 86 a5 73 e5 1a db b9 51 81 11 36 8f 1e e9 c4 26 d0 45 da d7 30 bb 84 ca 24 69 49 d3 ec 04 9f 8d 98 03 5d 48 fe d9 6d f2 ca d4 20 f5 2a 50 10 39 37 c8 b1 58 94 Data Ascii: `JyCW>g@dm5IAssQ6&E0$iI]Hm P97X)ozVsSGo@0bA2_Dr+F9d`N+4Ug1uQt8;YU4Ln;QbVYtcR p1.5,4Z[%F)RtqR"tMvM6Q5Yk
Apr 19, 2024 01:48:08.482522011 CEST	1289	IN	Data Raw: 99 6f 80 d1 42 c7 bf 82 d6 18 44 04 cd d4 a2 0c 6d aa a8 ec b0 49 22 27 45 87 2b e6 23 56 09 31 b9 b6 7b a9 1a 26 0c 00 e3 a3 15 2f a3 8f 1d 10 50 b3 53 69 c3 00 09 80 f6 77 a4 d4 3c 62 a9 02 d5 91 eb e2 73 d7 8d 26 95 c7 25 d1 da f3 9f 70 19 43 Data Ascii: oBDmI"'E+#V1{&/PSiw<bs&%pCigRVka4OVp1'kf#IX94Nf7'#,x:G#NL5I`U$-47CZj8TV6@+@vyEw4th cH,V)4~'`p~U
Apr 19, 2024 01:48:08.482561111 CEST	1289	IN	Data Raw: 47 17 e0 09 da 54 bf e1 a9 81 bf d0 3e 5a c9 40 ea 64 21 dd 57 e5 48 50 1b e8 aa eb 96 83 75 b7 f3 8a 83 e1 56 ed 46 6f 84 05 29 12 b4 2d 05 6e 3f 0f 15 78 42 9f e7 49 88 e9 ca c9 dd 63 e2 fb 22 ed ea b0 50 ce ae e9 7c 46 1d 3f c9 90 2c 77 78 a9 Data Ascii: GT>Z@d!WHPuVFo)-n?xBIc"P\|F?,wxQJSK*hLl$mdIE}!m[Xh:~J}TqCR&E?t'>{j3P'DDK?l%m<2D)0a<p-\ARI1Ve
Apr 19, 2024 01:48:13.227014065 CEST	405	OUT	GET /assets/fontawesome/webfonts/fa-solid-900.woff2 HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive Origin: http://154.61.80.57 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://154.61.80.57/assets/fontawesome/css/all.min.css Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:13.575088024 CEST	441	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:13 GMT Content-Type: font/woff2 Content-Length: 150472 Last-Modified: Wed, 17 Apr 2024 06:57:55 GMT Connection: keep-alive ETag: "661f72f3-24bc8" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Accept-Ranges: bytes
Apr 19, 2024 01:48:14.746401072 CEST	387	OUT	GET /assets/images/login_sd.mp4 HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: identity;q=1, ;q=0 Accept: /* Referer: http://154.61.80.57/ Accept-Language: en-US,en;q=0.9 Range: bytes=6258688-6265757 If-Range: "661f72f3-5f9b9e"
Apr 19, 2024 01:48:15.094489098 CEST	476	IN	HTTP/1.1 206 Partial Content Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:14 GMT Content-Type: video/mp4 Content-Length: 7070 Last-Modified: Wed, 17 Apr 2024 06:57:55 GMT Connection: keep-alive ETag: "661f72f3-5f9b9e" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Range: bytes 6258688-6265757/6265758
Apr 19, 2024 01:48:15.248981953 CEST	385	OUT	GET /assets/images/login_sd.mp4 HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: identity;q=1, ;q=0 Accept: /* Referer: http://154.61.80.57/ Accept-Language: en-US,en;q=0.9 Range: bytes=76051-6258687 If-Range: "661f72f3-5f9b9e"
Apr 19, 2024 01:48:15.597316027 CEST	477	IN	HTTP/1.1 206 Partial Content Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:15 GMT Content-Type: video/mp4 Content-Length: 6182637 Last-Modified: Wed, 17 Apr 2024 06:57:55 GMT Connection: keep-alive ETag: "661f72f3-5f9b9e" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Range: bytes 76051-6258687/6265758

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:08.130548000 CEST	345	OUT	GET /assets/fontawesome/css/all.min.css HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:08.495002985 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:08 GMT Content-Type: text/css Last-Modified: Wed, 17 Apr 2024 06:57:54 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f72f2-18d98" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 35 38 34 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 59 8f dc c8 96 de bb 7f 85 dc c6 00 ad 71 a5 9a 64 92 99 59 12 60 8c 67 80 0b 0c 30 86 1f ec 07 0f e0 97 20 19 cc a4 8a 5b 73 a9 54 4a d0 7f 77 6c 5f 64 04 79 22 4b dd d3 d7 cb 75 63 30 b7 4b 11 4c 2e 11 27 ce 7e be f3 cb df ff fb 7f f7 ee ef df fd a5 ef e6 77 ff f9 ca a7 be e5 ef fe 32 72 fe ee f0 21 f9 10 bd cb 6f ef fe a1 12 73 cc 4c ed de 5d e6 79 98 3e fe f2 8b 33 fa a1 e8 5b 79 93 7f a9 0b de 4d 0f 2e fa a5 d1 57 fc 52 c9 27 fc fc cf 45 df 4d 1f df fd d3 3f bd fb c7 7f 7d 97 7e 88 9e d4 6b 88 91 ff f6 cf ff f2 ee bf fe e5 5f de c5 1f e2 a7 77 ff d4 97 fc e3 bb ff f2 cf ff 1d f7 7f 2f 9f f5 4f fd 70 1b eb f3 65 7e 97 44 49 a2 7e 58 cb db 3d bd fb e7 ae f8 20 ae f8 e5 df 7d a8 d8 37 f9 02 bb 8a b5 75 73 fb f8 ca c6 9f 77 e2 1f bb 69 be 35 dc 8c 3e fd e4 7d fa 41 7d fc 4f ef 3f a9 1f 5e b9 7c c2 ea 87 4f cf 51 f4 fe bb b8 f9 93 f8 ff 5d 3e b2 ae 9c d4 9f 45 c3 a6 a9 2e d4 df 23 3f 2f 0d 1b d5 df d3 85 8d 83 fe ab 6f ea 52 fe 95 cb ff 51 b3 d3 b7 5d db 7f dd f5 d3 97 9d 7a e4 d4 f6 fd 7c a9 bb f3 c7 f3 c8 6e 53 c1 1a fe 49 bc 47 fe 52 cf eb 0b 98 f8 64 d6 d4 6c e2 e5 a7 b2 9e 86 86 39 df 68 06 9e ea ae a9 3b be cb 9b be 78 31 5f a5 be e2 63 d7 8f 2d 6b f4 88 f8 55 2d ee 86 31 f5 8b 8b fe f6 f8 d3 cc bf cc e2 7b ba 92 8f ea a9 cb dc 7f 7f f8 b9 f8 48 f3 7d ee 16 90 8b fd dd 5f c7 fc e1 2f fe 51 5d a7 7f 13 7f d1 97 4e f5 57 fe 31 e6 ad 1a 4c dc c1 c4 0c ee dd c1 bd 19 4c dd c1 d4 0c 66 ee 60 66 06 0f ee e0 c1 0c 1e dd c1 a3 19 3c b9 83 27 33 f8 ec 0e 3e 9b c1 38 f2 de 3e b2 af 3f 39 c3 1f 0e 89 78 07 6f 43 3e 88 0f fd f4 ca 47 41 ee ac d9 89 fd 3f 77 1f 3f 24 09 5e d5 ff f9 71 f3 eb e8 b4 df ef 89 3b c4 f6 0e 53 eb de e1 44 dc e2 18 a7 d4 2d a2 6c 9f 61 1d 9a b3 fb 71 1f b6 5f 11 65 db 3b ec c4 ad ed 77 34 de 0d b6 bf 4f e3 c3 91 ba c5 fd 43 12 ef 1e c9 e6 0e 7b 75 29 71 87 93 7d 8b ea fa 4d 91 bf 9e 12 dc 67 e6 e3 a7 6b 5d ce 17 f3 51 ea aa a5 f9 d6 d4 93 39 58 bb f9 36 c8 d3 d5 f1 4f 2d 1b cf 75 b7 6b 78 e5 f0 90 a6 de e9 f1 a7 44 7e d5 fb 4f 03 2b 4b 71 b0 f4 65 91 b9 e1 7f 6a ea 6f 43 3f d5 73 dd 77 1f 47 de b0 b9 7e e5 7a 65 eb 6f ea 4a f1 c6 c5 cf ee 5d d5 6b 3d bd 13 df f9 fe ef 77 b1 b8 2f 7e ce 72 71 24 97 99 7f 0a 7d ca f6 2e f2 26 de 6a d5 dd 45 1c ff 59 1f d5 7e 14 bc e0 9b fe cf 6e 64 65 bd 4c f7 7b 78 c3 4f 92 5a df 7f d2 63 9b 6b f4 b3 04 49 8a 6b de ad 27 35 af 55 cc 64 3b 59 f4 4d 3f 3e fd 07 ce b9 5d bf cd dd cd f8 d3 07 f1 31 ef d4 66 bd fb Data Ascii: 5847}YqdY`g0 [sTJwl_dy"Kuc0KL.'~w2r!osL]y>3[yM.WR'EM?}~k_w/Ope~DI~X= }7uswi5>}A}O?^\|OQ]>E.#?/oRQ]z\|nSIGRdl9h;x1_c-kU-1{H}_/Q]NW1LLf`f<'3>8>?9xoC>GA?w?$^q;SD-laq_e;w4OC{u)q}Mgk]Q9X6O-ukxD~O+KqejoC?swG~zeoJ]k=w/~rq$}.&jEY~ndeL{xOZckIk'5Ud;YM?>]1f
Apr 19, 2024 01:48:08.495045900 CEST	1289	IN	Data Raw: 10 cb 15 57 1f 31 2c 4d a3 96 fc 5b d5 f4 6c fe 28 ff c4 86 8d 3e d7 57 97 9a 3d fb b0 f7 6e a0 ae 34 77 50 7f d3 7b 4e df 21 e7 6c fe 06 de ce ba ba 65 72 bb 76 1d 6b f9 47 33 fd 29 30 bc fd 55 c9 3d f6 bf 9a 78 8a a6 f7 9f 7e d3 c5 c4 13 ea 91 Data Ascii: W1,M[l(>W=n4wP{N!lervkG3)0U=x~bIiob'`~fKNooLZRKPvevx#T?OrQ[u!?HNON4y>}tC-Y4Ajo}Z
Apr 19, 2024 01:48:08.495084047 CEST	1289	IN	Data Raw: d3 6e ee 77 45 3d 16 0d df 5e cb d3 bc d4 d7 16 17 fe 3a ca 08 87 ba d2 24 7b eb eb 75 19 8f 1e c7 65 ee bc fb ec 18 ef ce 88 d9 d4 ec 97 38 44 d3 45 90 9d f7 00 3d 58 b0 8e b8 6b c2 cd 5b 2a 7a 35 04 b6 bd 2c c2 26 2d 13 1f 65 8c 8b 4f ee 13 d4 Data Ascii: nwE=^:${ue8DE=Xk[*z5,&-eO/#K?@WUm+#'v~OZym.I2=P.q418=<w1y;B^UFj9N{S(7%PKJ\|\|Y.#%IYl\
Apr 19, 2024 01:48:08.495122910 CEST	1289	IN	Data Raw: fa 2c ca d4 bd eb cb 77 e1 45 cd 7a c4 70 62 90 10 23 bb 05 1c 20 59 ee 9d 17 23 ab a8 cd de 1b d6 75 dd 4e 66 90 15 c2 92 b9 ec 58 25 be 94 79 af db f4 39 f7 c7 bd 77 38 9a a3 34 b2 ba cb 7b e2 01 d5 31 f3 85 43 d7 d3 74 13 17 e6 ec ce 4c 68 a0 Data Ascii: ,wEzpb# Y#uNfX%y9w84{1CtLh'y'd<r_2qaabx#d"U6qO_4sjhWIrhg&D6?S:u114-@m/xTqdiwE,ZC~
Apr 19, 2024 01:48:08.495161057 CEST	1289	IN	Data Raw: ba 0f 5f 58 43 3a 4b 61 bc 2b f7 4b 28 0d e9 10 9b 97 9a 84 62 4d bc 46 04 bd 2d 67 67 a9 df 0c c3 ca bd 8e 31 79 01 f5 16 cf e6 fe 8e 37 f5 eb ce f3 16 2a 87 29 6b 86 0b a3 7d a9 66 ea 91 27 35 c6 97 ce 33 99 02 72 cc 8d 85 64 dc bf 23 99 9c c3 Data Ascii: _XC:Ka+K(bMF-gg1y7)k}f'53rd#\|2))[ae^T_XF+)\|WWJ\|o\|8%))NlA&C14K2leSUoS!e>:-r}v{"2KHcG.Cx<1HFr$qq
