Play interactive tour

Edit tour

Analysis Report #Ud83d#Udce9-peter.nash.htm

Overview

General Information

Sample Name:	#Ud83d#Udce9-peter.nash.htm
Analysis ID:	432756
MD5:	8c6df9b0709674ba479f63d75b3a2cb6
SHA1:	734aef9ae6219e97ea02bdd13bce9a31c1327b14
SHA256:	ab8c991ac026e2cf24f0c012a09174da7fdc75604c626883c964add719bd1c9e
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish44

Obfuscated HTML file found

HTML body contains low number of good links

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

iexplore.exe (PID: 3728 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5720 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3728 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
#Ud83d#Udce9-peter.nash.htm	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

Phishing:

Yara detected HtmlPhish44

Show sources

Source: Yara match

File source: #Ud83d#Udce9-peter.nash.htm, type: SAMPLE

Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm	HTTP Parser: Number of links: 0
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm	HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm	HTTP Parser: Title: Undelivered email local access does not match URL
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm	HTTP Parser: Title: Undelivered email local access does not match URL

Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.3:49721 version: TLS 1.2

Source: Joe Sandbox View

IP Address: 104.18.11.207 104.18.11.207

Source: Joe Sandbox View

JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

Source: global traffic

HTTP traffic detected: GET /bground.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: gravitfy.comConnection: Keep-Alive

Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: maxcdn.bootstrapcdn.com

Source: font-awesome.min[1].css.3.dr	String found in binary or memory: http://fontawesome.io
Source: font-awesome.min[1].css.3.dr	String found in binary or memory: http://fontawesome.io/license
Source: bootstrap.min[1].css.3.dr	String found in binary or memory: http://getbootstrap.com)
Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/varelaround/v13/w8gdH283Tvk__Lua32TysjIfp8uJ.woff)
Source: bootstrap.min[1].css.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.3:49721 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.evad.winHTM@3/23@2/2

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFF818C42C07F5AA3B.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3728 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3728 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Data Obfuscation:

Obfuscated HTML file found

Show sources

Source: #Ud83d#Udce9-peter.nash.htm	Initial file: Did not found title: "Undelivered email local access" in HTML/HTM content
Source: #Ud83d#Udce9-peter.nash.htm	Initial file: Did not found title: "Undelivered email local access" in HTML/HTM content

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting1	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Scripting1	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer1	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://getbootstrap.com)	0%	Avira URL Cloud	safe
http://gravitfy.com/bground.png	0%	Avira URL Cloud	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
maxcdn.bootstrapcdn.com	104.18.11.207	true	false		high
gravitfy.com	185.61.154.34	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Desktop/%23Ud83d%23Udce9-peter.nash.htm	true		low
http://gravitfy.com/bground.png	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.io	font-awesome.min[1].css.3.dr	false		high
http://www.nytimes.com/	msapplication.xml3.1.dr	false		high
http://www.youtube.com/	msapplication.xml7.1.dr	false		high
http://getbootstrap.com)	bootstrap.min[1].css.3.dr	false	Avira URL Cloud: safe	low
https://github.com/twbs/bootstrap/blob/master/LICENSE)	bootstrap.min[1].css.3.dr	false		high
http://www.wikipedia.com/	msapplication.xml6.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.amazon.com/	msapplication.xml.1.dr	false		high
http://www.live.com/	msapplication.xml2.1.dr	false		high
http://www.reddit.com/	msapplication.xml4.1.dr	false		high
http://www.twitter.com/	msapplication.xml5.1.dr	false		high
http://fontawesome.io/license	font-awesome.min[1].css.3.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.18.11.207	maxcdn.bootstrapcdn.com	United States		13335	CLOUDFLARENETUS	false
185.61.154.34	gravitfy.com	United Kingdom		22612	NAMECHEAP-NETUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	432756
Start date:	10.06.2021
Start time:	18:16:33
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	#Ud83d#Udce9-peter.nash.htm
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.evad.winHTM@3/23@2/2
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .htm
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, ielowutil.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 184.30.21.219, 168.61.161.212, 104.43.139.144, 92.122.145.220, 104.42.151.234, 88.221.62.148, 142.250.180.202, 142.250.180.234, 142.250.180.196, 216.58.212.131, 13.88.21.125, 184.30.20.56, 152.199.19.161, 20.50.102.62, 20.190.159.136, 40.126.31.1, 40.126.31.8, 20.190.159.138, 40.126.31.137, 40.126.31.139, 40.126.31.143, 40.126.31.4, 92.122.213.194, 92.122.213.247, 20.54.26.129, 20.72.88.19, 20.75.105.140 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, gstaticadssl.l.google.com, www.tm.lg.prod.aadmsa.akadns.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, storeedgefd.xbetservices.akadns.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, eus2-consumerrp-displaycatalog-aks2aks-useast.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, go.microsoft.com, login.live.com, www.google.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com, fonts.googleapis.com, fs.microsoft.com, ajax.googleapis.com, fonts.gstatic.com, ie9comview.vo.msecnd.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, www.tm.a.prd.aadg.akadns.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, e16646.dscg.akamaiedge.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, cs9.wpc.v0cdn.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.18.11.207	Check 57549.Html	Get hash	malicious	Browse
	#Ud83d#Udda8northerntrust.hscni.net 692233150-queue-7828.htm	Get hash	malicious	Browse
	Paid INV for Robert.landis Khs-net.htm	Get hash	malicious	Browse
	Payment Advice 006062021.htm	Get hash	malicious	Browse
	New_Messagejacob@steinborn.comMessage.html	Get hash	malicious	Browse
	Return-message4928.html	Get hash	malicious	Browse
	new_fax_message.html	Get hash	malicious	Browse
	VM_5823_05_24_2-2.html	Get hash	malicious	Browse
	Secured-Message_7634-7.html	Get hash	malicious	Browse
	_Vm064855583.HtM	Get hash	malicious	Browse
	VM60VWPCVNQS5D.html	Get hash	malicious	Browse
	PAID Invoice name@gmail.com.htm	Get hash	malicious	Browse
	Ao_Scan_item.htm	Get hash	malicious	Browse
	redcape.com.au-857585.htm	Get hash	malicious	Browse
	#U266c Voice_Audio_845021.htm	Get hash	malicious	Browse
	Wynnlasvegas_Scan_item.htm	Get hash	malicious	Browse
	Sait_Message.htm	Get hash	malicious	Browse
	DOC597-597.htm	Get hash	malicious	Browse
	Retrieve_Messages65904_40_55am.html	Get hash	malicious	Browse
	Arbella NDA file attach...htm	Get hash	malicious	Browse
185.61.154.34	#Ud83d#Udce9-vesna.starcevic.htm	Get hash	malicious	Browse	gravitfy.com/bground.png

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
maxcdn.bootstrapcdn.com	Evershedsnicea NDA file attach...htm	Get hash	malicious	Browse	104.18.10.207
	Check 57549.Html	Get hash	malicious	Browse	104.18.11.207
	7 #U039c#U0456#U0455#U0455#U0435d #U0441#U0430II#U0455.htm	Get hash	malicious	Browse	104.18.10.207
	The Village.html	Get hash	malicious	Browse	104.18.10.207
	#Ud83d#Udda8northerntrust.hscni.net 692233150-queue-7828.htm	Get hash	malicious	Browse	104.18.11.207
	Paid INV for Robert.landis Khs-net.htm	Get hash	malicious	Browse	104.18.11.207
	#Ud83d#Udda8rocket.com 1208421(69-queue-2615.htm	Get hash	malicious	Browse	104.18.10.207
	Payment Advice 006062021.htm	Get hash	malicious	Browse	104.18.11.207
	receipt620.htm	Get hash	malicious	Browse	104.18.10.207
	original phishing email.html	Get hash	malicious	Browse	104.18.10.207
	New_Messagejacob@steinborn.comMessage.html	Get hash	malicious	Browse	104.18.11.207
	Return-message4928.html	Get hash	malicious	Browse	104.18.10.207
	Sealant Specialists, Inc. Projects #2021-Proposal #19100.html	Get hash	malicious	Browse	104.18.10.207
	VM60VWPCVNQS5D.html	Get hash	malicious	Browse	104.18.11.207
	PAID Invoice name@gmail.com.htm	Get hash	malicious	Browse	104.18.11.207
	mal.html	Get hash	malicious	Browse	104.18.10.207
	mal.html	Get hash	malicious	Browse	104.18.10.207
	mal.html	Get hash	malicious	Browse	104.18.10.207
	Ao_Scan_item.htm	Get hash	malicious	Browse	104.18.11.207
	ATT11972.HTM	Get hash	malicious	Browse	104.18.10.207
gravitfy.com	#Ud83d#Udce9-vesna.starcevic.htm	Get hash	malicious	Browse	185.61.154.34

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
NAMECHEAP-NETUS	lTAPQJikGw.exe	Get hash	malicious	Browse	198.54.117.216
	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	Get hash	malicious	Browse	162.0.229.108
	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	Get hash	malicious	Browse	68.65.122.148
	3arZKnr21W.exe	Get hash	malicious	Browse	198.54.116.180
	hdOkhI5TaNNo08q.exe	Get hash	malicious	Browse	198.54.122.60
	PO187439.exe	Get hash	malicious	Browse	198.54.117.217
	Nr_0052801.exe	Get hash	malicious	Browse	198.54.122.60
	Yl6482CO6U.exe	Get hash	malicious	Browse	198.54.126.101
	ZmZvKByoew.exe	Get hash	malicious	Browse	198.54.126.101
	WUqkYlTJ16.exe	Get hash	malicious	Browse	198.54.126.101
	V2GC02n03l.exe	Get hash	malicious	Browse	198.54.126.101
	y3I4XEdM4V.exe	Get hash	malicious	Browse	198.54.126.101
	LVh23zF9x9.exe	Get hash	malicious	Browse	198.54.126.101
	48s9bA7Stk.exe	Get hash	malicious	Browse	198.54.126.101
	New Purchase Order20210609.exe	Get hash	malicious	Browse	198.54.117.216
	uew5jAHqCT.exe	Get hash	malicious	Browse	162.255.119.200
	Payment receipt MT103.exe	Get hash	malicious	Browse	198.54.117.218
	Document.exe	Get hash	malicious	Browse	198.54.122.60
	QPRfh1rEwy.exe	Get hash	malicious	Browse	162.255.119.200
	yr7xI3AzPv3TQyn.exe	Get hash	malicious	Browse	198.54.122.60
CLOUDFLARENETUS	SKlGhwkzTi.exe	Get hash	malicious	Browse	104.21.65.7
	RFQ-sib.exe	Get hash	malicious	Browse	104.21.19.200
	PO.doc	Get hash	malicious	Browse	104.21.19.200
	Evershedsnicea NDA file attach...htm	Get hash	malicious	Browse	104.16.18.94
	SecuriteInfo.com.Trojan.PackedNET.825.24532.exe	Get hash	malicious	Browse	172.67.188.154
	090049000009000.exe	Get hash	malicious	Browse	104.21.19.200
	Letter 1019.xlsx	Get hash	malicious	Browse	172.67.161.4
	fTxhRIDnrC.dll	Get hash	malicious	Browse	104.20.185.68
	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	Get hash	malicious	Browse	23.227.38.74
	UGGJ4NnzFz.exe	Get hash	malicious	Browse	23.227.38.74
	Order.exe	Get hash	malicious	Browse	104.21.40.174
	DocumentScanCopy2021_pdf.exe	Get hash	malicious	Browse	104.21.19.200
	RRY0yKj2HM.dll	Get hash	malicious	Browse	104.20.184.68
	SecuriteInfo.com.Trojan.PackedNET.721.2973.exe	Get hash	malicious	Browse	104.23.98.190
	SecuriteInfo.com.Trojan.PackedNET.831.4134.exe	Get hash	malicious	Browse	104.23.98.190
	SWIFT COMMERCIAL DUTY 0218J.exe	Get hash	malicious	Browse	172.67.188.154
	p8Wo6PbOjL.exe	Get hash	malicious	Browse	162.159.130.233
	b7cgnOpObK.exe	Get hash	malicious	Browse	104.21.19.200
	Invoice 8-6-2021.exe	Get hash	malicious	Browse	172.67.188.154
	PO187439.exe	Get hash	malicious	Browse	104.21.81.138

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
9e10692f1b7f78228b2d4e424db3a98c	fTxhRIDnrC.dll	Get hash	malicious	Browse	104.18.11.207
	RRY0yKj2HM.dll	Get hash	malicious	Browse	104.18.11.207
	Check 57549.Html	Get hash	malicious	Browse	104.18.11.207
	sat1_0609_2.dll	Get hash	malicious	Browse	104.18.11.207
	7 #U039c#U0456#U0455#U0455#U0435d #U0441#U0430II#U0455.htm	Get hash	malicious	Browse	104.18.11.207
	Yl6482CO6U.exe	Get hash	malicious	Browse	104.18.11.207
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	104.18.11.207
	Sleek_Free.exe	Get hash	malicious	Browse	104.18.11.207
	WV Northern Community College.docx	Get hash	malicious	Browse	104.18.11.207
	LVh23zF9x9.exe	Get hash	malicious	Browse	104.18.11.207
	d7b9ef581459a0d8f94b789ae07a9e0892c0f0d0bcc74.dll	Get hash	malicious	Browse	104.18.11.207
	d7b9ef581459a0d8f94b789ae07a9e0892c0f0d0bcc74.dll	Get hash	malicious	Browse	104.18.11.207
	The Village.html	Get hash	malicious	Browse	104.18.11.207
	RFQ-INV-PAYMENT.Htm	Get hash	malicious	Browse	104.18.11.207
	#Ud83d#Udcde VM_58490931 Recoding.wav - 20223 PM.htm.htm	Get hash	malicious	Browse	104.18.11.207
	Bills Pending Approval.html	Get hash	malicious	Browse	104.18.11.207
	#Ud83d#Udda8northerntrust.hscni.net 692233150-queue-7828.htm	Get hash	malicious	Browse	104.18.11.207
	2ff0174.dll	Get hash	malicious	Browse	104.18.11.207
	e621ca05.exe	Get hash	malicious	Browse	104.18.11.207
	Bills Pending Approval.html	Get hash	malicious	Browse	104.18.11.207