Apr 19, 2024 01:48:08.495203018 CEST	1289	IN	Data Raw: d3 3a ce 31 76 7c 4d 93 82 82 a2 a3 58 6e 11 43 dd bd f6 d2 63 11 74 28 db 54 5d 55 a6 f0 63 22 35 83 ad fc 45 fa 1a 29 72 b5 89 c2 83 ca 52 0b 84 c3 4e 90 27 21 67 e3 11 59 ee 32 7c b8 48 05 46 11 f0 86 a2 a9 7b c3 9f ee 86 e4 e7 3e 18 90 27 c3 Data Ascii: :1v\|MXnCct(T]Uc"5E)rRN'!gY2\|HF{>'-DFFc@N9UrPT.Ez`+:`z*%g4WLnl\\|+Gk(]o1pN3dl9i=G$5Yqb"
Apr 19, 2024 01:48:08.495240927 CEST	1289	IN	Data Raw: 10 27 ac eb 58 5e 93 54 08 10 34 6b 58 5a 57 ae b6 9d 1b 19 18 09 e6 d1 23 9d 58 07 ba 48 fb 1a 66 17 97 99 24 1d 69 9a 1d e1 b3 e1 8b a7 0b 89 7f f6 9b bc 32 39 48 bd 0a 14 c4 90 1b e4 50 dc 95 15 21 dd bd 6f 7a 72 56 20 e4 a6 8e 00 df 80 60 c4 Data Ascii: 'X^T4kXZW#XHf$i29HP!ozrV `=H~UZ%.5U7hP7HYGF.!%0JRw"#n,5tROl]n6#VsNJIf]<[#hSmAs:hTA8dBM%RyeI"
Apr 19, 2024 01:48:08.495279074 CEST	1289	IN	Data Raw: 0c 6d aa a8 cc b0 4e 22 27 45 87 2d e6 23 56 09 31 b9 ae bf 56 4d 20 0c 00 e3 a3 e3 d7 c9 c5 0e f0 a8 d9 aa b4 7e 80 04 40 fb 3b 52 6a 1e b0 54 9e ea 18 ea e2 f3 d0 8d 26 94 c7 7b a2 b5 e3 3f 09 65 0c c5 c7 bb dd be 04 c0 2d b1 38 2b 15 70 e9 e4 Data Ascii: mN"'E-#V1VM ~@;RjT&{?e-8+pJ~3`qf6mUx? 6{}3qI0#`T@5cU-,47CI-Tst)P)ZWALaumT@nnD/fVh5_F^srbD!i
Apr 19, 2024 01:48:08.495321989 CEST	1289	IN	Data Raw: 85 e6 d1 52 06 52 27 0b e9 be 32 47 82 da 40 5b 5d 77 3f 58 0f 3b af 58 18 6e d9 6e b4 25 2c 48 9e a0 6d 29 70 fb c3 50 81 47 f4 79 9e 39 9f 2f 21 b9 7b 48 5c 5f a4 59 9d 20 94 b3 6d 3a cf a8 e3 27 18 92 e1 0e d7 1a b5 ab d4 aa e0 3b 95 a4 aa bc Data Ascii: RR'2G@[]w?X;Xnn%,Hm)pPGy9/!{H\_Y m:';ZFdOP\w+Aq#Y)wKG1-iRcvizqWl)dk:!<l0e+a~.'@5H^^=5kabH"0HV.,`]FK}-<`
Apr 19, 2024 01:48:08.495361090 CEST	1289	IN	Data Raw: 36 00 21 12 a1 5a 3d 17 82 e9 52 2a e8 72 bf db 90 fc b7 2a 3d 6b d6 fa 28 99 18 19 a3 34 01 c5 16 d4 43 d1 da cf c3 24 f1 83 62 06 90 84 56 0c 81 b7 a0 a2 f4 81 de 0e 11 aa 13 56 25 dd 34 54 25 b7 2d 68 c7 3a cf 49 4b c5 02 e7 2b 63 81 3a 35 91 Data Ascii: 6!Z=Rr=k(4C$bVV%4T%-h:IK+c:5g&Wo/QI1R=]G<F.UH ;D)hBA}]msUH(Vw3%tuW/'jZB1Q=5J3uH!ddhD#j$
Apr 19, 2024 01:48:08.856535912 CEST	1289	IN	Data Raw: 13 d0 c3 a0 e2 5f ea 75 8e ac 79 45 6f c2 a3 6d e0 53 e8 76 9e 0f d2 68 cc 37 ab f2 03 8a 16 f7 38 92 e2 1b 8b 25 50 79 2a d6 b8 c0 da a9 6e 73 c3 d2 34 e4 9b f1 0c 39 0b c4 f2 60 61 0b 1d 65 f2 13 c0 84 35 42 46 4b 4b cf a9 1a 68 05 71 04 fe c7 Data Ascii: _uyEomSvh78%Pyns49`ae5BFKKhq<!N{-Yr<S3#zIs?WR+![BH}ZMQPm21Re}3q~W2Ub@$4M%Y<KWrEEH
Apr 19, 2024 01:48:08.866421938 CEST	324	OUT	GET /static/css/main.397ec292.css HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:09.234327078 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:08 GMT Content-Type: text/css Last-Modified: Wed, 17 Apr 2024 07:01:30 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f73ca-a4dac" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 36 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 73 1b 39 d2 20 fc 7d 7f 05 b7 3b 26 c2 6a 93 32 ab 78 88 92 62 1c 43 9d 96 6d c9 96 6c d9 96 7a 7b df 28 92 25 b2 24 92 45 f3 d0 c5 d0 7f 7f 71 14 aa 70 24 8e 22 29 d9 cf c6 4c 4f b7 4d 54 22 33 91 48 24 12 09 20 b1 35 8e e3 e9 bc 54 6a c5 e3 4e 38 2e 8d 83 4e 34 9b 6c 79 b5 d1 fd 53 6b 36 9d c6 c3 62 34 1c cd a6 c5 7e d0 0a fb f3 56 d0 be e9 8e e3 d9 b0 53 6a c7 fd 78 bc 15 0d a3 69 14 f4 b7 69 f5 ad 61 3c 0c b7 af e2 e1 b4 74 15 0c a2 fe 03 fa de 0b c7 d1 94 96 4d a2 c7 50 2c b9 0b a3 6e 6f ba 55 2d 97 b7 07 c1 b8 1b 0d b7 ca db a3 a0 d3 89 86 dd ad f2 d3 7a 73 36 ed cd 83 7e d4 1d 96 a2 69 38 98 6c b5 c3 e1 34 1c 6f 53 da 7f 5e 5d 5d 6d 77 a2 c9 a8 1f 3c 6c 5d f5 c3 7b 81 f2 20 1e c6 93 51 d0 0e b7 7b 94 88 57 2e df f6 b6 af 67 93 69 74 f5 80 d8 47 98 86 53 86 71 14 4f 50 43 e2 e1 d6 38 ec 07 d3 e8 36 a4 c4 4b ad ee bc 15 23 31 0c 10 63 fd f0 6a 8a fe 88 6f c3 f1 55 3f be db ea 45 9d 4e 38 cc aa 06 ad 49 dc 9f 4d c3 ed 31 a1 57 de 9e c6 23 d6 0a 84 68 ab 15 5e c5 e3 50 95 61 6f d2 0f 5e 95 8b e5 7f 15 11 8b ff 2a ae d7 6b 6b db 1c 50 34 08 ba e1 d6 6c dc 7f d5 09 a6 c1 16 f9 f9 66 34 ec 22 98 49 58 af 16 a3 6f 3b 9f ce ee ca 1f 0e bb 71 13 fd ef e4 cb 79 6f ff bc 8b ff ba 8f ff b3 bb db bc c0 7f 5c 76 5b 17 43 5c 70 f8 e3 ec e0 fb bb b3 af 2d ff b2 dc f1 0f 1e 2e 4f 77 76 2e 0f 37 a3 cb 2f 3b ef 5b df 0f 86 97 df de f7 2f be 9f d5 da ed 7e ff 33 ae f0 70 39 fa 76 d0 2b 7f df f7 8e 3f 0d 4e 6e 5b 5f 6a 3d 0a 5f ab b6 7e 34 e9 ff f6 ee de 84 ef 76 7a 17 fe b4 df d9 dd 89 2e bf 77 46 ad eb 72 b4 b1 31 7b 73 14 ed 8c 2e f7 ca d1 b7 c7 6f 27 c7 fb de dd a9 ff 2d 0e ce 7b f5 f6 e0 db d7 f0 a6 76 7e 51 19 8d 2f 1e fb 37 47 d7 8d d7 47 7b f7 d5 4f c3 de b4 7d e8 f5 3b 87 fb dd f0 d0 9b b4 86 c7 f5 10 d5 47 3c dd 5e 0c ce eb f8 77 eb fb b7 f2 c5 97 46 74 f4 ae 5b 47 30 77 9d c3 c9 e6 d1 cd c1 4d cb 7f df 3f 3a e8 9d 9c ef ee ec b5 2a e8 ef 7b e7 b3 93 c8 bb 3e fe 7a ea 1d ed b5 6b 1f af f7 fd e3 c7 d3 da a7 2f 77 dd e3 eb e6 fd a7 dd c6 1d fa f7 fe f8 a1 7c 7f 72 1d 97 8f f7 e2 87 e3 a8 d9 3d da 4d fe bd ae 76 3f bf 7b 7f 73 79 3d fa 72 b6 7f 91 f2 d3 1e 9c 0d 3e 7f 79 1f 77 de 9d dd 7d 8a 1a b7 9d 4a a7 f2 71 d8 7e fc 38 d8 7c b8 7c 68 dc 7f fa 7a 53 fb f8 d8 7c f8 f8 78 f4 f0 f1 07 aa 1f 79 8f e1 f7 5a f9 e2 47 77 8a ea 5f 73 78 f7 2f 7f 9c 5c b7 07 7d d4 86 fe 6d 2b da 79 b8 3c bc a8 5f 7c 7f 7f db f9 71 ba 79 14 1d 65 32 40 ed e4 69 a2 b2 59 22 93 d9 85 bf 39 Data Ascii: 6000is9 };&j2xbCmlz{(%$Eqp$")LOMT"3H$ 5TjN8.N4lySk6b4~VSjxiia<tMP,noU-zs6~i8l4oS^]]mw<l]{ Q{W.gitGSqOPC86K#1cjoU?EN8IM1W#h^Pao^kkP4lf4"IXo;qyo\v[C\p-.Owv.7/;[/~3p9v+?Nn[_j=_~4vz.wFr1{s.o'-{v~Q/7GG{O};G<^wFt[G0wM?:{>zk/w\|r=Mv?{sy=r>yw}Jq~8\|\|hzS\|xyZGw_sx/\}m+y<_\|qye2@iY"9
Apr 19, 2024 01:48:09.752621889 CEST	322	OUT	GET /static/js/main.63007f25.js HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:10.119652987 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:09 GMT Content-Type: application/javascript Last-Modified: Wed, 17 Apr 2024 07:01:30 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f73ca-3a4480" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 34 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 6d 7b da c8 b2 28 fa fd fe 8a 84 b3 56 1e 09 1a 8c c0 c6 36 58 e1 71 9c 64 cd ec 89 c7 99 24 f3 92 21 ec 3c 42 34 a0 89 90 88 24 1c 63 9b f3 db 4f 55 f5 8b 5a 42 38 c9 5a b3 cf 87 7b ef 9a 15 a3 7e af ae ae ae aa ee ae ae 3e a8 3f 7e f4 32 4e 1e 85 81 cf a3 94 3f 0a a2 59 9c 2c bd 2c 88 a3 47 ab 90 7b 10 95 72 fe 68 e9 05 51 ab d7 6d b7 8f 67 9d a3 d6 5f 69 eb d5 8f 17 2f 7e 7e fb a2 95 dd 64 8f ea 07 ff cf e3 d9 3a f2 b1 90 65 df 5d 7b c9 23 ee de 9d 9e b6 4f fa 3a 9a b3 cc be ab ad b1 ba 2c 09 fc ac 36 c0 6c 91 6b 94 53 9f 8f 38 04 b2 45 90 b6 3e f2 6b 1e 65 a9 7b b7 dd 26 3c 5b 27 90 d4 5a 25 71 16 67 9b 15 6f c5 46 69 a8 9e 45 f6 9d cc 65 16 1e f1 f1 fd bd 55 8a 71 47 63 9b 95 e2 5a ab 75 ba b0 ee 7c 2f 0c 27 9e ff a9 9f b1 38 f2 79 ff f1 e3 68 2b f2 6e 59 b1 75 9f bb c5 ee 99 ad 4b 98 1e b7 ed 62 31 be 0c 32 a3 18 f4 3a 4e 2c 44 45 e6 62 39 16 01 68 2c 71 9d 41 72 e6 25 f3 f5 12 81 6b 85 3c 9a 67 8b 41 d2 68 d8 d1 28 69 3a 63 57 a7 8d 92 31 61 32 76 77 3a 0d 15 05 c5 d8 5a bd 26 e2 bd 1c 84 24 07 21 76 13 d9 14 14 6c 0f 82 b3 78 10 40 93 c1 cc 4a 46 c1 58 0c ac e7 e2 37 f3 5d af a5 30 35 f0 08 19 4f 9e 58 49 2b 5d 21 21 59 01 73 6c d6 76 5d 5d e1 93 27 53 1e f2 8c 3f ca 0c 10 59 dc 6c b2 a0 d9 b4 99 df f2 56 ab 70 63 e1 20 6e b7 03 cf 8a 6d e6 59 41 09 77 f1 6c 56 c2 38 80 c6 11 be 2c ef 44 54 89 88 c4 8d 54 d7 62 e8 5a 7c 96 0c 62 c2 66 3c d6 fd 00 70 33 e8 44 a4 3a 11 63 27 12 00 11 c0 b4 07 d8 9b 68 a7 37 c5 a6 b6 3c 04 02 af 4e 1b 50 5a 89 ac 07 06 c9 14 fb 3a e7 d9 0b 91 cb 98 21 15 e4 0d a5 b6 96 3d c8 5a 7f ba d1 96 75 9d a3 4e bf 3c 29 76 66 1d 20 c3 ea 76 da 5d 1b 70 11 59 38 4f 6d 18 f0 c8 3a 3e e9 75 6c 93 36 b8 31 29 33 44 b2 40 30 27 94 d1 9c b2 ef ef f1 67 10 b5 a6 1c 9a 88 37 7c ea 3e 76 54 2b d8 8b e7 7c e6 ad c3 ec 62 36 07 30 65 07 a2 96 3f 9b bb 56 9b 05 ad 8b e7 b6 95 c0 50 b2 48 4e 71 88 4d 5a 7f be b3 81 16 38 cc bb 22 4a f2 ca 76 d1 02 4c a2 9c bd d0 13 13 79 d0 3c 0e 57 21 7f 5a c8 8f d4 65 64 75 b3 62 66 d9 5b 13 0a 95 db bd d3 a8 e8 3f 6e 6f 05 9b 01 d2 b5 24 c7 31 10 85 a9 5b 2b 6e fd 29 06 d0 db b2 ce e1 c9 e9 c3 03 08 98 06 d4 dc fd d9 df 41 c0 a3 bf f8 76 6b 0b dc b3 98 46 54 8c b2 07 5f 27 c7 3d 98 66 f8 71 d8 81 e1 4e f5 70 87 48 02 dd 36 a4 ae dd 36 5b c1 bf 29 fc 9b b9 0e ef b2 09 7c 2d e0 df 25 fc bb 75 6b f1 e4 2f 0e 20 e0 3c 01 1c c4 b3 47 2b 9e 90 b4 a0 d9 6f 04 5a 51 fc 65 Data Ascii: 4000m{(V6Xqd$!