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C85B896D-CA52-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.8566444851618593
Encrypted:	false
SSDEEP:	768:8/KUKEoKEv+KEvzsKEf7zSKEf7zIKEf7GzGKEf7GzGD:8/KUKEoKEv+KEvzsKEf7zSKEf7zIKEf9
MD5:	0E2826A427E60E88909F137FDC395C8C
SHA1:	B2AECBD7ADAC30809728C60D4FC9B429EBCC0BE8
SHA-256:	4B77C1E68A5BEE3AA70A30639D793B4DA6D5E9A0B1829F6B933A59AAF5E0CCCD
SHA-512:	8EE3558702EDF7F58144623E88E93C7B6A57EA9E1F84EDFF9A90DC61B2738D258FE1BBBB80C5B8FF36C628EAEC1463FFD4E5B51DF01DE6EF08AA40FC17225150
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C85B896F-CA52-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	28512
Entropy (8bit):	1.9533571521035182
Encrypted:	false
SSDEEP:	96:ryZJQZ6HBSejh2FWWM6XpD8QJs4kURtEr:ryZJQZ6Hkejh2FWWM6XpD8Qi4dtEr
MD5:	8D205509CCCE0D9433AC61F8A5BBF57E
SHA1:	D33FDB8406D8B94AC27B39D604BF97FDF9520DB8
SHA-256:	7F29A1EB0B19CCCD54D04E6F5960627D9637A830A00EFFC60694934006B86DDA
SHA-512:	CDEBB50A714F270103FE0BCF4328ADAA05C2C3AA2A882067C9B7E8EC7A5EE2D684154A0CC915E2395FA2357539CA6A103B28C3A3BB2A6A5120C7070FE81843A1
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C85B8970-CA52-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5657475801038534
Encrypted:	false
SSDEEP:	48:Iw1EGcprvvGwpaeG4pQuGrapbS9GQpKTG7HpRtTGIpG:ruZRQe6gBSHAiTLA
MD5:	9701AAE376BE0C482C073456ABEC7145
SHA1:	1565B65206C902557FBC61C62282044DE18AD053
SHA-256:	0D726F02C25F245A37E71653476A62E76CD2FE03F42191070B8BBFE1CE6926EA
SHA-512:	763D1B6ACF163B57E8D6EA6B45E71AECA9B6C258B84F1BB83885861419246836D8648C6A7F11D9F4C47BCCB90343A404F6F22E09BD13B55D51081B06C75C4FF1
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.075860844435999
Encrypted:	false
SSDEEP:	12:TMHdNMNxOE3rxr1nWimI002EtM3MHdNMNxOE3rxr1nWimI00ObVbkEtMb:2d6NxOyd5SZHKd6NxOyd5SZ76b
MD5:	0E214DCA0A60D34F536F1B06F0342D17
SHA1:	C2E4C453E8682945EA490475E3D3D7DED1F29B91
SHA-256:	F253BDEFFB33FECF156F6F746703A6FF263F4849585313171618F1619B2BD0C7
SHA-512:	0D3647E88BE9DACF3D55865A2EEAA445794DB2F4C4F80E3738D5CA62FD762947C9C4AB28C5D0270C4EB866942687D466474D5A9D07DF98B18F7A6EE894E055BC
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.14110853260817
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2kRnWimI002EtM3MHdNMNxe2kRnWimI00Obkak6EtMb:2d6NxrwSZHKd6NxrwSZ7Aa7b
MD5:	2BC14D8F6960B48CDD928F83176CCA10
SHA1:	E134194C4E325DE58D0441064DAEAADDFB9D942A
SHA-256:	063FC58921DEF123FF5AD3AB304F68A4F19E389238349AA179ACF88D13CFCC10
SHA-512:	EBB329CF60FF70E54CAAB870E5130CAB25066D2A8E23981A3D875D9B2F3F0D6B7ADCF48F056763EF849684BBD7B7F09DB718EC0A9013FE7D50A39EEA7429B465
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x9f48cbf2,0x01d75e5f</date><accdate>0x9f48cbf2,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x9f48cbf2,0x01d75e5f</date><accdate>0x9f48cbf2,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	5.0951735910188996
Encrypted:	false
SSDEEP:	12:TMHdNMNxvL3rxr1nWimI002EtM3MHdNMNxvL3rxr1nWimI00ObmZEtMb:2d6Nxvbd5SZHKd6Nxvbd5SZ7mb
MD5:	BD4DEBBFFF7CD5DF0B455B80B99ED922
SHA1:	F8A3D25325295753E5F5AC2D3C883F55FE7ADEF4
SHA-256:	FE11831E42BA983F50C665D6C6BFFA63DE14E79877496BC7AFE2A844A5C4E14E
SHA-512:	ACAACA87FC9C158ACAAB27080A0D97657AED3E1FE15E5E60E095770AE11127E9F4F58FBFE479CD314CFD31A05F578CDDAA286BA34075CC519B3CAA45513E051C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.095768985392995
Encrypted:	false
SSDEEP:	12:TMHdNMNxiLLzLznWimI002EtM3MHdNMNxiLLzLznWimI00Obd5EtMb:2d6NxALzLzSZHKd6NxALzLzSZ7Jjb
MD5:	4E14C1B41AF7C03A261C6DFB057B37B7
SHA1:	3757DBF4353AE47CFC15446D612AA07A5D15AC4D
SHA-256:	6DF273444F9EE21CAB092AD957C52341B677C79382A8B7FB67A73E7A00CD3D7F
SHA-512:	B529D695546A8D42E5CB0248DF815F6654A7C2BB2669C6F24C2115F19DC326D4F7137246249EF901422A9D4D47ED9CD25AFF5A4D4F6139D099EC234CA6F24742
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.110623330799822
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGw3rxr1nWimI002EtM3MHdNMNxhGw3rxr1nWimI00Ob8K075EtMb:2d6NxQed5SZHKd6NxQed5SZ7YKajb
MD5:	055BE08D2F64FBD5B3D420EC42A281B9
SHA1:	4D3911750F15F7F20B43E508F9A836F0030F9B7D
SHA-256:	69A2BD6FE50E1E5270AFE5183330B30E1680C5B317C4196C1A6F7DF84972F066
SHA-512:	697588A3B8F3989ED18C3704635C0AE18C20D6E7A6BC7BA9304A557BBD69EB75BEC7750D1B6393B847BA495EC09C9146A00B4C7B1DBD5CF292B2D91B113CF674
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x9f60a35c,0x01d75e5f</date><accdate>0x9f60a35c,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.0833124198103175
Encrypted:	false
SSDEEP:	12:TMHdNMNx0nLLzLznWimI002EtM3MHdNMNx0nLLzLznWimI00ObxEtMb:2d6Nx0LLzLzSZHKd6Nx0LLzLzSZ7nb
MD5:	3F2D6DBF3A1E7B04E8B1DC7E3AAAAB7A
SHA1:	632282FCDDCB2A1941F240635AF499C922087525
SHA-256:	925C807BA5F771C58FFE412A6F4579B71FCBAF44ECD374AC73D6CE230AFB8EBB
SHA-512:	6B7229DB942EB010657036F54B9DBFDA48A75A9F97696B7113AA7ED5C432890AE7E5E09AD1390602DFAC351A244FC335FCBD015835E5FE7AD9CE1A85CD142C70
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.120630248385772
Encrypted:	false
SSDEEP:	12:TMHdNMNxxLLzLznWimI002EtM3MHdNMNxxLLzLznWimI00Ob6Kq5EtMb:2d6NxFLzLzSZHKd6NxFLzLzSZ7ob
MD5:	80EC6FC3101D786E6F10415B26259C55
SHA1:	0FA27202F0A619362A710A9B8A2484D2A15FC645
SHA-256:	B65F317BF38F5E31E6AD557DCD8629FB3C2192EF15011F3D8ADA5D4A2D45C45A
SHA-512:	07DAEEDA6CD6A3BD5D311F9D7BFDABBB9F302C7D55F430139F90EC26CB76F1A0AF2E4674FBBCA75E8308CE5EF8C412955E3CDA8F2F62B14D02CAAF9DB0FDA90F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	659
Entropy (8bit):	5.098185169966995
Encrypted:	false
SSDEEP:	12:TMHdNMNxcLLzLznWimI002EtM3MHdNMNxcLLzLznWimI00ObVEtMb:2d6NxyLzLzSZHKd6NxyLzLzSZ7Db
MD5:	C7220AB501195C7C76DA38D235B40839
SHA1:	28887A9344E94D65919E582F36F5B0D707AC7B7B
SHA-256:	DF7F295A3784B93C550B8C5D2AA62E2FA0EC77BBE4E4C599210680687B71CF56
SHA-512:	D19E255880333A708253E6B3BD9FBDD3DBDBCCBE05AA2096B39E477B5EB06304DA60C4DE125D5D410331A1BC1FF792A48D8211BA16B046EA4CC4044FE96911E6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.0815736360022274
Encrypted:	false
SSDEEP:	12:TMHdNMNxfnLLzLznWimI002EtM3MHdNMNxfnLLzLznWimI00Obe5EtMb:2d6NxDLzLzSZHKd6NxDLzLzSZ7ijb
MD5:	DD5EDD9CE84C762F07D5964713BBCBA6
SHA1:	B3CB1952CDCDDB431D28DEC8D3D02A21B0310F62
SHA-256:	EBF850E120B824AA4D118D1DA026A6D10B877C1D65C33F547C96239082EFC197
SHA-512:	3811F304CD90B99A381C6537AEF9B5F993C4D20D3A0832F7FC3C8020B40DF9141135C8E29DC53AEB52DBB36A443D6462522841C96B5EF82C09DE069FDB41111B
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x9f4ff2ee,0x01d75e5f</date><accdate>0x9f4ff2ee,0x01d75e5f</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\bootstrap.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	37045
Entropy (8bit):	5.174934618594778
Encrypted:	false
SSDEEP:	768:o2rGy27UwlNqMl95qNmCFejhqs8snmi+CSFXfbx8Gf3Zq7Q:Jg73zhq0GvbJ3ZKQ
MD5:	5869C96CC8F19086AEE625D670D741F9
SHA1:	430A443D74830FE9BE26EFCA431F448C1B3740F9
SHA-256:	53964478A7C634E8DAD34ECC303DD8048D00DCE4993906DE1BACF67F663486EF
SHA-512:	8B3B64A1BB2F9E329F02D4CD7479065630184EBAED942EE61A9FF9E1CE34C28C0EECB854458977815CF3704A8697FA8A5D096D2761F032B74B70D51DA3E37F45
Malicious:	false
Reputation:	moderate, very likely benign file
IE Cache URL:	https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Preview:	/!. Bootstrap v3.3.7 (http://getbootstrap.com). * Copyright 2011-2016 Twitter, Inc.. * Licensed under the MIT license. */.if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");+function(a){"use strict";var b=a.fn.jquery.split(" ")[0].split(".");if(b[0]<2&&b[1]<9\|\|1==b[0]&&9==b[1]&&b[2]<1\|\|b[0]>3)throw new Error("Bootstrap's JavaScript requires jQuery version 1.9.1 or higher, but lower than version 4")}(jQuery),+function(a){"use strict";function b(){var a=document.createElement("bootstrap"),b={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitionend"};for(var c in b)if(void 0!==a.style[c])return{end:b[c]};return!1}a.fn.emulateTransitionEnd=function(b){var c=!1,d=this;a(this).one("bsTransitionEnd",function(){c=!0});var e=function(){c\|\|a(d).trigger(a.support.transition.end)};return setTimeout(e,b),this},a(function(){a.support.transition=b(),a.support.transition&&(a.event.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\favicons[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3453
Entropy (8bit):	7.916505116320006
Encrypted:	false
SSDEEP:	96:vPfkJtB3ib12agTB6RxQ/N1Rzn/8qfyYBFORmnq:vXkJDyb1sFuw9/l6bJ
MD5:	5A0E30FE1C08242C6300DF8A8E504C3C
SHA1:	CEF995B7DABA5775344206D9364CB9CA1FF4DA07
SHA-256:	81026CD5BBC27FEA74E125B81C7604E292602F9634D2785537A3D6287FA3116C
SHA-512:	4DBB58A0907B28B53B84DCF723BA472E004A735E0E26BCECDAF877E0979D3DD7DDD09C1AA9141372616214B052B7905D24D4BCA97AEDFB6D6F43BFE53D8C1920
Malicious:	false
IE Cache URL:	https://www.google.com/s2/favicons?sz=64&domain_url=adobe.com
Preview:	.PNG........IHDR...@...@......iq.....sBIT....\|.d....4IDATx....]Wu......;?..(..PB...B..hU.@U."U.............x........P $MSDBp~...!!.E..=.......p..6....J..:...c..^?.{.m~.).....E\K..V.O....H\./..?.C..^..L.b9.b.SA&f...IX...x6.....=K..G~....8..9..V'=.g..}wI._(>U7.Q4..z...........Tj....m..........).j....w.'....L.m..Q(....N..M..s.k...M#.....g...P.CfZS[..F.4.j._.....ho.x....T..{=.G..+.o...k.A..=.....o./..-.G....u..S..m...?..dA.........q......`"NJ.^..9..8F.N.rBWt<.j..y..FR.U...{..U@..a..z....~..$u..E...4I...{V.ya..khT........;....O.aAzY..Nuc.).I....d.qZ8.6....m..2..{.!5.................3.Ry.w..h..x?pK.c.."V...T^8...u......G......q.K.]./...T'%.l....Ut...,{......b..-/.@........#...!.f.i.{W@Ju.J.@.(.3.[.=E...4.8#q/..4M..j{T.^...X.T.].C.c.....1]@..+..T....X@....i....h..'.<.JP.W5.......w7....`P..T{Z..\......2i4.=..ja...s..i/.Hak.B.R.C..X.oe...09..b.X...o./N.2A.s.\|.H......jG..s..6..]s..`C.a..~....m.%.#...4..`.x._{....I..m..,s.M..Z.v

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\css[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	369
Entropy (8bit):	5.214265433109311
Encrypted:	false
SSDEEP:	6:0IFFli+56ZRWHTizlpdAxInVuNijFF7F51DQ+56ZRWHTizlpdC1OOgewNin:jF/iO6ZRoT6pixUEqFbPMO6ZRoT6pYgM
MD5:	F3F1B04EE6133FFAC1F09A4DF6E2CDD1
SHA1:	75BF5BA3433D290670595A9000863CF67CD0391B
SHA-256:	8F299DB657E7009004FC4188DB6524BE1BC70EB1361A9FA0F311107F1FBD2D64
SHA-512:	BD04B777BFE2FCAB3A09BC61DEF9F2430B1C2620111A4C37B666705347BB1D20790FE212AB0114E23F4A3016465AC2AD51C854402511572FC478AF2E90538E12
Malicious:	false
IE Cache URL:	https://fonts.googleapis.com/css?family=Roboto\|Varela+Round
Preview:	@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxM.woff) format('woff');.}.@font-face {. font-family: 'Varela Round';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/varelaround/v13/w8gdH283Tvk__Lua32TysjIfp8uJ.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\jquery.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	97163
Entropy (8bit):	5.373204330051448
Encrypted:	false
SSDEEP:	1536:GYE1JVoiB9JqZdXXe2pD3PgoIiulrUdTJSFk/zkZ4HjL5o8srOaS9TwD6b7/Jp9i:t4J+R3jL5TCOauTwD6FdnCVQNea98HrV
MD5:	4F252523D4AF0B478C810C2547A63E19
SHA1:	5A9DCFBEF655A2668E78BAEBEAA8DC6F41D8DABB
SHA-256:	668B046D12DB350CCBA6728890476B3EFEE53B2F42DBB84743E5E9F1AE0CC404
SHA-512:	8C6B0C1FCDE829EF5AB02A643959019D4AC30D3A7CC25F9A7640760FEFFF26D9713B84AB2E825D85B3B2B08150265A10143F82E05975ACCB10645EFA26357479
Malicious:	false
IE Cache URL:	https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Preview:	/! jQuery v1.12.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="1.12.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.ca