<B4$cOUZB8Z{~>?~2N?Y,,G{rhQmg_i/~~d:e]{#O:,6lkS8E>ke{&<['Z%qgoFiEeUqGcZu\|/'8yh+nYuKb12:N,DEb9h,qAr%k<gAh(i:cW1a2vw:Z&$!vlx@JFX7]05OXI+]!!Yslv]]'S?YlVpc nmYAwlV8,DTTbZ\|bf<p3D:c'h7<NPZ:!=ZuN<)vf v]pY8Om:>ul61)3D@0'g7\|>vT+\|b60e?VPHNqMZ8"JvLy<W!Zedubf[?no$1[+n)AvkFT_'=fqNpH66[)\|-%uk/ <G+oZQe
Apr 19, 2024 01:48:13.225171089 CEST	372	OUT	GET /images/hook.svg HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:13.587045908 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:13 GMT Content-Type: text/html Last-Modified: Wed, 17 Apr 2024 07:01:30 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f73ca-1e9a" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 63 34 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 59 0b 73 db b8 11 fe 2b 34 73 f1 91 35 45 3d 1c 39 36 69 da c9 e5 32 4d da a4 c9 5c dc 99 76 5c f7 06 12 57 12 12 12 50 01 50 b6 4f e2 7f ef 02 e0 4b 0f 67 da 38 b1 45 00 8b dd c5 3e be 5d 50 97 47 29 9f aa c7 25 38 0b 95 67 57 97 fa af 93 11 36 4f 5c 60 2e 8e 81 a4 57 97 39 28 e2 4c 17 44 48 50 89 5b a8 59 ef dc ed 57 d3 8c e4 90 b8 2b 0a f7 4b 2e 94 eb 4c 39 53 c0 90 ec 9e a6 6a 91 a4 b0 a2 53 e8 99 41 40 19 55 94 64 3d 39 25 19 24 c3 40 2e 04 65 df 7a 8a f7 66 54 25 8c 6b a6 8a aa 0c ae de 7d fa f4 d7 5f 3e dd 38 9f 5f ff ed ed 87 cb be 9d bc cc 90 da 11 90 25 ae 54 8f 19 c8 05 00 4a 5c 08 98 25 6e 9f 48 d4 4e f6 67 28 9f dc 83 e4 39 f4 a7 72 6b 1c e6 94 85 38 e7 fe 18 27 92 65 3f c0 41 f6 29 9a 44 f6 0d d5 0f ee 5d 82 c8 a9 94 f4 c7 f9 e4 45 46 e5 e2 89 cd 64 b9 cc 00 bd 50 4c 17 3d 2d d0 75 24 fd 03 64 e2 0e cf 07 0f f8 bb c7 92 ac fa bb 7b c2 25 9b 6f 31 b5 8c 74 68 e1 73 4e e6 d0 d7 14 35 e7 d3 d1 c3 e9 e8 10 5f fc d5 3b 7b 86 e0 ff 64 3a 3c 7b 18 9e 7d 8f a9 21 d8 63 9a 13 46 67 20 f7 2d 87 3b 25 55 10 de c3 a4 a1 d9 de 28 bf 55 06 3b b0 93 cc 88 a0 bd 25 65 0c d2 9e 22 93 50 ae e6 3a 3d 32 2e 12 f7 d9 78 32 21 e9 d8 dd 4a a2 5c 6a ab d2 29 51 e8 e9 de 0d cd e0 8d a6 ee e4 d4 b3 94 8c 4f 47 d3 ed 6d 6a 01 39 f4 a6 bb a4 33 f3 83 a4 c6 e9 57 13 9e 3e 06 3a bd d7 39 11 73 ca a2 41 bc 24 69 4a d9 3c 1a 94 cf 26 9c ab 8c 93 14 c4 3a a5 72 99 91 c7 68 96 c1 43 4c 32 3a 67 3d 34 42 2e a3 29 f2 05 11 7f 2d a4 a2 b3 c7 5e 25 a9 9e d6 e4 bd 94 0a 98 6a ed 23 54 a7 c8 59 6c f2 3e 1a 0e 06 ab fb 78 01 74 be 50 66 b0 88 15 3c a8 9e e1 de 30 40 7e bd 19 c9 69 f6 18 7d 34 e1 1a 48 c2 64 4f 82 a0 b3 78 2e 68 da 13 fc be 37 27 cb 68 38 5e 3e c4 13 32 fd 36 17 bc 60 a9 3d 7b f4 6c 38 1d ce 46 a7 71 35 c2 c3 c7 4b 8e 0e d4 ea a0 bf d0 aa 2b 88 ff e8 51 96 c2 43 74 71 71 51 3e 5b 0a 3e 17 20 e5 7a 9f ae 52 76 74 7e 58 d2 99 fe 57 9d 6e 74 36 40 22 0c 90 dc 38 2e 92 0b 92 f2 fb cf 45 26 c1 21 19 1e 8d 11 05 ce 58 3a 40 24 a0 f8 1e 2f 94 43 d9 4c a3 21 b4 4a fc ae 04 ca 69 55 21 13 89 36 54 10 d7 86 fe f9 e7 58 f1 25 fa 6d c2 95 e2 39 3e 64 30 53 7a bc a7 df 98 5c a4 a7 a3 ee 82 c9 96 08 63 17 88 e8 cd 05 49 29 b2 f4 7a 2f c6 29 cc 03 31 9f 10 6f 34 1e 07 f5 6f 38 f2 9d d1 f8 79 80 2a 31 b9 24 02 69 f7 c6 e3 c1 f3 c3 1b 9f 5c 78 b9 c3 61 67 ec 77 f5 d5 29 6d ac ef 18 17 b4 d6 cd f9 ca 18 d3 1e a5 b1 63 6c 18 55 96 cb 32 27 1c 6e d9 bb 7c f5 0d 1e 67 02 f3 45 3a 1d ff ac 07 cf d7 Data Ascii: c48Ys+4s5E=96i2M\v\WPPOKg8E>]PG)%8gW6O\`.W9(LDHP[YW+K.L9SjSA@Ud=9%$@.ezfT%k}_>8_%TJ\%nHNg(9rk8'e?A)D]EFdPL=-u$d{%o1thsN5_;{d:<{}!cFg -;%U(U;%e"P:=2.x2!J\j)QOGmj93W>:9sA$iJ<&:rhCL2:g=4B.)-^%j#TYl>xtPf<0@~i}4HdOx.h7'h8^>26`={l8Fq5K+QCtqqQ>[> zRvt~XWnt6@"8.E&!X:@$/CL!JiU!6TX%m9>d0Sz\cI)z/)1o4o8y*1$i\xagw)mclU2'n\|gE:

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:08.130631924 CEST	339	OUT	GET /assets/fonts/icons/style.css HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:08.497270107 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:08 GMT Content-Type: text/css Last-Modified: Wed, 17 Apr 2024 06:57:55 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f72f3-db0" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 33 36 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 96 dd 6e db 38 10 85 ef 03 e4 1d 58 ef 85 9b a0 6a 22 35 69 12 17 c1 ee 06 dd 05 8a a2 68 91 76 7b b3 7f 18 49 23 89 6b 8a 14 48 3a 8e 5b f4 dd 3b 94 9d a4 5c 2b 23 fb 4e 24 bf 99 e1 21 cf 98 bf 54 46 fb a4 82 02 c5 d7 fd 3d 21 36 9f ad 54 ab 99 98 ca c2 b4 c6 e8 e9 ab 30 e5 6c 31 13 62 61 d5 d3 69 58 e5 8e 36 b3 cf d1 f8 9f 4f 41 a5 67 30 3d d8 75 e5 4f 12 2b 79 3b 3d a0 84 b6 05 ff 74 8a 6d 8e 65 89 65 62 3a d4 7e d5 e1 f4 e0 59 88 35 18 c7 fb ea 3e e3 7d 04 6f 17 38 06 2e 4d 35 40 86 51 8e 72 37 f5 7d d9 1b 45 1e 60 9a dc 6c bb d7 6e 89 b2 6e fc 4c e8 30 ad 1e c6 9d 5f 29 dc 1e 2e a5 eb 14 90 d6 b9 32 c5 9c c6 bf ed ef ed ef fd 59 28 70 ee 9f cb 09 a5 d3 c9 e4 ef 67 62 3d 72 78 39 11 9b a1 f5 71 1d 1d 8a 85 43 f1 44 b6 9d b1 1e b4 17 de 88 ce e2 0d 69 28 a4 73 0b 74 62 29 7d 23 72 6b 96 0e ad c0 5b 8f da 49 a3 9d f0 0d 78 51 34 a0 6b ec 6b 71 e2 f0 e8 f1 2b f0 43 8e f5 19 77 08 73 da 0f a5 b2 a3 bb 7c 4c 94 1b b0 92 02 46 13 9e 4a 4c bc 05 ed 82 c2 61 4a 63 3f a1 a4 c6 a4 d9 44 4a 5f 05 9d 7a 01 ae d0 7b da d9 ef 14 50 5c a3 2e d1 4a 5d 8b cb 87 df 66 5f 54 45 3e 97 b4 b5 be 50 da 94 6f 68 e1 4c 50 01 12 94 04 87 65 9f 27 69 cd 97 c4 b8 db ad 85 b5 85 95 2b 40 e1 dd 31 3d ef cf c2 a3 42 9a 6a df d0 c7 2c 47 aa 7a e3 25 fa 26 b1 a9 d8 c9 5f 78 71 7c 3c 59 63 6b a8 6e 41 2a 66 75 1a ad fe b5 28 cc 42 fb 2b 73 cb 20 59 8c 94 ad d4 1f 40 a3 fa 48 fa 50 fd 8e 41 5f 44 68 6e 7c 92 2b 28 e6 4a 3a cf 50 27 5b 14 dd 95 16 74 c9 a5 3a dd 82 4a d2 cf 23 83 bc dc 42 a4 fe 0f 0b cf a5 39 db 62 94 9c 73 49 ce b7 80 ae a1 9b c7 10 17 ff 27 1c d5 b5 ee 0a e4 af 5e 8b b0 f8 f1 00 c0 07 68 0d 29 c3 e0 f9 10 1e 74 09 ee 4e 42 27 74 49 0e 7a ce c9 54 ec 10 a3 00 cb 9e 68 b9 4b 0c bb ea 38 29 70 87 18 18 2c c3 15 52 ed 10 c4 35 a6 63 62 a4 c7 3b c4 58 82 a2 1b cb 45 89 dd 1b e6 80 bd ae 69 ec dd da 98 5a 61 02 0b df 30 4c 6c da 46 96 48 cd ca 25 bc 69 d3 d8 b4 52 3b 1f 76 53 26 d0 b1 ba c4 b6 7d 8b ab dc d0 b5 08 2d ef dd 6b 06 8b ad 3b c7 95 32 75 8d 96 21 62 e3 be 03 3b ff 2d 9c fb 35 42 c9 50 e7 c3 d4 1f da f2 5c ec e1 f7 55 15 fe 64 ae 8c e2 14 8c 6d db 2d 5c 33 a6 79 ec d4 bb 7e 4c 4d 1d 9d 93 b9 54 d2 af 18 3a f6 a8 a3 73 ce c1 8e 39 3b 2d 87 29 c3 5e 43 1c 84 46 1a 40 5a 0d 53 bc e5 b3 e3 41 6a cc e4 59 3a 88 3d 78 94 41 b3 41 94 6e a4 59 70 85 be 18 c4 3a b4 2d 3d b0 46 52 9e 0c b2 6e f4 1f 39 3b 1d 06 f9 ee 95 bd 1c a6 3c 70 a7 9e 9d 3d 42 21 28 b4 1c 78 3e 08 d2 83 94 a5 2e 06 a9 Data Ascii: 36bn8Xj"5ihv{I#kH:[;\+#N$!TF=!6T0l1baiX6OAg0=uO+y;=tmeeb:~Y5>}o8.M5@Qr7}E`lnnL0_).2Y(pgb=rx9qCDi(stb)}#rk[IxQ4kkq+Cws\|LFJLaJc?DJ_z{P\.J]f_TE>PohLPe'i+@1=Bj,Gz%&_xq\|<YcknA*fu(B+s Y@HPA_Dhn\|+(J:P'[t:J#B9bsI'^h)tNB'tIzThK8)p,R5cb;XEiZa0LlFH%iR;vS&}-k;2u!b;-5BP\Udm-\3y~LMT:s9;-)^CF@ZSAjY:=xAAnYp:-=FRn9;<p=B!(x>.