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bground[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1200 x 709, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	570553
Entropy (8bit):	7.989580845141396
Encrypted:	false
SSDEEP:	12288:VT47kwS//c6rayYizyKSsMo0BvdHVlc32eUZqGFahLC3MgVyFdzwkPgMGQ:VT4Y9c64zo0Jd/fqyeL7gmsk9
MD5:	7FF7E5D205A5814E79ADF5670A4BF74B
SHA1:	097EB55B7931E46B95B41EABA471347CF4114C48
SHA-256:	A1E112204DA7C73E44B753B8643A0F302F72F024644F66673F5501546A0A7321
SHA-512:	5A184ED43698C32269C49912A2BFFE2CD8435C15A6CBBCAAC92B71EB44DAAE23672370142E90280ED990696B4AF9A4DF565BFC05C2671DB9D151DE605C9D6535
Malicious:	false
IE Cache URL:	http://gravitfy.com/bground.png
Preview:	.PNG........IHDR.....................pHYs...#...#.x.?v.. .IDATx...$Iz...&....I`)....D..d..o".@.!}... A.(. Aqw.+.......>.{.GVV..N.,..n..LWeez...O....nU.[U.Z.$1.a......8....K...y....E.k]....=n................3...///......F..A.~.]q.]q.].....3..3F..........v..v{P..xy...../...a.q..p.^..q...W.u..v..v.....+...xy.Q........<.,y!..q{~...r....\.W\.6y!m....\|>}..............\|yy.<....\...%./7..7.W...2nK....>.z..r..r!..r..r..^..>....LY.a2n..;.9...i._.y7......~.8.\|9.r.?w.M..O.../....../....r.R...'..z.Lc.Q.........\|.qx.cc...qy7........9/.+...^oX{2........><..e...s{.,..O.y./....A..\|..q...6.32...=_.B../...._.o..7..kY.Z....e-kY..Y...._...C..\|.z\|........\....}..:t]..m.-..C...G..^........\|...9^.S......w...3......%.....?..?........o.O.....w.._...._.....*q+.\...$.%.q......1qvM.}....5.q.S\......p..\.t.v>.Rd.h_.&..G3.w,.?oB/..r%u8_.f}....a`.S.....z..&.@d..x...h..\.z>....a.q.9..\.\.#..3n....q{..I.I&\.8...92R12I..^K.Y.,......r]........R.L.g9...q..c.>....d.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\w8gdH283Tvk__Lua32TysjIfp8uJ[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 25220, version 1.1
Category:	downloaded
Size (bytes):	25220
Entropy (8bit):	7.979586731734534
Encrypted:	false
SSDEEP:	768:VuF+H+BPTkB7R7XBsUpYWEdOnA3CF0SyW80re:AF++dAVXBsuBnAyFq6e
MD5:	ED1CF004373CD51BD0FD4C0E3DCA9FAE
SHA1:	88D90FFF0F086A342745CED39A6F7C06AA045738
SHA-256:	BC7CA2F6B8F07D83BFE12011B3AAF0A69479A86E0813155B0B6C275DD740A549
SHA-512:	3CC346FEF8632B76C0FB4E4972123ECED55A60A88919EA7D6A8D2E0AF9C807947A63F626959588CD3FD17FE5C00A9BB2AC667390ACB0D4102EDF0D570054AE47
Malicious:	false
IE Cache URL:	https://fonts.gstatic.com/s/varelaround/v13/w8gdH283Tvk__Lua32TysjIfp8uJ.woff
Preview:	wOFF......b........`........................GDEF.......,.....m..GPOS...........fl.].GSUB...d.......(...OS/2.......O...`i...cmap...T........g.F.cvt .......X.....o>Tfpgm...`........vd.\|gasp...t............glyf...\|..@.......head..Y<...6...6...`hhea..Yt... ...$.9..hmtx..Y........@#o%jloca..[...."..."...&maxp..].... ... ...@name..]....-....]ov-post.._$........3j.aprep..a.........~.x...1.. ...<.nU.C.l.E.0..>@.z..j...i....A_.x....&W..{.....m.l.......m.mk....v........".../.I./ztlM.f..j....#O...s[>&..E.....uH^...y.2E3"..9.#+A..W..r.uc.....G..Z5kT.I:.V.QB NA..2.L`.8h....$&s.s.,...R.8..J..g[.."....!+$`..x.PF..../.&/DG.#\..m.6\.;t]Z^%g.....9.....o.6wL..w.dWu....e....(F3...Lc:.......,c..X.V.d.ia.I.'..Y.8V .TIa..VZh.b.Y!.$..I.J...8[%..H.R..$.GI...4vr..q.D..dd..X").a......=....C..N.......U.....e.=.c......#$.;~...;b.P.1Tr~....2U......e...........IQ<^.@....._:].Y\|......9...S.1,'A.c....?...M.....l..f....Ka<.............c.b....o.7%I.4y.K!.S.2....@..R...&..M..R..4...p?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\bootstrap.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	121200
Entropy (8bit):	5.0982146191887106
Encrypted:	false
SSDEEP:	768:Vy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1FS:nw/a1fIuiHlq5mN8lDbNmPbh
MD5:	EC3BB52A00E176A7181D454DFFAEA219
SHA1:	6527D8BF3E1E9368BAB8C7B60F56BC01FA3AFD68
SHA-256:	F75E846CC83BD11432F4B1E21A45F31BC85283D11D372F7B19ACCD1BF6A2635C
SHA-512:	E8C5DAF01EAE68ED7C1E277A6E544C7AD108A0FA877FB531D6D9F2210769B7DA88E4E002C7B0BE3B72154EBF7CBF01A795C8342CE2DAD368BD6351E956195F8B
Malicious:	false
IE Cache URL:	https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Preview:	/!. Bootstrap v3.3.7 (http://getbootstrap.com). * Copyright 2011-2016 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{font-family:sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{color:#000;background:#ff0}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\font-awesome.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	31000
Entropy (8bit):	4.746143404849733
Encrypted:	false
SSDEEP:	384:wHu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8G:wwlr+Klk3Yi+fwYUf2l8yQ/e9vf
MD5:	269550530CC127B6AA5A35925A7DE6CE
SHA1:	512C7D79033E3028A9BE61B540CF1A6870C896F8
SHA-256:	799AEB25CC0373FDEE0E1B1DB7AD6C2F6A0E058DFADAA3379689F583213190BD
SHA-512:	49F4E24E55FA924FAA8AD7DEBE5FFB2E26D439E25696DF6B6F20E7F766B50EA58EC3DBD61B6305A1ACACD2C80E6E659ACCEE4140F885B9C9E71008E9001FBF4B
Malicious:	false
IE Cache URL:	https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.7.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.