Apr 19, 2024 01:48:08.497303963 CEST	66	IN	Data Raw: d1 a6 9a c5 be 1b 6f 75 59 6c bb 4f 90 2b fc 2c 71 c9 10 b1 d5 3e cb 71 77 66 b1 cf 60 fd 50 e3 b6 11 7b ac 7f 07 fe db 52 23 80 9a 79 6c 64 77 1e fb 0e 12 8c 27 93 b0 0d 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ouYlO+,q>qwf`P{R#yldw'0
Apr 19, 2024 01:48:53.511871099 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:08.475831985 CEST	351	OUT	GET /assets/fonts/icons/permissions/style.css HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:08.821645021 CEST	995	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:08 GMT Content-Type: text/css Last-Modified: Wed, 17 Apr 2024 06:57:55 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f72f3-569" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 32 30 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 93 cb 6e db 40 0c 45 f7 fe 0a d6 5d 28 36 a2 d8 e9 2b 8e 0d a3 45 17 fd 80 6e d3 16 18 8f 68 69 a0 d1 8c 30 a4 fc 68 d1 7f 2f 25 19 ce 00 89 ec 6a 27 f2 90 97 bc 94 be 6c bd e3 74 ab 34 c2 9f 11 c0 e9 ad 32 f6 b8 84 c4 68 5f 79 ef 92 95 64 28 e8 25 40 13 ec 4d d2 42 34 3b 25 ef d0 f3 67 3d 37 8d 6f 92 c9 7f 82 6f 0d 6e cd 21 99 88 5c a8 14 df 24 58 6d 30 cb 30 4b 7d 8d 8e 8f 35 26 93 5b 69 f5 6a 1b e6 ed 59 ef dc 80 43 83 57 ea f6 7e fb 4a 61 1b bd 50 44 bb fc 3c f3 c9 8c e7 5a 49 f6 2b 77 ae ed d1 e4 05 2f c1 b5 59 7b 0e 13 1f 2d be 88 66 86 6a ab c4 e3 8d f5 ba 5c 8d fe 8e 46 4f da 2a a2 5f eb b1 08 b9 74 fc f3 16 fa c8 74 3d 86 53 a8 3b d1 6c 0a 0d 21 bc 31 55 ed 03 2b c7 c0 1e ea 80 3b 71 0e 0c 51 83 04 7b c3 05 6c 82 df 13 06 c0 03 a3 23 e3 1d 01 17 8a 41 17 ca e5 d8 cd 41 30 9d 0d 5e 3d 92 e8 ee 5a a3 2a 65 11 11 0a 57 b6 1b b0 62 a7 82 91 66 71 9c 65 b8 94 83 72 d4 9a da 66 1c b6 71 6b 1c a6 c5 a9 cd fd 6a d4 ef fd 15 99 65 a1 6f d2 0c be a3 cb 30 18 97 c3 fa f9 e9 d7 11 fd 4d 69 64 a3 6e 42 d9 85 0b e1 96 20 da 46 59 a3 08 b3 56 23 ad fc ef d4 d3 e1 05 97 07 75 24 ad 2c 76 77 b9 eb cc a7 bd a9 71 b9 41 19 b3 ff 53 24 28 b6 ca 74 e3 1f f8 f0 f8 6e dc b2 3d ea 5d 89 c7 61 f4 7d 84 6a 6b 74 a9 b8 75 61 b8 e0 43 5c d0 5c 81 3f 46 b0 f5 2e 67 55 0f c3 9f 22 98 10 b3 61 f2 21 22 05 d9 ab 90 a5 e2 90 1d ae 58 44 15 0d d1 85 de 8f 11 79 a1 e5 62 3e 8f 8d 90 8c d2 4c c3 f4 7d 7c 12 f9 66 db df 6d 10 8e ef 47 3a 20 b6 ee e9 72 d8 92 c5 3c be e3 ce e9 61 b0 bf df 3f d1 ef 6d a2 69 05 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 203n@E](6+Enhi0h/%j'lt42h_yd(%@MB4;%g=7oon!\$Xm00K}5&[ijYCW~JaPD<ZI+w/Y{-fj\FO_tt=S;l!1U+;qQ{l#AA0^=ZeWbfqerfqkjeo0MidnB FYV#u$,vwqAS$(tn=]a}jktuaC\\?F.gU"a!"XDyb>L}\|fmG: r<a?mi0
Apr 19, 2024 01:48:53.822065115 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:08.484558105 CEST	340	OUT	GET /assets/fonts/mulish/style.css HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:08.838088036 CEST	960	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:08 GMT Content-Type: text/css Last-Modified: Wed, 17 Apr 2024 06:57:55 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f72f3-672" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 31 65 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d5 93 3b 6f db 30 10 80 77 03 fe 0f da 9c a4 61 7d a4 25 59 72 97 ea 45 67 68 9b a2 41 d0 22 4b 20 28 b4 cd 42 92 13 49 b6 a2 06 f9 ef 3d 3e 90 ba 63 bc 59 03 0f 1f 8f 38 0a 1f ef a6 17 4e 31 34 b2 2c 65 41 c4 73 e7 5c 4c c7 a3 cf ab 6d dd 91 55 5e 08 e7 65 3c 72 f0 b3 1b 95 2c 87 85 33 f9 ba 2b 65 bb 99 7c 3a c8 b5 dd 50 8a 85 53 6f 9b 2a 2f 0f 13 bd 90 eb 4d b7 70 5c 80 c3 ed 07 d9 3e 96 39 16 6b fb fc d1 26 da a6 58 38 bb a6 3c a3 df bb 61 1d cc ae 7e dd df 2c 37 eb a7 6b 18 be 14 d5 ef 3f b7 d1 ee a7 78 be fb f6 23 c8 9f f6 4b b7 27 1f fb ed 6a c5 ce b1 22 de da 9d 4d 34 4e ce 6d b9 5d 2d 8b ed 83 20 4d 5e af f1 d7 6e 3f 80 eb 03 01 8f f1 4b 04 9a 04 40 70 09 14 30 88 5d 1d d3 0c 08 4b b9 3e 11 f9 2e 90 c8 0f 35 f0 8c 65 04 17 8e c5 5f c7 a3 e9 3f 6b 27 62 ec fa 28 63 33 a0 97 da 1c a0 39 d7 e3 06 42 05 a1 cd c4 0a 62 0d 8c 52 ff cd cf 5e 8a ae ce 2b d1 8a 13 31 24 8f 32 44 81 11 5c 66 5a 06 a5 28 83 52 63 86 b2 00 81 85 06 7c 05 be 85 48 1d 8b ec b1 88 23 c4 a0 9b 32 c3 0c cd 78 68 9a 32 8a df 6c 96 79 27 eb 13 1a d0 ea 48 99 28 86 b9 a6 cd 98 17 1a 27 a0 9d 70 e3 84 81 75 83 83 8a 82 2c a4 08 09 b7 3d a8 df 82 25 38 ec 2c 99 9b 51 9e 33 1c e5 39 e7 ff fb 3c 11 97 62 bf ec df 6b 12 94 49 30 d2 80 ce 6c ab 79 aa 57 3d d3 ab 2c 8e d1 75 9c 18 48 7c 13 d3 c8 c6 c4 98 05 a5 d9 b7 ee e7 ae d5 6d 92 94 31 13 43 3b fd a1 31 8f 09 1b 3d 15 b9 7d 3b ce 79 aa fc ff 05 9f 9c 77 ff 72 06 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1e0;o0wa}%YrEghA"K (BI=>cY8N14,eAs\LmU^e<r,3+e\|:PSo*/Mp\>9k&X8<a~,7k?x#K'j"M4Nm]- M^n?K@p0]K>.5e_?k'b(c39BbR^+1$2D\fZ(Rc\|H#2xh2ly'H('pu,=%8,Q39<bkI0lyW=,uH\|m1C;1=};ywr0
Apr 19, 2024 01:48:08.900336027 CEST	418	OUT	GET /assets/fonts/mulish/1Ptyg83HX_SGhgqO0yLcmjzUAuWexZNR8aevGw.woff2 HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive Origin: http://154.61.80.57 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://154.61.80.57/assets/fonts/mulish/style.css Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:09.253971100 CEST	439	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:09 GMT Content-Type: font/woff2 Content-Length: 11232 Last-Modified: Wed, 17 Apr 2024 06:57:55 GMT Connection: keep-alive ETag: "661f72f3-2be0" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Accept-Ranges: bytes
Apr 19, 2024 01:48:09.254072905 CEST	1289	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 2b e0 00 10 00 00 00 00 65 28 00 00 2b 7f 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 64 1b b3 36 1c 85 4a 06 60 3f 53 54 41 54 48 00 85 02 11 08 0a f5 10 dd 0d 0b 84 1e 00 01 36 02 24 Data Ascii: wOF2+e(+d6J`?STATH6$* U<#(U+1A/ih^+VMh53ZZa{G~b8X7}w{zK6a$dca5pE.#h(H
Apr 19, 2024 01:48:09.254112005 CEST	1289	IN	Data Raw: 1d 71 91 e5 74 70 c3 62 dc f7 78 11 d6 7c 08 11 ac 7e d7 bd 64 44 dc 52 7d 7f 79 0e 8a 7d b0 17 0d 44 35 eb 9b d8 c4 bb 70 43 53 2e 58 a6 1b 48 7b 62 cd e5 9d 20 8f 9f ec fd 20 ce c0 5d 9a a2 0f d4 bb 5a 93 d8 31 6d 02 69 b7 4b 5f 41 e2 75 81 83 Data Ascii: qtpbx\|~dDR}y}D5pCS.XH{b ]Z1miK_AuJ5DjgReLCqb,jz=H\0rb\mx?~5127Ib,nx5Faz3fZC@Ev=s?6Zp#-HYc"]Fe/52^+u:M
Apr 19, 2024 01:48:09.254148960 CEST	1289	IN	Data Raw: 8d bf 9d 4d 01 b0 5d b4 56 dd 86 8d 35 c5 09 ab 6d c6 dd ef 08 f1 93 2e b8 f4 86 be 0b 78 52 d0 36 57 2b d1 e9 a7 0e 26 fa ec cd ac 25 ba 02 08 91 60 85 cc b8 87 81 a5 45 04 2a 28 05 52 80 15 4c 5a fb 87 3a 36 29 64 ee 21 50 6e 1f e4 df 25 b4 21 Data Ascii: M]V5m.xR6W+&%`E*(RLZ:6)d!Pn%!b,4uZ"P>T7/h-6dBp+2 fwo`=aj= &^(^(CAY#M=^Z`'t4pUH3$?CoRRfP
Apr 19, 2024 01:48:09.254187107 CEST	1289	IN	Data Raw: 85 d7 c2 1a 1e 24 9b a7 70 9a 7c ec b5 cc fa ea 56 8d 06 e3 46 70 a1 05 eb d8 bb 6f 5f 44 21 69 fe e1 01 92 90 ff 00 15 0c 4d d3 c5 52 b6 87 e1 cd e8 0d ed 38 95 eb 67 50 f9 f4 3a df d6 70 dd 88 71 fe de 00 07 66 89 81 54 8e 38 f5 57 12 54 50 fc Data Ascii: $p\|VFpo_D!iMR8gP:pqfT8WTPpUY=qklu#fH^EKc+US;@{!RBW>Hf@2~-}4@R#OQy)j)?nWcY
Apr 19, 2024 01:48:09.254225969 CEST	1289	IN	Data Raw: 1a f9 52 a8 ee aa 3d e1 30 5e b5 24 30 31 f3 47 4b d5 e4 fb 94 f9 3b 71 fe 74 c7 cc 95 a4 7e b2 fa d3 61 c4 f6 c8 36 19 d8 33 d8 c4 9a 67 90 f9 35 10 6a 4c b6 de 80 33 c7 9b 0f 46 a9 38 2a 63 39 e6 1b 2e 1b 43 ed 9a d1 8e f0 3d 65 33 c2 68 ba 5c Data Ascii: R=0^$01GK;qt~a63g5jL3F8*c9.C=e3h\n`>C2kf1Me}tv/Q2Qzcg-7RKJfQ{\rm:>pNWv5q\|WZl;'sN'Qm92iV,?=tu
Apr 19, 2024 01:48:09.254265070 CEST	1289	IN	Data Raw: 20 64 f5 f9 2d a2 e5 d3 80 fe 9b a4 89 f0 6e ff d5 99 57 25 1a ad 5e b5 2e ec 85 0f 96 c9 ab 04 dc 56 bd 8e db a2 2f 85 1c f6 ca 5e 6e c1 34 1a 05 fc 94 a1 d6 40 5b 2f 5d cb 2b 9d 4e 4b 85 5a 65 ab 60 21 5b 25 30 5e 41 5c 91 1a af 40 52 e2 a8 2c Data Ascii: d-nW%^.V/^n4@[/]+NKZe`![%0^A\@R,S+6E0>AV^OyoO)H]RYa{Q7Vciuow\|4E0`"Byb)\|%GgKs3W@*QxbS@FU/,0!>R>~;bwD
Apr 19, 2024 01:48:09.254337072 CEST	1289	IN	Data Raw: 5d 4a b8 56 98 d7 68 2f 02 79 39 ab d6 9c 5d 8d 93 68 52 bf eb b0 4c ea 70 d9 22 a5 90 9b 4e 94 e4 f6 f5 87 7d b3 09 98 09 62 19 93 f6 49 16 49 e3 b3 48 0f 32 d3 a3 a8 06 ae 8c f6 47 7a ea 30 89 20 4e a8 f6 4d 1a 92 b3 c5 6a 7e 0e 2d 8e 8a 79 d3 Data Ascii: ]JVh/y9]hRLp"N}bIIH2Gz0 NMj~-y]h[81Ol6<p.Ig'dd455idg+#R\|h,I$/40Kb_lKsdBKS1. SwOc7?)(?vs,8-f4y
Apr 19, 2024 01:48:09.254375935 CEST	1289	IN	Data Raw: 12 71 07 aa fd 65 ad 26 c4 dd ea af 76 07 4c 85 1c ae c1 68 e2 ea 39 6c ae de e4 27 25 b8 cd ee b6 9a 64 a4 05 21 13 14 10 bb db 64 9c c4 e6 e4 eb 8d 48 fb 2f 32 70 ff 2f ef 2e 41 5b 5b f1 84 cf 27 da dd d5 b1 57 e4 eb 3e 52 ea 9b 6c b5 73 86 1c Data Ascii: qe&vLh9l'%d!dH/2p/.A[['W>RlsrmsJ elT9,e&/,i?TQ~cdIeiY?TQ\Cu-`=*5j4IH\D'L&X3enHmnVv3
Apr 19, 2024 01:48:09.254412889 CEST	920	IN	Data Raw: 27 42 71 58 99 9e a1 73 0c fd d3 8c 3b 37 e7 c9 d4 7e 20 7e ca bf fb d7 fe a8 e0 65 97 ef dc d8 de f7 e0 13 1f e5 7d 9f 39 c9 a1 ef 2c b2 72 bb 72 62 1f 4c 90 06 f5 9c 0e 77 ab 95 56 07 64 b0 f1 14 81 4a 2a 77 cf 96 06 cd fb 47 f5 9f 5e 0a d0 8c Data Ascii: 'BqXs;7~ ~e}9,rrbLwVdJwG^/3<ar?;7[v3s^ :,]O;Ur$C+.mFMP#G8}go([+]~Dn\!&~1JsWt!z
Apr 19, 2024 01:48:09.347264051 CEST	385	OUT	GET /assets/fav/favicon-32x32.png HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:09.701302052 CEST	436	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:09 GMT Content-Type: image/png Content-Length: 2052 Last-Modified: Wed, 17 Apr 2024 06:57:54 GMT Connection: keep-alive ETag: "661f72f2-804" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Accept-Ranges: bytes
Apr 19, 2024 01:48:09.701342106 CEST	1289	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 Data Ascii: PNGIHDR szzgAMAa cHRMz&u0`:pQ<bKGDtIME5g~UIDATXkh\s+Y^YpDz:ukbP$5\|J)Z!J?@)N4K]7M:BdIeiZ;jW
Apr 19, 2024 01:48:13.225323915 CEST	387	OUT	GET /assets/images/login_poster.jpg HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:13.578668118 CEST	439	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:13 GMT Content-Type: image/jpeg Content-Length: 18418 Last-Modified: Wed, 17 Apr 2024 06:57:55 GMT Connection: keep-alive ETag: "661f72f3-47f2" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Accept-Ranges: bytes
Apr 19, 2024 01:48:13.935400963 CEST	345	OUT	GET /assets/images/login_sd.mp4 HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: identity;q=1, ;q=0 Accept: /* Referer: http://154.61.80.57/ Accept-Language: en-US,en;q=0.9 Range: bytes=0-
Apr 19, 2024 01:48:14.288975954 CEST	473	IN	HTTP/1.1 206 Partial Content Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:14 GMT Content-Type: video/mp4 Content-Length: 6265758 Last-Modified: Wed, 17 Apr 2024 06:57:55 GMT Connection: keep-alive ETag: "661f72f3-5f9b9e" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Range: bytes 0-6265757/6265758