C:\Users\user\AppData\Local\Temp\~DF3617EA387C4FB37B.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	36209
Entropy (8bit):	0.629931315112413
Encrypted:	false
SSDEEP:	48:kBqoxKAuvScS+8aAhNIN7Ljc1d1Ds41B171w1DH0R:kBqoxKAuvScS+8aAhKdwJs4kUR
MD5:	9266C8C8171252789B7072B32FD1CAE5
SHA1:	59AA3533D770A527218047DC22195BDA9B6EAA97
SHA-256:	93DA202C818FFAEEDF2984BA4E5EEB94A7C46C7843C796B95CE22CB54FA2C776
SHA-512:	116077CDFDA4BDD8DCEB21B290CD71B04FDE858F91CFB7A548F641D8C3B3358F527F396E568A5DF36E529597CC68E028815884992F5E9B612B8DB264AB5E0E8E
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF90C585B98E4338A8.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25441
Entropy (8bit):	0.3703273421274823
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laAxuXgR4RvC/:kBqoxxJhHWSVSEabxuXgRfZ
MD5:	59ED4BDD06F7012747AB4156106352B8
SHA1:	C7FB37A9E7D73A38C0AF385B73EAA228A74CB899
SHA-256:	50C8BA3FEACF25F7BE4353F1A33E11833DE47BCFABA01BD1E3B46DFA86587B75
SHA-512:	25F1F34CC30CB42781003409C50A348794C5C576D892D15A59C14344045FE775BB3BAEBB4268EEAFF8478B30C47CBF8823242DC84FF2CE3F3EE11678DA4FBB78
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFF818C42C07F5AA3B.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13029
Entropy (8bit):	0.48232140842757887
Encrypted:	false
SSDEEP:	96:kBqoI/L6/LE/LWLAL+QLvLAL+8LQL+8LPL6LvL6Le:kBqoI/+/g/KEvzEfsf7GzGq
MD5:	8421E82079D89FB1B05A37EF91E48195
SHA1:	AF51804E3324626C91FE40B1A7AF9835FF5FF9A5
SHA-256:	48FEF1F6100E1FB63792680C97E5A1816738E09ACB1A1485B2AD865F50B12735
SHA-512:	375D6B8EE8A89A8E4F91E8082394B94F57D6AB0F7CF32B6627F127F85B3CC378184616ED0B3E31FA46630D6F27E572A1D355D8169CCA0DD37154C3D081681CB8
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Entropy (8bit):	4.185045640172398
TrID:
File name:	#Ud83d#Udce9-peter.nash.htm
File size:	16689
MD5:	8c6df9b0709674ba479f63d75b3a2cb6
SHA1:	734aef9ae6219e97ea02bdd13bce9a31c1327b14
SHA256:	ab8c991ac026e2cf24f0c012a09174da7fdc75604c626883c964add719bd1c9e
SHA512:	ca8c2da8658813d9aca16c3455be1d3ef4da91f313a7f828bcc91c8b20aaa2e49c044b2beab6869735d7f89e9c376fe3e5776aeb9f5f938c7c0631136a5f1433
SSDEEP:	384:lHv8K0pHYIZWd3XyLIBTLVWTLCxHO+vT2:lHvR0KC6B7NxuD
File Content Preview:	<script language="javascript">.. document.write(unescape('%3C%21DOCTYPE%20html%3E%0A%3Chtml%20lang%3D%22en%22%3E%0A%3Chead%3E%0A%3Cmeta%20charset%3D%22utf-8%22%3E%0A%3Cmeta%20http-equiv%3D%22X-UA-Compatible%22%20content%3D%22IE%3Dedge%22%3E%0