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:10.258236885 CEST	293	OUT	GET /static/css/main.397ec292.css HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:10.614973068 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:10 GMT Content-Type: text/css Last-Modified: Wed, 17 Apr 2024 07:01:30 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f73ca-a4dac" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 36 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 73 1b 39 d2 20 fc 7d 7f 05 b7 3b 26 c2 6a 93 32 ab 78 88 92 62 1c 43 9d 96 6d c9 96 6c d9 96 7a 7b df 28 92 25 b2 24 92 45 f3 d0 c5 d0 7f 7f 71 14 aa 70 24 8e 22 29 d9 cf c6 4c 4f b7 4d 54 22 33 91 48 24 12 09 20 b1 35 8e e3 e9 bc 54 6a c5 e3 4e 38 2e 8d 83 4e 34 9b 6c 79 b5 d1 fd 53 6b 36 9d c6 c3 62 34 1c cd a6 c5 7e d0 0a fb f3 56 d0 be e9 8e e3 d9 b0 53 6a c7 fd 78 bc 15 0d a3 69 14 f4 b7 69 f5 ad 61 3c 0c b7 af e2 e1 b4 74 15 0c a2 fe 03 fa de 0b c7 d1 94 96 4d a2 c7 50 2c b9 0b a3 6e 6f ba 55 2d 97 b7 07 c1 b8 1b 0d b7 ca db a3 a0 d3 89 86 dd ad f2 d3 7a 73 36 ed cd 83 7e d4 1d 96 a2 69 38 98 6c b5 c3 e1 34 1c 6f 53 da 7f 5e 5d 5d 6d 77 a2 c9 a8 1f 3c 6c 5d f5 c3 7b 81 f2 20 1e c6 93 51 d0 0e b7 7b 94 88 57 2e df f6 b6 af 67 93 69 74 f5 80 d8 47 98 86 53 86 71 14 4f 50 43 e2 e1 d6 38 ec 07 d3 e8 36 a4 c4 4b ad ee bc 15 23 31 0c 10 63 fd f0 6a 8a fe 88 6f c3 f1 55 3f be db ea 45 9d 4e 38 cc aa 06 ad 49 dc 9f 4d c3 ed 31 a1 57 de 9e c6 23 d6 0a 84 68 ab 15 5e c5 e3 50 95 61 6f d2 0f 5e 95 8b e5 7f 15 11 8b ff 2a ae d7 6b 6b db 1c 50 34 08 ba e1 d6 6c dc 7f d5 09 a6 c1 16 f9 f9 66 34 ec 22 98 49 58 af 16 a3 6f 3b 9f ce ee ca 1f 0e bb 71 13 fd ef e4 cb 79 6f ff bc 8b ff ba 8f ff b3 bb db bc c0 7f 5c 76 5b 17 43 5c 70 f8 e3 ec e0 fb bb b3 af 2d ff b2 dc f1 0f 1e 2e 4f 77 76 2e 0f 37 a3 cb 2f 3b ef 5b df 0f 86 97 df de f7 2f be 9f d5 da ed 7e ff 33 ae f0 70 39 fa 76 d0 2b 7f df f7 8e 3f 0d 4e 6e 5b 5f 6a 3d 0a 5f ab b6 7e 34 e9 ff f6 ee de 84 ef 76 7a 17 fe b4 df d9 dd 89 2e bf 77 46 ad eb 72 b4 b1 31 7b 73 14 ed 8c 2e f7 ca d1 b7 c7 6f 27 c7 fb de dd a9 ff 2d 0e ce 7b f5 f6 e0 db d7 f0 a6 76 7e 51 19 8d 2f 1e fb 37 47 d7 8d d7 47 7b f7 d5 4f c3 de b4 7d e8 f5 3b 87 fb dd f0 d0 9b b4 86 c7 f5 10 d5 47 3c dd 5e 0c ce eb f8 77 eb fb b7 f2 c5 97 46 74 f4 ae 5b 47 30 77 9d c3 c9 e6 d1 cd c1 4d cb 7f df 3f 3a e8 9d 9c ef ee ec b5 2a e8 ef 7b e7 b3 93 c8 bb 3e fe 7a ea 1d ed b5 6b 1f af f7 fd e3 c7 d3 da a7 2f 77 dd e3 eb e6 fd a7 dd c6 1d fa f7 fe f8 a1 7c 7f 72 1d 97 8f f7 e2 87 e3 a8 d9 3d da 4d fe bd ae 76 3f bf 7b 7f 73 79 3d fa 72 b6 7f 91 f2 d3 1e 9c 0d 3e 7f 79 1f 77 de 9d dd 7d 8a 1a b7 9d 4a a7 f2 71 d8 7e fc 38 d8 7c b8 7c 68 dc 7f fa 7a 53 fb f8 d8 7c f8 f8 78 f4 f0 f1 07 aa 1f 79 8f e1 f7 5a f9 e2 47 77 8a ea 5f 73 78 f7 2f 7f 9c 5c b7 07 7d d4 86 fe 6d 2b da 79 b8 3c bc a8 5f 7c 7f 7f db f9 71 ba 79 14 1d 65 32 40 ed e4 69 a2 b2 59 22 93 d9 85 bf 39 Data Ascii: 6000is9 };&j2xbCmlz{(%$Eqp$")LOMT"3H$ 5TjN8.N4lySk6b4~VSjxiia<tMP,noU-zs6~i8l4oS^]]mw<l]{ Q{W.gitGSqOPC86K#1cjoU?EN8IM1W#h^Pao^kkP4lf4"IXo;qyo\v[C\p-.Owv.7/;[/~3p9v+?Nn[_j=_~4vz.wFr1{s.o'-{v~Q/7GG{O};G<^wFt[G0wM?:{>zk/w\|r=Mv?{sy=r>yw}Jq~8\|\|hzS\|xyZGw_sx/\}m+y<_\|qye2@iY"9
Apr 19, 2024 01:48:10.615037918 CEST	1289	IN	Data Raw: fd 58 e9 f5 da a8 2d 1f af 9b b7 48 e6 d5 d6 f7 fb 59 fb 71 84 fa 68 e7 e4 eb d7 72 14 bc 3b 2b b7 f7 e2 db 8f 7e 0d f1 49 65 f5 91 f4 e7 66 f5 e2 47 f3 f6 f8 4b f5 ee a3 ef 4d 3f 3e 64 34 db 95 b3 2f 97 df 2f 36 8f 06 bd 72 e7 5d b3 fe f1 61 73 Data Ascii: X-HYqhr;+~IefGKM?>d4//6r]as~Hoow_66!_c]Q?>>u7nPR[Tn~8@z48C=6'>Ys,N\WO]_
Apr 19, 2024 01:48:10.615080118 CEST	1289	IN	Data Raw: cd ee 1e 72 66 bd 72 88 0b 23 22 8a 4b fc 9f 71 f7 fd 4d 73 e7 60 82 1c ce 1e 86 2c e3 c2 03 2c bf 9d e0 e0 b4 79 7e 78 e8 f5 c2 77 b8 f0 b0 91 e1 43 c2 45 9d d3 1a 1c 4c 2f 71 53 de 60 7c fb 35 fc e5 c7 ed 41 67 e7 ae 7f d7 aa 9c 60 54 07 c4 db Data Ascii: rfr#"KqMs`,,y~xwCEL/qS`\|5Ag`T:M6ssql^jfo__{Gzuh/o>z~W_i\]\5^h7^@<<j8i!5h" G{qpqS
Apr 19, 2024 01:48:10.615119934 CEST	1289	IN	Data Raw: 66 11 d9 83 e9 5d b9 fd e1 0e 5b f2 e3 bd cb f7 cd c6 e9 c6 a7 f3 f7 b7 37 1f 27 9f af 2e eb 8f 07 df f6 cf 3e 3f 34 7e be eb f9 17 fb 67 af 2b d1 9b 9d cf 8d ca ed d1 ce c7 8f 0f 5f 26 f1 07 c4 d8 cf 0f 3f 47 81 df 1b d5 5f 5f ff ac 9f 4d 2e 0e Data Ascii: f][7'.>?4~g+_&?G__M.{/8>U&:pR2E`^~BVe[x4?vz,nw'gowQcyfPC[0qi\|\|y;h6
Apr 19, 2024 01:48:10.615160942 CEST	1289	IN	Data Raw: 42 3f 29 63 24 d6 57 c4 b5 d7 a4 cd d3 1a 9a ba 99 f1 4a 5c 07 ba e1 9e 4c 50 8d 51 1a 43 b3 10 4b a2 04 16 28 6c 2f 8a 08 e9 da da 36 33 cd eb 7e fa 57 d7 f6 24 f0 c5 75 7f 2d 31 5a 0d d8 e7 50 71 10 20 77 2e 93 e3 b9 fa de 49 4f f3 a0 19 37 40 Data Ascii: B?)c$WJ\LPQCK(l/63~W$u-1ZPq w.IO7@Nv7t;xYCMG<Lg{6dWxH&NRs1WO-q#NPAK*.}1Y$[aK`TDjyl6w
Apr 19, 2024 01:48:10.615202904 CEST	1289	IN	Data Raw: d4 52 14 59 6d 46 bc 0c 52 7e 0a fe 66 9b 75 ff 68 6c 40 65 8d b5 67 18 e3 bd 4c 64 47 d0 f0 68 c7 9d b0 78 d3 ea 14 91 af 80 ac e7 60 24 dc 22 fa 72 70 1c 0f e3 d2 59 d8 c5 c6 ae b8 1b 0f d1 3a 22 98 14 3f 46 ad e4 da 67 01 03 14 8f c3 61 3f 46 Data Ascii: RYmFR~fuhl@egLdGhx`$"rpY:"?Fga?FgM]4A$,.ywDRA 7@ 7KE< \|J,Wt$IG4w?dY8:h'xb3P$byj#6ODb[TZK$7j4<hJ.
Apr 19, 2024 01:48:10.615242958 CEST	1289	IN	Data Raw: 5a 24 04 22 e6 08 6f 86 6d 1c 63 83 fc ca 9b ce c6 c3 b5 a7 a7 bf b1 3d 24 47 fa 59 22 50 64 fd ee a2 69 2f 9e 21 93 7b 8f ea 95 86 68 a2 fb f7 74 3c 0b ff 29 42 d0 f4 93 7a 5b 2a 39 65 81 00 a7 9d d2 1d 9e 3f 92 7b cc e2 de 5d 29 b9 06 5c 6a 05 Data Ascii: Z$"omc=$GY"Pdi/!{ht<)Bz[*9e?{])\jcfe~0 m-I .[xuR0Ej^5]0L.,fKYO?L$'z6W$[f1mN2`R7~46P{:;-\|>LD"9?fEV2x}
Apr 19, 2024 01:48:10.615283012 CEST	1289	IN	Data Raw: 63 32 6b b7 71 7e 07 35 1d 80 57 f7 2b 9e 0f bc 46 ee 6f 54 37 bd 3a 80 a4 20 33 9f 60 aa 6e 06 81 b7 29 34 6d 78 15 43 24 3d af e5 d7 01 92 5e ad 52 ad 95 65 0c 3a 7a f4 e8 2b 0f 7d 17 8c b1 2f 09 27 3d 40 54 01 92 b5 cd aa ef 55 01 24 3a aa 9d Data Ascii: c2kq~5W+FoT7: 3`n)4mxC$=^Re:z+}/'=@TU$:f]xWh6VP(uypNEft@<Lsxe%\#cEK8%$e1d&dfH&N'Y,AN!y"#CI&Pl2:0c2UU4;S?K
Apr 19, 2024 01:48:10.615322113 CEST	1289	IN	Data Raw: 11 e6 cb 08 83 34 46 04 f2 53 b4 21 30 0e a7 58 19 41 72 ef 19 84 91 2e d1 58 68 22 89 54 86 48 d4 b8 bd ac 98 51 20 7b db 24 2c 2f 7f 61 35 b8 be 92 17 7c e5 c6 1a 70 4e 23 d9 a7 70 3e 9a 44 3b be 13 5e 05 a8 59 aa 46 6f f1 fb 07 3e 74 62 47 8a Data Ascii: 4FS!0XAr.Xh"THQ {$,/a5\|pN#p>D;^YFo>tbGs%ILT~E3Q,F1qqL~g}RP_%McQI{Upl7,F07S}wR[@UHhB*z1o<bK~4]Uajfc
Apr 19, 2024 01:48:10.615365028 CEST	1289	IN	Data Raw: e5 df aa 95 c1 5e a4 65 e4 c9 26 97 e7 31 21 14 74 ea 1e a0 11 92 9c 3f c3 79 f8 8a 76 62 59 0e 52 b1 28 2f 29 20 7b 68 fa 52 d4 0b b4 19 89 fb 45 1a 9c d0 d1 b5 96 e6 db 73 68 6f 96 8d 55 2c 72 e3 c2 45 ec 9f 66 d3 67 e7 c3 41 1a 3a 36 4a 74 1c Data Ascii: ^e&1!t?yvbYR(/) {hREshoU,rEfgA:6Jt=0nW\15&n#!g@$2CB29Rp\|'C7IetHLG:$g<=x<HV@H)BpX6>(d\^'p$_>[f}
Apr 19, 2024 01:48:10.966370106 CEST	1289	IN	Data Raw: 91 b4 f4 75 a0 dc 32 e2 95 4f 8c e8 20 c4 86 93 f5 8b 03 ed be 01 2f fe 66 6e 33 86 e0 9b 9c 44 2b b4 74 23 fa c6 0b b7 9f 86 7c e6 ad ac b3 f8 4c 52 a5 df e1 34 94 ed 30 6f 71 d2 1e 87 e1 b0 10 0c 3b 10 0c dd 9d 4a 8e fc 4a 42 78 09 ee 45 e9 d3 Data Ascii: u2O /fn3D+t#\|LR40oq;JJBxEh:mV.gVP>61Hbx1@1Rg!W1R\:yz#;5!asZbCFNLL=9JOP_57/@QJN_V+=}:TB:I9`/ pWzb>O>
Apr 19, 2024 01:48:13.258256912 CEST	291	OUT	GET /static/js/main.63007f25.js HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:13.613679886 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:13 GMT Content-Type: application/javascript Last-Modified: Wed, 17 Apr 2024 07:01:30 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f73ca-3a4480" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 34 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 6d 7b da c8 b2 28 fa fd fe 8a 84 b3 56 1e 09 1a 8c c0 c6 36 58 e1 71 9c 64 cd ec 89 c7 99 24 f3 92 21 ec 3c 42 34 a0 89 90 88 24 1c 63 9b f3 db 4f 55 f5 8b 5a 42 38 c9 5a b3 cf 87 7b ef 9a 15 a3 7e af ae ae ae aa ee ae ae 3e a8 3f 7e f4 32 4e 1e 85 81 cf a3 94 3f 0a a2 59 9c 2c bd 2c 88 a3 47 ab 90 7b 10 95 72 fe 68 e9 05 51 ab d7 6d b7 8f 67 9d a3 d6 5f 69 eb d5 8f 17 2f 7e 7e fb a2 95 dd 64 8f ea 07 ff cf e3 d9 3a f2 b1 90 65 df 5d 7b c9 23 ee de 9d 9e b6 4f fa 3a 9a b3 cc be ab ad b1 ba 2c 09 fc ac 36 c0 6c 91 6b 94 53 9f 8f 38 04 b2 45 90 b6 3e f2 6b 1e 65 a9 7b b7 dd 26 3c 5b 27 90 d4 5a 25 71 16 67 9b 15 6f c5 46 69 a8 9e 45 f6 9d cc 65 16 1e f1 f1 fd bd 55 8a 71 47 63 9b 95 e2 5a ab 75 ba b0 ee 7c 2f 0c 27 9e ff a9 9f b1 38 f2 79 ff f1 e3 68 2b f2 6e 59 b1 75 9f bb c5 ee 99 ad 4b 98 1e b7 ed 62 31 be 0c 32 a3 18 f4 3a 4e 2c 44 45 e6 62 39 16 01 68 2c 71 9d 41 72 e6 25 f3 f5 12 81 6b 85 3c 9a 67 8b 41 d2 68 d8 d1 28 69 3a 63 57 a7 8d 92 31 61 32 76 77 3a 0d 15 05 c5 d8 5a bd 26 e2 bd 1c 84 24 07 21 76 13 d9 14 14 6c 0f 82 b3 78 10 40 93 c1 cc 4a 46 c1 58 0c ac e7 e2 37 f3 5d af a5 30 35 f0 08 19 4f 9e 58 49 2b 5d 21 21 59 01 73 6c d6 76 5d 5d e1 93 27 53 1e f2 8c 3f ca 0c 10 59 dc 6c b2 a0 d9 b4 99 df f2 56 ab 70 63 e1 20 6e b7 03 cf 8a 6d e6 59 41 09 77 f1 6c 56 c2 38 80 c6 11 be 2c ef 44 54 89 88 c4 8d 54 d7 62 e8 5a 7c 96 0c 62 c2 66 3c d6 fd 00 70 33 e8 44 a4 3a 11 63 27 12 00 11 c0 b4 07 d8 9b 68 a7 37 c5 a6 b6 3c 04 02 af 4e 1b 50 5a 89 ac 07 06 c9 14 fb 3a e7 d9 0b 91 cb 98 21 15 e4 0d a5 b6 96 3d c8 5a 7f ba d1 96 75 9d a3 4e bf 3c 29 76 66 1d 20 c3 ea 76 da 5d 1b 70 11 59 38 4f 6d 18 f0 c8 3a 3e e9 75 6c 93 36 b8 31 29 33 44 b2 40 30 27 94 d1 9c b2 ef ef f1 67 10 b5 a6 1c 9a 88 37 7c ea 3e 76 54 2b d8 8b e7 7c e6 ad c3 ec 62 36 07 30 65 07 a2 96 3f 9b bb 56 9b 05 ad 8b e7 b6 95 c0 50 b2 48 4e 71 88 4d 5a 7f be b3 81 16 38 cc bb 22 4a f2 ca 76 d1 02 4c a2 9c bd d0 13 13 79 d0 3c 0e 57 21 7f 5a c8 8f d4 65 64 75 b3 62 66 d9 5b 13 0a 95 db bd d3 a8 e8 3f 6e 6f 05 9b 01 d2 b5 24 c7 31 10 85 a9 5b 2b 6e fd 29 06 d0 db b2 ce e1 c9 e9 c3 03 08 98 06 d4 dc fd d9 df 41 c0 a3 bf f8 76 6b 0b dc b3 98 46 54 8c b2 07 5f 27 c7 3d 98 66 f8 71 d8 81 e1 4e f5 70 87 48 02 dd 36 a4 ae dd 36 5b c1 bf 29 fc 9b b9 0e ef b2 09 7c 2d e0 df 25 fc bb 75 6b f1 e4 2f 0e 20 e0 3c 01 1c c4 b3 47 2b 9e 90 b4 a0 d9 6f 04 5a 51 fc 65 Data Ascii: 4000m{(V6Xqd$!<B4$cOUZB8Z{~>?~2N?Y,,G{rhQmg_i/~~d:e]{#O:,6lkS8E>ke{&<['Z%qgoFiEeUqGcZu\|/'8yh+nYuKb12:N,DEb9h,qAr%k<gAh(i:cW1a2vw:Z&$!vlx@JFX7]05OXI+]!!Yslv]]'S?YlVpc nmYAwlV8,DTTbZ\|bf<p3D:c'h7<NPZ:!=ZuN<)vf v]pY8Om:>ul61)3D@0'g7\|>vT+\|b60e?VPHNqMZ8"JvLy<W!Zedubf[?no$1[+n)AvkFT_'=fqNpH66[)\|-%uk/ <G+oZQe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:10.258461952 CEST	293	OUT	GET /assets/fav/favicon-32x32.png HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:10.629796028 CEST	436	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:10 GMT Content-Type: image/png Content-Length: 2052 Last-Modified: Wed, 17 Apr 2024 06:57:54 GMT Connection: keep-alive ETag: "661f72f2-804" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Accept-Ranges: bytes
Apr 19, 2024 01:48:10.629828930 CEST	1289	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 Data Ascii: PNGIHDR szzgAMAa cHRMz&u0`:pQ<bKGDtIME5g~UIDATXkh\s+Y^YpDz:ukbP$5\|J)Z!J?@)N4K]7M:BdIeiZ;jW
Apr 19, 2024 01:48:10.629848003 CEST	763	IN	Data Raw: b8 76 ee 0a e9 b9 14 2b 57 97 78 e0 4b 47 88 f5 36 21 5a d0 9b 2e e9 9b eb 54 5e a5 56 25 17 d9 db 69 b2 63 69 62 1f 69 22 d8 1a 64 e0 f3 83 0c 9c 1e 2c a3 8f 75 37 71 f0 94 a2 e3 53 9d 28 43 21 8e 10 e9 8a 12 3e 10 a5 fd 63 89 72 70 89 08 86 61 Data Ascii: v+WxKG6!Z.T^V%icibi"d,u7qS(C!>crpa;NeHgK(uDbZt?W0(gVUTP)/.RW9&dR,yr(J(g8mJv>;\|&ODk
Apr 19, 2024 01:48:14.083343029 CEST	280	OUT	GET /images/hook.svg HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:14.438726902 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:14 GMT Content-Type: text/html Last-Modified: Wed, 17 Apr 2024 07:01:30 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"661f73ca-1e9a" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Content-Encoding: gzip Data Raw: 63 34 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 59 0b 73 db b8 11 fe 2b 34 73 f1 91 35 45 3d 1c 39 36 69 da c9 e5 32 4d da a4 c9 5c dc 99 76 5c f7 06 12 57 12 12 12 50 01 50 b6 4f e2 7f ef 02 e0 4b 0f 67 da 38 b1 45 00 8b dd c5 3e be 5d 50 97 47 29 9f aa c7 25 38 0b 95 67 57 97 fa af 93 11 36 4f 5c 60 2e 8e 81 a4 57 97 39 28 e2 4c 17 44 48 50 89 5b a8 59 ef dc ed 57 d3 8c e4 90 b8 2b 0a f7 4b 2e 94 eb 4c 39 53 c0 90 ec 9e a6 6a 91 a4 b0 a2 53 e8 99 41 40 19 55 94 64 3d 39 25 19 24 c3 40 2e 04 65 df 7a 8a f7 66 54 25 8c 6b a6 8a aa 0c ae de 7d fa f4 d7 5f 3e dd 38 9f 5f ff ed ed 87 cb be 9d bc cc 90 da 11 90 25 ae 54 8f 19 c8 05 00 4a 5c 08 98 25 6e 9f 48 d4 4e f6 67 28 9f dc 83 e4 39 f4 a7 72 6b 1c e6 94 85 38 e7 fe 18 27 92 65 3f c0 41 f6 29 9a 44 f6 0d d5 0f ee 5d 82 c8 a9 94 f4 c7 f9 e4 45 46 e5 e2 89 cd 64 b9 cc 00 bd 50 4c 17 3d 2d d0 75 24 fd 03 64 e2 0e cf 07 0f f8 bb c7 92 ac fa bb 7b c2 25 9b 6f 31 b5 8c 74 68 e1 73 4e e6 d0 d7 14 35 e7 d3 d1 c3 e9 e8 10 5f fc d5 3b 7b 86 e0 ff 64 3a 3c 7b 18 9e 7d 8f a9 21 d8 63 9a 13 46 67 20 f7 2d 87 3b 25 55 10 de c3 a4 a1 d9 de 28 bf 55 06 3b b0 93 cc 88 a0 bd 25 65 0c d2 9e 22 93 50 ae e6 3a 3d 32 2e 12 f7 d9 78 32 21 e9 d8 dd 4a a2 5c 6a ab d2 29 51 e8 e9 de 0d cd e0 8d a6 ee e4 d4 b3 94 8c 4f 47 d3 ed 6d 6a 01 39 f4 a6 bb a4 33 f3 83 a4 c6 e9 57 13 9e 3e 06 3a bd d7 39 11 73 ca a2 41 bc 24 69 4a d9 3c 1a 94 cf 26 9c ab 8c 93 14 c4 3a a5 72 99 91 c7 68 96 c1 43 4c 32 3a 67 3d 34 42 2e a3 29 f2 05 11 7f 2d a4 a2 b3 c7 5e 25 a9 9e d6 e4 bd 94 0a 98 6a ed 23 54 a7 c8 59 6c f2 3e 1a 0e 06 ab fb 78 01 74 be 50 66 b0 88 15 3c a8 9e e1 de 30 40 7e bd 19 c9 69 f6 18 7d 34 e1 1a 48 c2 64 4f 82 a0 b3 78 2e 68 da 13 fc be 37 27 cb 68 38 5e 3e c4 13 32 fd 36 17 bc 60 a9 3d 7b f4 6c 38 1d ce 46 a7 71 35 c2 c3 c7 4b 8e 0e d4 ea a0 bf d0 aa 2b 88 ff e8 51 96 c2 43 74 71 71 51 3e 5b 0a 3e 17 20 e5 7a 9f ae 52 76 74 7e 58 d2 99 fe 57 9d 6e 74 36 40 22 0c 90 dc 38 2e 92 0b 92 f2 fb cf 45 26 c1 21 19 1e 8d 11 05 ce 58 3a 40 24 a0 f8 1e 2f 94 43 d9 4c a3 21 b4 4a fc ae 04 ca 69 55 21 13 89 36 54 10 d7 86 fe f9 e7 58 f1 25 fa 6d c2 95 e2 39 3e 64 30 53 7a bc a7 df 98 5c a4 a7 a3 ee 82 c9 96 08 63 17 88 e8 cd 05 49 29 b2 f4 7a 2f c6 29 cc 03 31 9f 10 6f 34 1e 07 f5 6f 38 f2 9d d1 f8 79 80 2a 31 b9 24 02 69 f7 c6 e3 c1 f3 c3 1b 9f 5c 78 b9 c3 61 67 ec 77 f5 d5 29 6d ac ef 18 17 b4 d6 cd f9 ca 18 d3 1e a5 b1 63 6c 18 55 96 cb 32 27 1c 6e d9 bb 7c f5 0d 1e 67 02 f3 45 3a 1d ff ac 07 cf d7 Data Ascii: c48Ys+4s5E=96i2M\v\WPPOKg8E>]PG)%8gW6O\`.W9(LDHP[YW+K.L9SjSA@Ud=9%$@.ezfT%k}_>8_%TJ\%nHNg(9rk8'e?A)D]EFdPL=-u$d{%o1thsN5_;{d:<{}!cFg -;%U(U;%e"P:=2.x2!J\j)QOGmj93W>:9sA$iJ<&:rhCL2:g=4B.)-^%j#TYl>xtPf<0@~i}4HdOx.h7'h8^>26`={l8Fq5K+QCtqqQ>[> zRvt~XWnt6@"8.E&!X:@$/CL!JiU!6TX%m9>d0Sz\cI)z/)1o4o8y*1$i\xagw)mclU2'n\|gE:
Apr 19, 2024 01:48:14.438745022 CEST	1289	IN	Data Raw: 13 fe d0 b3 53 d1 c0 19 38 a7 e8 4c fc c0 03 78 17 03 67 38 7e 89 e7 71 fa ce 68 f0 dc 2f 31 74 f7 e8 cf 0f d3 6b 52 bf ec 8a d5 8a 1b 79 ed 21 1b 5f 23 a3 8a f9 81 c5 c6 0a 65 27 58 56 24 2b 20 8a c8 0c e3 6b 5d 47 08 51 4a 78 29 51 a4 87 15 43 Data Ascii: S8Lxg8~qh/1tkRy!_#e'XV$+ k]GQJx)QC_mfn&mX<nb/={U7i5/mATWGH&EhUF\&d<RE/gqU\|x~6zQXl6^bdyr<zZ$\|{Hi
Apr 19, 2024 01:48:14.438760996 CEST	1048	IN	Data Raw: ab 64 80 d5 fb ca db 8d ae 5b b8 d3 c6 d7 85 7b 7f 05 d5 39 ea 18 1d 03 e0 49 61 75 61 d2 5c ea 13 55 c9 89 7b e5 1e 77 bf 76 ab b7 dd 77 d5 fa 9e c0 96 2e ec ae f4 83 6d 55 7e c9 f8 e4 7b 56 ef 6a a2 13 17 55 cf a9 ec 0a 14 88 0e 6b 0b 0e 9a e0 Data Ascii: d[{9Iaua\U{wvw.mU~{VjUk?Sj.(&!?qu\.1ABoWT@5?sfJ->E7*o$t,NuU{Z-]hBB}(d<0P q\|{JW0#"\|?7zD
Apr 19, 2024 01:48:59.448559046 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:13.583538055 CEST	374	OUT	GET /socket.io/?EIO=3&transport=polling&t=Oxpd5At HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:13.937830925 CEST	544	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: application/octet-stream Date: Thu, 18 Apr 2024 23:48:13 GMT Content-Length: 84 Data Raw: 00 08 00 ff 30 7b 22 73 69 64 22 3a 22 37 32 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 30 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 36 30 30 30 30 7d 0a Data Ascii: 0{"sid":"72","upgrades":["websocket"],"pingInterval":20000,"pingTimeout":60000}
Apr 19, 2024 01:48:14.069448948 CEST	381	OUT	GET /socket.io/?EIO=3&transport=polling&t=Oxpd5Ry&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:14.423841000 CEST	464	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: application/octet-stream Date: Thu, 18 Apr 2024 23:48:14 GMT Content-Length: 5 Data Raw: 00 02 ff 34 30 Data Ascii: 40
Apr 19, 2024 01:48:14.544414043 CEST	381	OUT	GET /socket.io/?EIO=3&transport=polling&t=Oxpd5Zt&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:34.693095922 CEST	463	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: application/octet-stream Date: Thu, 18 Apr 2024 23:48:34 GMT Content-Length: 4 Data Raw: 00 01 ff 33 Data Ascii: 3
Apr 19, 2024 01:48:35.142144918 CEST	381	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdAZR&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:55.353984118 CEST	463	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: application/octet-stream Date: Thu, 18 Apr 2024 23:48:55 GMT Content-Length: 4 Data Raw: 00 01 ff 33 Data Ascii: 3
Apr 19, 2024 01:48:55.357639074 CEST	381	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdFXb&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:49:15.797035933 CEST	463	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: application/octet-stream Date: Thu, 18 Apr 2024 23:49:15 GMT Content-Length: 4 Data Raw: 00 01 ff 33 Data Ascii: 3
Apr 19, 2024 01:49:15.886504889 CEST	381	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdKYL&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:49:36.648963928 CEST	463	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: application/octet-stream Date: Thu, 18 Apr 2024 23:49:36 GMT Content-Length: 4 Data Raw: 00 01 ff 33 Data Ascii: 3
Apr 19, 2024 01:49:36.893830061 CEST	381	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdPgR&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:49:57.248478889 CEST	463	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: application/octet-stream Date: Thu, 18 Apr 2024 23:49:57 GMT Content-Length: 4 Data Raw: 00 01 ff 33 Data Ascii: 3
Apr 19, 2024 01:49:57.667748928 CEST	381	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdUjt&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:14.083627939 CEST	295	OUT	GET /assets/images/login_poster.jpg HTTP/1.1 Host: 154.61.80.57 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:14.443737030 CEST	439	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Thu, 18 Apr 2024 23:48:14 GMT Content-Type: image/jpeg Content-Length: 18418 Last-Modified: Wed, 17 Apr 2024 06:57:55 GMT Connection: keep-alive ETag: "661f72f3-47f2" Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization Accept-Ranges: bytes
Apr 19, 2024 01:48:14.443769932 CEST	1289	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b Data Ascii: JFIF``C$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)=================================================="}!1A
Apr 19, 2024 01:48:14.443790913 CEST	1289	IN	Data Raw: f5 a6 52 8a 40 14 51 45 00 14 51 45 00 14 b4 94 b4 00 51 45 14 00 51 45 14 00 51 40 04 90 07 53 4a 50 a9 c3 02 3e b4 00 51 45 14 80 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 5a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 Data Ascii: R@QEQEQEQEQ@SJP>QE((((((Z((((((((JZ((((EUQ@Q@Q@Q@Q@N;xIeQ@Q@Q@Q@Q@Q@Q@Q@)i-QEQEQEQEQEQEQEQEQEQE((
Apr 19, 2024 01:48:14.443808079 CEST	1289	IN	Data Raw: 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 03 ff 00 d5 32 90 51 bb fa 8f c6 91 9c b9 19 00 60 63 81 8a 6d 14 00 51 45 14 00 51 4e 54 67 fb a3 3f ca 9b 40 05 14 51 40 05 14 51 40 05 14 51 40 0a 3a 52 52 8e 94 Data Ascii: EPEPEPEPEPEPEP2Q`cmQEQNTg?@Q@Q@Q@:RRZ(P2{~4PEPEPEPEPEPEPEPEP GZJ(qX@EPEPEP ((EzSx(qJ((u((Z((:EJ0P(()
Apr 19, 2024 01:48:14.443830967 CEST	1289	IN	Data Raw: a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8c f1 d0 51 45 00 14 51 45 02 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 16 8a 28 a0 02 8a 28 a0 02 8a 28 a0 41 4b 49 4b 40 05 14 51 40 0e Data Ascii: ((((((((QEQE(((((((AKIK@Q@H'#EQEQEZ(Q@Q@EPEPEPEP+)(Q@QH((IK@Z((ZJ(iN%QE((Z((((EPEMR=AJsH
Apr 19, 2024 01:48:14.443849087 CEST	1289	IN	Data Raw: 28 00 a2 8a 28 00 a2 8a 5a 04 14 51 45 00 14 51 45 00 14 51 45 00 14 51 45 00 14 b4 94 b4 00 b4 51 45 02 0a 28 a2 80 0a 28 a2 80 0a 5a 4a 5a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 04 14 51 45 00 14 51 45 00 14 51 45 20 0a 28 Data Ascii: ((ZQEQEQEQEQE((ZJZ(((((QEQEQE (-%-QE%PEPEPKI@QEQE (ZJ(hH$qIRFF=)QERJ(h@QEQEQEQE(8&8#H9((((((UR2i9\
Apr 19, 2024 01:48:14.443870068 CEST	1289	IN	Data Raw: 40 0b 45 25 2d 00 14 51 45 00 14 51 4e db f2 67 70 cf a7 7a 00 6d 14 51 40 05 2d 25 2d 00 14 51 45 20 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 16 8a 4a 28 01 68 a4 a5 a0 02 8a 28 a0 02 8a 28 00 77 38 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 Data Ascii: @E%-QEQNgpzmQ@-%-QE (((J(h((w8(((((((((()Tdq@E+zJES5()T)?3=h(8"(t(((((Z(((@,2p=h %Q@Q@Q@((((
Apr 19, 2024 01:48:14.443890095 CEST	1289	IN	Data Raw: 00 14 51 45 00 02 8a 28 a0 02 8a 28 a0 41 45 14 50 01 45 14 50 01 45 14 52 00 a5 50 09 c1 38 f7 a4 a2 80 14 fb 52 51 45 30 0a 5a 4a 28 01 68 a2 8a 04 14 51 45 00 2d 14 94 50 02 d1 45 14 00 51 45 14 00 51 45 14 00 51 4a 4e 46 30 29 28 00 a2 8a 29 Data Ascii: QE((AEPEPERP8RQE0ZJ(hQE-PEQEQEQJNF0)()dQ@Q@E%RQ@EPEPEPE+6)FePRN2~4)nr94QEQEQEQEQI@E%ES5m=wvEQEQEQEQEQEQEKopSqTTQ@X)F
Apr 19, 2024 01:48:14.443907022 CEST	1289	IN	Data Raw: 8a 33 46 68 00 a2 8c d1 9a 00 28 a3 34 66 80 0a 28 a5 72 87 ee 29 5e 49 e4 e7 8e c2 80 12 8a 29 28 02 1a 28 a2 83 50 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 00 9e 80 9a 29 56 47 4f b8 cc b9 f4 38 a6 92 49 c9 39 3e a6 80 16 8a 28 a0 02 96 92 96 80 12 Data Ascii: 3Fh(4f(r)^I)((P((()VGO8I9>(oIRQ@Q@Q@EPUu3R@E-QER@Q@EPEPIEQEQE(((((((((((QA!EPEPEPEPEPEP(
Apr 19, 2024 01:48:14.443928957 CEST	1289	IN	Data Raw: 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 02 21 d7 9a 52 30 78 39 a4 a5 a0 d0 4a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 50 c5 7a 1a 4a 28 01 72 4f 19 e3 d2 8a 28 a0 02 92 8a 5a 00 50 17 04 96 c1 f4 a4 a4 a5 a0 04 a2 8a 28 00 a2 Data Ascii: ((((!R0x9J(((((PzJ(rO(ZP(((((($(hB1(4Q@EPEPEPEPNwn((>MJ8pi)hQEQEQEQEiEQE((QE)9EPEPEPEPEPKIK@E%-
Apr 19, 2024 01:48:14.803849936 CEST	1289	IN	Data Raw: 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a5 a4 a5 a0 02 96 92 96 80 0a 28 a2 81 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 06 68 cd 14 50 02 d1 49 45 00 2d 14 94 50 02 d1 Data Ascii: ((((Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@hPIE-PIE-PI3@E%RQ@&ih((((((((((((((()*,DEQAaEPEPEPEPEPEPEPEd@EPEPEPEP

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:14.536217928 CEST	314	OUT	GET /socket.io/?EIO=3&transport=polling&t=Oxpd5At HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:14.887033939 CEST	544	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: application/octet-stream Date: Thu, 18 Apr 2024 23:48:14 GMT Content-Length: 84 Data Raw: 00 08 00 ff 30 7b 22 73 69 64 22 3a 22 37 33 22 2c 22 75 70 67 72 61 64 65 73 22 3a 5b 22 77 65 62 73 6f 63 6b 65 74 22 5d 2c 22 70 69 6e 67 49 6e 74 65 72 76 61 6c 22 3a 32 30 30 30 30 2c 22 70 69 6e 67 54 69 6d 65 6f 75 74 22 3a 36 30 30 30 30 7d 0a Data Ascii: 0{"sid":"73","upgrades":["websocket"],"pingInterval":20000,"pingTimeout":60000}