File Icon


Icon Hash:	f8c89c9a9a998cb8

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2021 18:17:29.706912994 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:29.708985090 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:29.749267101 CEST	443	49721	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:29.749489069 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:29.751096010 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:29.751250029 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:29.859735012 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:29.860137939 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:29.903780937 CEST	443	49721	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:29.904130936 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:29.909895897 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:29.909924030 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:29.910001993 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:29.910049915 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:29.910103083 CEST	443	49721	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:29.910120010 CEST	443	49721	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:29.910166025 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:29.910190105 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.077215910 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.083275080 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.083528042 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.083622932 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.092694998 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.093111992 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.119466066 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.120793104 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.120825052 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.120927095 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.120944023 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.125380993 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.125550985 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.125611067 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.129487038 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.129556894 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.135282993 CEST	443	49721	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.135307074 CEST	443	49721	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.136771917 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.136795044 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.136810064 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.136826038 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.136845112 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.136862040 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.136871099 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.136888027 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.136900902 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.136940956 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.136960983 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.137723923 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.137747049 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.137775898 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.137818098 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.138106108 CEST	443	49721	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.138123035 CEST	443	49721	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.138174057 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.138207912 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.138444901 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.138462067 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.138495922 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.138514996 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.139029980 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.139055014 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.139103889 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.139134884 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.139955997 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.139980078 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.140016079 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.140044928 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.140974045 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.141000032 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.141022921 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.141060114 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.141113997 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.141463041 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.141910076 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.141943932 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.141958952 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.141995907 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.142920971 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.142940044 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.142985106 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.143018961 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.143913984 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.143935919 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.143974066 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.144010067 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.144887924 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.144907951 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.144947052 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.144979000 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.145889044 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.145906925 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.145931959 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.145962000 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.146883965 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.146902084 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.146944046 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.146981001 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.183614969 CEST	443	49721	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.223459005 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.330404997 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.373323917 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.384234905 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.384299994 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.384361982 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.384411097 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.384444952 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.384464979 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.384515047 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.384887934 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.384943962 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.384984016 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.385030985 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.385870934 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.385927916 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.385976076 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.386027098 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.386861086 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.386921883 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.386966944 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.387006998 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.387794971 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:17:30.387872934 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:17:30.506227016 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.506417990 CEST	49729	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.567682028 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.567774057 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.568263054 CEST	80	49729	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.568361998 CEST	49729	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.569099903 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.635919094 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.636007071 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.636029005 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.636039019 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.636056900 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.636065960 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.636089087 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.636090040 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.636109114 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.636115074 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.636132002 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.636141062 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.636163950 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.636163950 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.636189938 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.636192083 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.636214972 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.636221886 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.636243105 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.636260986 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696029902 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696065903 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696089983 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696110010 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696115017 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696139097 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696161985 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696161985 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696183920 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696204901 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696213961 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696228027 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696250916 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696253061 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696274996 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696275949 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696300983 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696321964 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696329117 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696369886 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696394920 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696398020 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696418047 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696439981 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696449995 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696468115 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696544886 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696614981 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696636915 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696654081 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696674109 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.696752071 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.696763992 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.756089926 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756134033 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756150961 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756167889 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756283998 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.756326914 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.756576061 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756596088 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756611109 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756628036 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756649017 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.756656885 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756675005 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756722927 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.756746054 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.756788015 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756812096 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756833076 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756844044 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.756850958 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756855965 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.756871939 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756894112 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.756899118 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756922007 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756939888 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.756953001 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757018089 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757071972 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757091045 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757106066 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757123947 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757128954 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757188082 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757195950 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757206917 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757225037 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757240057 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757241964 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757297993 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757342100 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757359982 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757375956 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757392883 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757417917 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757438898 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757476091 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757566929 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757585049 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757603884 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757621050 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757626057 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757700920 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757771969 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757812977 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757828951 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757838964 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757844925 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757880926 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757898092 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.757920980 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.757997036 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.758002043 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.758049011 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.815949917 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.815973043 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.815990925 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816008091 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816024065 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816040039 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816049099 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.816154003 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.816185951 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816205978 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816220999 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816237926 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816274881 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.816303015 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.816381931 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816411972 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816426992 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816437960 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816446066 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.816498995 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.816735029 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816756010 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816775084 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816792011 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816796064 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.816807032 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816823006 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.816869020 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.816909075 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.816966057 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817014933 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817092896 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817111969 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817126989 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817142963 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817142963 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817161083 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817171097 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817177057 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817198992 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817213058 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817240000 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817425013 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817449093 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817466974 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817481995 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817485094 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817543983 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817756891 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817776918 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817792892 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817809105 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817816973 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817828894 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817874908 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817893982 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817905903 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817910910 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817910910 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.817941904 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817977905 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.817991018 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818010092 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818026066 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818041086 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818057060 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818099022 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818125963 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818177938 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818198919 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818219900 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818238974 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818260908 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818325996 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818372965 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818397045 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818418980 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818423986 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818440914 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818466902 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818506002 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818514109 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818540096 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818564892 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818567991 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818588018 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818622112 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818667889 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818681955 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818715096 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818730116 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818731070 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818758965 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818770885 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818806887 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818860054 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818883896 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818907976 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818909883 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818936110 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818947077 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818960905 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.818970919 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.818990946 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819010973 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.819048882 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.819051981 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819070101 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819086075 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819106102 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819130898 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.819147110 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.819186926 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.819210052 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819257021 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.819268942 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819288969 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819313049 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819387913 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.819405079 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819430113 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819461107 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.819473028 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819495916 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819564104 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.819578886 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819603920 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.819612980 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.819638014 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.819675922 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.875767946 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.875797033 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.875818968 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.875839949 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.875860929 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.875869036 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.875881910 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.875890970 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.875902891 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.875926971 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.875947952 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.875996113 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.876209974 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876229048 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876250982 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876269102 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.876276016 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876296997 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876321077 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876322985 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.876374960 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.876396894 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.876657963 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876718998 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876740932 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876741886 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.876761913 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876768112 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.876782894 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876794100 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.876802921 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.876821995 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.876847029 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.877228975 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877255917 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877276897 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877296925 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877304077 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.877320051 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877341986 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877362967 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877362967 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.877383947 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877417088 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.877444029 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.877634048 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877680063 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877691031 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.877700090 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877721071 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877732038 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.877741098 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877767086 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877767086 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.877779961 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877800941 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877808094 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.877820969 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877840042 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877860069 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.877861977 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.877883911 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.877907038 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878071070 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878119946 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878132105 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878142118 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878166914 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878185034 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878209114 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878237009 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878256083 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878263950 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878277063 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878290892 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878302097 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878318071 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878319025 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878339052 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878357887 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878372908 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878390074 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878418922 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878438950 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878443956 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878465891 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878508091 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878618956 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878658056 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878679037 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878691912 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878699064 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878701925 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878721952 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878724098 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878742933 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878750086 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878773928 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878802061 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878906012 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878926992 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878947020 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878962040 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.878967047 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.878988028 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879009962 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879045963 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879056931 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879069090 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879522085 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879547119 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879566908 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879587889 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879602909 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879609108 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879632950 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879653931 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879666090 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879674911 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879695892 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879715919 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879731894 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879736900 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879748106 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879760027 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879781008 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879782915 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879806042 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879818916 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879828930 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879849911 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879854918 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879872084 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879893064 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879897118 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879914999 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879925013 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879935980 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879956007 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.879966974 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.879978895 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880001068 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880002022 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880022049 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880043983 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880064011 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880083084 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880085945 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880090952 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880109072 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880112886 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880130053 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880145073 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880151033 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880172014 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880182981 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880192041 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880213022 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880227089 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880234003 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880258083 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880265951 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880280972 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880297899 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880300045 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880326033 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880347013 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880348921 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880367994 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880369902 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880388975 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880398035 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880410910 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880433083 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880438089 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880455017 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880475998 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880497932 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880501986 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880517960 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880537033 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880538940 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880551100 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880557060 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880580902 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880593061 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880605936 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880621910 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880626917 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880647898 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880656004 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880670071 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880691051 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880693913 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880711079 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880733013 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880743027 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880753994 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880769968 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880776882 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880798101 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880804062 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880820990 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880841970 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880848885 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880865097 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880875111 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880887032 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880908012 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880918980 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880933046 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880955935 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880959988 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880978107 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.880983114 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.880999088 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881021023 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881023884 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881042004 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881062984 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881066084 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881083965 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881086111 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881105900 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881125927 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881129026 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881151915 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881164074 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881174088 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881195068 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881205082 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881216049 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881236076 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881246090 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881256104 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881268024 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881278038 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881300926 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881323099 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881326914 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881342888 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881356955 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881365061 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881386042 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881395102 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881408930 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881416082 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881432056 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881452084 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881464005 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.881484032 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.881519079 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.946512938 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.946573973 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.946599007 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.946614027 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.946635962 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.946652889 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.946679115 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.946701050 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.946710110 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.946746111 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.946752071 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.946784019 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.946800947 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.946822882 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.946835041 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.946862936 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.946885109 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.946902037 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.946924925 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.946959019 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.956634045 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.956684113 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.956728935 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.956767082 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.956842899 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.956892967 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.956933975 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.956943035 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.956978083 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957010984 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957051039 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957058907 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957091093 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957118034 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957130909 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957159996 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957197905 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957200050 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957226038 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957236052 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957277060 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957324028 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957351923 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957362890 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957385063 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957405090 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957412004 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957456112 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957468987 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957496881 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957514048 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957535982 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957552910 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957576036 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957583904 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957614899 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957632065 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957653999 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957672119 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957694054 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957705975 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957741976 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957751989 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957787991 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957799911 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957827091 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957839966 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957870007 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957900047 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957933903 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957947969 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.957969904 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.957993031 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958004951 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958031893 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958045006 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958072901 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958080053 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958113909 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958127022 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958153963 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958173990 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958194971 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958228111 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958261013 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958270073 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958303928 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958312035 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958342075 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958352089 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958369017 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958394051 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958395004 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958434105 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958450079 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958482027 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958482981 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958539963 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958547115 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958580017 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958596945 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958628893 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958638906 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958676100 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958705902 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958736897 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958777905 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958790064 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958820105 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958832026 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958858967 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958875895 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958897114 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958914995 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958937883 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958950043 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.958976984 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.958995104 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959027052 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959043980 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959072113 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959101915 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959158897 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959168911 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959214926 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959228992 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959254026 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959266901 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959295034 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959306002 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959333897 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959353924 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959383011 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959388018 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959429026 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959459066 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959490061 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959500074 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959517002 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959541082 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959553957 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959592104 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959594965 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959635019 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959646940 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959673882 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959697008 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959716082 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959732056 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959755898 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959768057 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959794044 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959805012 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959832907 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959845066 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959872007 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959893942 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959922075 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959953070 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.959964037 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.959983110 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960002899 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960041046 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960067987 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960078955 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960115910 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960128069 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960155010 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960166931 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960192919 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960197926 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960237980 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960241079 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960284948 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960289001 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960323095 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960335970 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960364103 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960385084 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960402966 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960424900 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960442066 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960454941 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960481882 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960494041 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960520029 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960536957 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960567951 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960566998 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960612059 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960618973 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960649967 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960654974 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960690022 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960702896 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960730076 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960737944 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960788012 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960803032 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.960863113 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.960962057 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.961008072 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.961024046 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.961045980 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.961066961 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.961086035 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.961107969 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.961126089 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.961133003 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.961163998 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.961175919 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.961204052 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:30.961222887 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:30.961260080 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:31.006702900 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:31.006752014 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:31.006783962 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:31.006915092 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:31.006944895 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:31.331296921 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:31.331409931 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:31.398596048 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:31.460131884 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:31.460155964 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:31.460175037 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:31.460196972 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:31.460232019 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:31.460269928 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:45.631371021 CEST	80	49729	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:45.631558895 CEST	49729	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:45.632159948 CEST	80	49729	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:45.632235050 CEST	49729	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:17:45.879060030 CEST	80	49727	185.61.154.34	192.168.2.3
Jun 10, 2021 18:17:45.879245996 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:19:18.831490040 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:19:18.831552982 CEST	49729	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:19:18.831590891 CEST	49729	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:19:18.831886053 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:19:18.831948996 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:19:18.875701904 CEST	443	49723	104.18.11.207	192.168.2.3
Jun 10, 2021 18:19:18.875845909 CEST	49723	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:19:18.877717018 CEST	443	49721	104.18.11.207	192.168.2.3
Jun 10, 2021 18:19:18.877783060 CEST	49721	443	192.168.2.3	104.18.11.207
Jun 10, 2021 18:19:19.156817913 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:19:19.860215902 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:19:21.156914949 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:19:23.657155991 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:19:28.470043898 CEST	49727	80	192.168.2.3	185.61.154.34
Jun 10, 2021 18:19:38.080208063 CEST	49727	80	192.168.2.3	185.61.154.34