Apr 19, 2024 01:48:35.167401075 CEST	321	OUT	GET /socket.io/?EIO=3&transport=polling&t=Oxpd5Zt&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:35.518374920 CEST	528	IN	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:48:35 GMT Content-Length: 15 Data Raw: 77 72 69 74 65 3a 20 6f 76 65 72 6c 61 70 0a Data Ascii: write: overlap
Apr 19, 2024 01:48:55.365144968 CEST	321	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdAZR&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:55.715961933 CEST	528	IN	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:48:55 GMT Content-Length: 15 Data Raw: 77 72 69 74 65 3a 20 6f 76 65 72 6c 61 70 0a Data Ascii: write: overlap
Apr 19, 2024 01:49:15.889143944 CEST	321	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdKQj&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:49:16.240356922 CEST	528	IN	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:49:16 GMT Content-Length: 15 Data Raw: 77 72 69 74 65 3a 20 6f 76 65 72 6c 61 70 0a Data Ascii: write: overlap
Apr 19, 2024 01:49:36.914180994 CEST	321	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdKYL&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:49:37.265003920 CEST	528	IN	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:49:37 GMT Content-Length: 15 Data Raw: 77 72 69 74 65 3a 20 6f 76 65 72 6c 61 70 0a Data Ascii: write: overlap
Apr 19, 2024 01:49:58.136758089 CEST	321	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdPgR&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:49:58.488476038 CEST	528	IN	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:49:58 GMT Content-Length: 15 Data Raw: 77 72 69 74 65 3a 20 6f 76 65 72 6c 61 70 0a Data Ascii: write: overlap

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:14.920547962 CEST	321	OUT	GET /socket.io/?EIO=3&transport=polling&t=Oxpd5Ry&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:15.271627903 CEST	528	IN	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:48:15 GMT Content-Length: 15 Data Raw: 77 72 69 74 65 3a 20 6f 76 65 72 6c 61 70 0a Data Ascii: write: overlap
Apr 19, 2024 01:48:35.167223930 CEST	321	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdAK-&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:35.518260956 CEST	528	IN	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:48:35 GMT Content-Length: 15 Data Raw: 77 72 69 74 65 3a 20 6f 76 65 72 6c 61 70 0a Data Ascii: write: overlap
Apr 19, 2024 01:48:55.363698006 CEST	321	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdFR_&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:48:55.714865923 CEST	528	IN	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:48:55 GMT Content-Length: 15 Data Raw: 77 72 69 74 65 3a 20 6f 76 65 72 6c 61 70 0a Data Ascii: write: overlap
Apr 19, 2024 01:49:15.890474081 CEST	321	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdFXb&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:49:16.241394997 CEST	528	IN	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:49:16 GMT Content-Length: 15 Data Raw: 77 72 69 74 65 3a 20 6f 76 65 72 6c 61 70 0a Data Ascii: write: overlap
Apr 19, 2024 01:49:36.911859989 CEST	321	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdPR0&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:49:37.262911081 CEST	528	IN	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:49:37 GMT Content-Length: 15 Data Raw: 77 72 69 74 65 3a 20 6f 76 65 72 6c 61 70 0a Data Ascii: write: overlap
Apr 19, 2024 01:49:58.117760897 CEST	321	OUT	GET /socket.io/?EIO=3&transport=polling&t=OxpdUZ5&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 19, 2024 01:49:58.468689919 CEST	528	IN	HTTP/1.1 500 Internal Server Error Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 23:49:58 GMT Content-Length: 15 Data Raw: 77 72 69 74 65 3a 20 6f 76 65 72 6c 61 70 0a Data Ascii: write: overlap

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 01:48:34.337260008 CEST	444	OUT	POST /socket.io/?EIO=3&transport=polling&t=OxpdAK-&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Content-Length: 3 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: text/plain;charset=UTF-8 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Data Raw: 31 3a 32 Data Ascii: 1:2
Apr 19, 2024 01:48:34.689481020 CEST	462	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Date: Thu, 18 Apr 2024 23:48:34 GMT Content-Length: 2 Content-Type: text/plain; charset=utf-8 Data Raw: 6f 6b Data Ascii: ok
Apr 19, 2024 01:48:55.000485897 CEST	444	OUT	POST /socket.io/?EIO=3&transport=polling&t=OxpdFR_&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Content-Length: 3 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: text/plain;charset=UTF-8 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Data Raw: 31 3a 32 Data Ascii: 1:2
Apr 19, 2024 01:48:55.350569010 CEST	462	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Date: Thu, 18 Apr 2024 23:48:55 GMT Content-Length: 2 Content-Type: text/plain; charset=utf-8 Data Raw: 6f 6b Data Ascii: ok
Apr 19, 2024 01:49:15.443608999 CEST	444	OUT	POST /socket.io/?EIO=3&transport=polling&t=OxpdKQj&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Content-Length: 3 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: text/plain;charset=UTF-8 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Data Raw: 31 3a 32 Data Ascii: 1:2
Apr 19, 2024 01:49:15.793481112 CEST	462	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Date: Thu, 18 Apr 2024 23:49:15 GMT Content-Length: 2 Content-Type: text/plain; charset=utf-8 Data Raw: 6f 6b Data Ascii: ok
Apr 19, 2024 01:49:36.295666933 CEST	444	OUT	POST /socket.io/?EIO=3&transport=polling&t=OxpdPR0&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Content-Length: 3 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: text/plain;charset=UTF-8 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Data Raw: 31 3a 32 Data Ascii: 1:2
Apr 19, 2024 01:49:36.645488024 CEST	462	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Date: Thu, 18 Apr 2024 23:49:36 GMT Content-Length: 2 Content-Type: text/plain; charset=utf-8 Data Raw: 6f 6b Data Ascii: ok
Apr 19, 2024 01:49:56.894361019 CEST	444	OUT	POST /socket.io/?EIO=3&transport=polling&t=OxpdUZ5&sid=72 HTTP/1.1 Host: 154.61.80.57:3434 Connection: keep-alive Content-Length: 3 Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: text/plain;charset=UTF-8 Origin: http://154.61.80.57 Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Data Raw: 31 3a 32 Data Ascii: 1:2
Apr 19, 2024 01:49:57.245011091 CEST	462	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE Access-Control-Allow-Origin: http://154.61.80.57 Date: Thu, 18 Apr 2024 23:49:57 GMT Content-Length: 2 Content-Type: text/plain; charset=utf-8 Data Raw: 6f 6b Data Ascii: ok

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://154.61.80.57

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Windows Analysis Report
http://154.61.80.57

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:48:10 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 63 46 4a 56 70 64 73 46 35 30 36 30 4b 58 4f 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 61 35 39 62 36 35 62 64 37 31 38 36 34 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: cFJVpdsF5060KXO1.1Context: 75a59b65bd71864b
2024-04-18 23:48:10 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:48:10 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 63 46 4a 56 70 64 73 46 35 30 36 30 4b 58 4f 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 61 35 39 62 36 35 62 64 37 31 38 36 34 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 78 4c 75 4e 41 68 68 58 38 38 34 37 67 72 6f 2f 6c 69 75 41 4e 6b 2b 6d 4b 47 49 2b 56 54 6c 59 67 4c 66 74 36 30 37 75 7a 2b 6e 78 6c 6e 52 5a 4f 41 79 4e 79 7a 38 42 6a 30 43 76 47 64 49 42 48 4f 73 6f 6a 71 6d 6e 67 52 49 44 4f 73 74 58 47 39 77 31 7a 6e 61 66 52 37 64 72 70 39 4b 62 43 5a 5a 55 52 6e 41 6f 4a 50 42 6e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: cFJVpdsF5060KXO1.2Context: 75a59b65bd71864b<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXxLuNAhhX8847gro/liuANk+mKGI+VTlYgLft607uz+nxlnRZOAyNyz8Bj0CvGdIBHOsojqmngRIDOstXG9w1znafR7drp9KbCZZURnAoJPBn
2024-04-18 23:48:10 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 63 46 4a 56 70 64 73 46 35 30 36 30 4b 58 4f 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 61 35 39 62 36 35 62 64 37 31 38 36 34 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: cFJVpdsF5060KXO1.3Context: 75a59b65bd71864b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:48:10 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:48:10 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6c 62 34 4e 5a 55 4b 54 53 45 53 47 36 4a 66 49 61 55 4c 66 4e 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: lb4NZUKTSESG6JfIaULfNQ.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:48:11 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-18 23:48:11 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=198908 Date: Thu, 18 Apr 2024 23:48:11 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:48:12 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-18 23:48:12 UTC	531	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Content-Type: application/octet-stream ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=198816 Date: Thu, 18 Apr 2024 23:48:12 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-18 23:48:12 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:48:13 UTC	612	OUT	GET /country-flag-icons/3x2/US.svg HTTP/1.1 Host: purecatamphetamine.github.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://154.61.80.57/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 23:48:13 UTC	743	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1352 Server: GitHub.com Content-Type: image/svg+xml permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 05 Apr 2024 01:02:36 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "660f4dac-548" expires: Wed, 17 Apr 2024 04:07:06 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: 28C0:2A2C5F:1F936C2:2A4BA97:661F4891 Accept-Ranges: bytes Age: 0 Date: Thu, 18 Apr 2024 23:48:13 GMT Via: 1.1 varnish X-Served-By: cache-pdk-kfty2130060-PDK X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1713484094.702230,VS0,VE19 Vary: Accept-Encoding X-Fastly-Request-ID: 750afb229d46f78599c22ede25d91a9408c57eb0
2024-04-18 23:48:13 UTC	1352	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 31 33 20 33 34 32 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 46 46 46 22 20 64 3d 22 4d 30 20 30 68 35 31 33 76 33 34 32 48 30 7a 22 2f 3e 3c 67 20 66 69 6c 6c 3d 22 23 44 38 30 30 32 37 22 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 35 32 2e 36 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 31 30 35 2e 32 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 31 35 37 2e 38 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 32 31 30 2e 35 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 32 36 33 2e 31 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 33 31 35 2e 37 68 35 31 33 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 513 342"><path fill="#FFF" d="M0 0h513v342H0z"/><g fill="#D80027"><path d="M0 0h513v26.3H0zM0 52.6h513v26.3H0zM0 105.2h513v26.3H0zM0 157.8h513v26.3H0zM0 210.5h513v26.3H0zM0 263.1h513v26.3H0zM0 315.7h513

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:48:14 UTC	381	OUT	GET /country-flag-icons/3x2/US.svg HTTP/1.1 Host: purecatamphetamine.github.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 23:48:14 UTC	742	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1352 Server: GitHub.com Content-Type: image/svg+xml permissions-policy: interest-cohort=() x-origin-cache: HIT Last-Modified: Fri, 05 Apr 2024 01:02:36 GMT Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31556952 ETag: "660f4dac-548" expires: Wed, 17 Apr 2024 04:07:06 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: 28C0:2A2C5F:1F936C2:2A4BA97:661F4891 Accept-Ranges: bytes Date: Thu, 18 Apr 2024 23:48:14 GMT Via: 1.1 varnish Age: 1 X-Served-By: cache-pdk-kfty2130086-PDK X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1713484095.651785,VS0,VE1 Vary: Accept-Encoding X-Fastly-Request-ID: 7f4b44645c69ea9577b00928b531464d9d7c33cb
2024-04-18 23:48:14 UTC	1352	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 31 33 20 33 34 32 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 46 46 46 22 20 64 3d 22 4d 30 20 30 68 35 31 33 76 33 34 32 48 30 7a 22 2f 3e 3c 67 20 66 69 6c 6c 3d 22 23 44 38 30 30 32 37 22 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 35 32 2e 36 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 31 30 35 2e 32 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 31 35 37 2e 38 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 32 31 30 2e 35 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 32 36 33 2e 31 68 35 31 33 76 32 36 2e 33 48 30 7a 4d 30 20 33 31 35 2e 37 68 35 31 33 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 513 342"><path fill="#FFF" d="M0 0h513v342H0z"/><g fill="#D80027"><path d="M0 0h513v26.3H0zM0 52.6h513v26.3H0zM0 105.2h513v26.3H0zM0 157.8h513v26.3H0zM0 210.5h513v26.3H0zM0 263.1h513v26.3H0zM0 315.7h513

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:48:18 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 78 47 43 2f 52 56 72 2f 6e 6b 61 50 6c 6e 66 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 66 30 63 61 39 64 65 66 38 64 61 37 30 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: xGC/RVr/nkaPlnfd.1Context: 90f0ca9def8da70e
2024-04-18 23:48:18 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:48:18 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 78 47 43 2f 52 56 72 2f 6e 6b 61 50 6c 6e 66 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 66 30 63 61 39 64 65 66 38 64 61 37 30 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 78 4c 75 4e 41 68 68 58 38 38 34 37 67 72 6f 2f 6c 69 75 41 4e 6b 2b 6d 4b 47 49 2b 56 54 6c 59 67 4c 66 74 36 30 37 75 7a 2b 6e 78 6c 6e 52 5a 4f 41 79 4e 79 7a 38 42 6a 30 43 76 47 64 49 42 48 4f 73 6f 6a 71 6d 6e 67 52 49 44 4f 73 74 58 47 39 77 31 7a 6e 61 66 52 37 64 72 70 39 4b 62 43 5a 5a 55 52 6e 41 6f 4a 50 42 6e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: xGC/RVr/nkaPlnfd.2Context: 90f0ca9def8da70e<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXxLuNAhhX8847gro/liuANk+mKGI+VTlYgLft607uz+nxlnRZOAyNyz8Bj0CvGdIBHOsojqmngRIDOstXG9w1znafR7drp9KbCZZURnAoJPBn
2024-04-18 23:48:18 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 78 47 43 2f 52 56 72 2f 6e 6b 61 50 6c 6e 66 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 66 30 63 61 39 64 65 66 38 64 61 37 30 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: xGC/RVr/nkaPlnfd.3Context: 90f0ca9def8da70e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:48:18 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:48:18 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 48 7a 39 47 6c 30 4a 71 59 55 32 4f 44 48 6f 69 49 4c 30 59 55 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Hz9Gl0JqYU2ODHoiIL0YUA.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:48:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 59 6d 30 76 68 48 43 41 6b 2b 65 39 78 67 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 33 64 31 38 66 35 62 65 30 62 32 61 34 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 6Ym0vhHCAk+e9xgJ.1Context: 843d18f5be0b2a45
2024-04-18 23:48:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:48:30 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 36 59 6d 30 76 68 48 43 41 6b 2b 65 39 78 67 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 33 64 31 38 66 35 62 65 30 62 32 61 34 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 78 4c 75 4e 41 68 68 58 38 38 34 37 67 72 6f 2f 6c 69 75 41 4e 6b 2b 6d 4b 47 49 2b 56 54 6c 59 67 4c 66 74 36 30 37 75 7a 2b 6e 78 6c 6e 52 5a 4f 41 79 4e 79 7a 38 42 6a 30 43 76 47 64 49 42 48 4f 73 6f 6a 71 6d 6e 67 52 49 44 4f 73 74 58 47 39 77 31 7a 6e 61 66 52 37 64 72 70 39 4b 62 43 5a 5a 55 52 6e 41 6f 4a 50 42 6e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 6Ym0vhHCAk+e9xgJ.2Context: 843d18f5be0b2a45<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXxLuNAhhX8847gro/liuANk+mKGI+VTlYgLft607uz+nxlnRZOAyNyz8Bj0CvGdIBHOsojqmngRIDOstXG9w1znafR7drp9KbCZZURnAoJPBn
2024-04-18 23:48:30 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 36 59 6d 30 76 68 48 43 41 6b 2b 65 39 78 67 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 34 33 64 31 38 66 35 62 65 30 62 32 61 34 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 6Ym0vhHCAk+e9xgJ.3Context: 843d18f5be0b2a45<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:48:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:48:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 42 35 6d 4b 2b 77 65 6f 6f 45 53 43 41 57 6d 50 4a 78 4e 54 48 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: B5mK+weooESCAWmPJxNTHg.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:48:48 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 34 48 52 57 31 47 68 63 34 30 75 71 59 6f 64 48 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 35 39 30 65 37 61 34 36 36 36 61 65 61 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 4HRW1Ghc40uqYodH.1Context: 69590e7a4666aead
2024-04-18 23:48:48 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:48:48 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 34 48 52 57 31 47 68 63 34 30 75 71 59 6f 64 48 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 35 39 30 65 37 61 34 36 36 36 61 65 61 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 78 4c 75 4e 41 68 68 58 38 38 34 37 67 72 6f 2f 6c 69 75 41 4e 6b 2b 6d 4b 47 49 2b 56 54 6c 59 67 4c 66 74 36 30 37 75 7a 2b 6e 78 6c 6e 52 5a 4f 41 79 4e 79 7a 38 42 6a 30 43 76 47 64 49 42 48 4f 73 6f 6a 71 6d 6e 67 52 49 44 4f 73 74 58 47 39 77 31 7a 6e 61 66 52 37 64 72 70 39 4b 62 43 5a 5a 55 52 6e 41 6f 4a 50 42 6e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 4HRW1Ghc40uqYodH.2Context: 69590e7a4666aead<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXxLuNAhhX8847gro/liuANk+mKGI+VTlYgLft607uz+nxlnRZOAyNyz8Bj0CvGdIBHOsojqmngRIDOstXG9w1znafR7drp9KbCZZURnAoJPBn
2024-04-18 23:48:48 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 34 48 52 57 31 47 68 63 34 30 75 71 59 6f 64 48 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 35 39 30 65 37 61 34 36 36 36 61 65 61 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 4HRW1Ghc40uqYodH.3Context: 69590e7a4666aead<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:48:48 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:48:48 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 59 4f 62 72 68 46 69 48 71 6b 2b 2f 4c 31 2f 7a 76 39 6d 67 49 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: YObrhFiHqk+/L1/zv9mgIg.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:49:10 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 61 75 47 68 6b 44 58 38 70 6b 69 79 6f 51 5a 74 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 62 65 34 33 34 30 37 62 31 61 62 32 63 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: auGhkDX8pkiyoQZt.1Context: eabe43407b1ab2c9
2024-04-18 23:49:10 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:49:10 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 61 75 47 68 6b 44 58 38 70 6b 69 79 6f 51 5a 74 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 62 65 34 33 34 30 37 62 31 61 62 32 63 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 78 4c 75 4e 41 68 68 58 38 38 34 37 67 72 6f 2f 6c 69 75 41 4e 6b 2b 6d 4b 47 49 2b 56 54 6c 59 67 4c 66 74 36 30 37 75 7a 2b 6e 78 6c 6e 52 5a 4f 41 79 4e 79 7a 38 42 6a 30 43 76 47 64 49 42 48 4f 73 6f 6a 71 6d 6e 67 52 49 44 4f 73 74 58 47 39 77 31 7a 6e 61 66 52 37 64 72 70 39 4b 62 43 5a 5a 55 52 6e 41 6f 4a 50 42 6e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: auGhkDX8pkiyoQZt.2Context: eabe43407b1ab2c9<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXxLuNAhhX8847gro/liuANk+mKGI+VTlYgLft607uz+nxlnRZOAyNyz8Bj0CvGdIBHOsojqmngRIDOstXG9w1znafR7drp9KbCZZURnAoJPBn
2024-04-18 23:49:10 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 61 75 47 68 6b 44 58 38 70 6b 69 79 6f 51 5a 74 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 62 65 34 33 34 30 37 62 31 61 62 32 63 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: auGhkDX8pkiyoQZt.3Context: eabe43407b1ab2c9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:49:10 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:49:10 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6e 31 64 35 79 72 6b 54 47 55 65 38 6c 5a 32 35 55 67 6d 41 43 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: n1d5yrkTGUe8lZ25UgmACQ.0Payload parsing failed.

Timestamp	Bytes transferred	Direction	Data
2024-04-18 23:49:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4c 42 4d 49 74 45 42 70 4b 30 4f 59 69 74 66 58 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 35 62 35 31 36 36 38 37 38 36 62 61 31 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: LBMItEBpK0OYitfX.1Context: 295b51668786ba17
2024-04-18 23:49:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-18 23:49:37 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 4c 42 4d 49 74 45 42 70 4b 30 4f 59 69 74 66 58 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 35 62 35 31 36 36 38 37 38 36 62 61 31 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 78 4c 75 4e 41 68 68 58 38 38 34 37 67 72 6f 2f 6c 69 75 41 4e 6b 2b 6d 4b 47 49 2b 56 54 6c 59 67 4c 66 74 36 30 37 75 7a 2b 6e 78 6c 6e 52 5a 4f 41 79 4e 79 7a 38 42 6a 30 43 76 47 64 49 42 48 4f 73 6f 6a 71 6d 6e 67 52 49 44 4f 73 74 58 47 39 77 31 7a 6e 61 66 52 37 64 72 70 39 4b 62 43 5a 5a 55 52 6e 41 6f 4a 50 42 6e Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: LBMItEBpK0OYitfX.2Context: 295b51668786ba17<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXxLuNAhhX8847gro/liuANk+mKGI+VTlYgLft607uz+nxlnRZOAyNyz8Bj0CvGdIBHOsojqmngRIDOstXG9w1znafR7drp9KbCZZURnAoJPBn
2024-04-18 23:49:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4c 42 4d 49 74 45 42 70 4b 30 4f 59 69 74 66 58 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 35 62 35 31 36 36 38 37 38 36 62 61 31 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: LBMItEBpK0OYitfX.3Context: 295b51668786ba17<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-18 23:49:37 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-18 23:49:37 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 69 73 2f 2f 69 73 6b 2b 39 45 65 33 43 68 69 42 44 7a 44 43 7a 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: is//isk+9Ee3ChiBDzDCzg.0Payload parsing failed.