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2021 18:17:18.517765999 CEST	60152	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:18.596893072 CEST	53	60152	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:19.132112026 CEST	57544	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:19.190681934 CEST	53	57544	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:20.247164011 CEST	55984	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:20.299227953 CEST	53	55984	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:21.271512032 CEST	64185	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:21.322674036 CEST	53	64185	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:21.521224022 CEST	65110	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:21.587929964 CEST	53	65110	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:22.934351921 CEST	58361	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:22.992656946 CEST	53	58361	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:24.650002003 CEST	63492	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:24.703308105 CEST	53	63492	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:25.957209110 CEST	60831	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:26.010797024 CEST	53	60831	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:27.093153954 CEST	60100	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:27.146162987 CEST	53	60100	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:27.404438972 CEST	53195	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:27.463088036 CEST	53	53195	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:28.312776089 CEST	50141	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:28.363292933 CEST	53	50141	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:29.635236025 CEST	53023	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:29.636250973 CEST	49563	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:29.636955976 CEST	51352	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:29.695779085 CEST	53	53023	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:29.697006941 CEST	53	51352	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:29.699179888 CEST	53	49563	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:30.410720110 CEST	59349	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:30.415420055 CEST	57084	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:30.428323030 CEST	58823	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:30.465353012 CEST	53	57084	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:30.478369951 CEST	53	58823	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:30.486423016 CEST	53	59349	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:30.815768003 CEST	57568	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:30.865993023 CEST	53	57568	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:32.673682928 CEST	50540	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:32.726779938 CEST	53	50540	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:33.823580027 CEST	54366	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:33.873951912 CEST	53	54366	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:36.231456041 CEST	53034	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:36.285909891 CEST	53	53034	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:37.422188044 CEST	57762	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:37.474292994 CEST	53	57762	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:38.417074919 CEST	55435	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:38.467832088 CEST	53	55435	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:39.646338940 CEST	50713	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:39.696880102 CEST	53	50713	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:42.117100000 CEST	56132	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:42.167665958 CEST	53	56132	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:47.464901924 CEST	58987	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:47.517802954 CEST	53	58987	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:48.997375965 CEST	56579	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:49.047806978 CEST	53	56579	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:51.638067007 CEST	60633	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:51.698870897 CEST	53	60633	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:57.395975113 CEST	61292	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:57.456960917 CEST	53	61292	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:58.144290924 CEST	63619	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:58.220299006 CEST	53	63619	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:58.418591976 CEST	61292	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:58.477415085 CEST	53	61292	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:58.795928001 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:58.860613108 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:59.446234941 CEST	61292	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:59.505376101 CEST	53	61292	8.8.8.8	192.168.2.3
Jun 10, 2021 18:17:59.825634956 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:17:59.887299061 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 10, 2021 18:18:01.652718067 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:18:01.659827948 CEST	61292	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:18:01.703988075 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 10, 2021 18:18:01.719043970 CEST	53	61292	8.8.8.8	192.168.2.3
Jun 10, 2021 18:18:03.666418076 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:18:03.726588964 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 10, 2021 18:18:05.859740973 CEST	61292	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:18:05.920411110 CEST	53	61292	8.8.8.8	192.168.2.3
Jun 10, 2021 18:18:07.713510036 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:18:07.764662027 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 10, 2021 18:18:47.956446886 CEST	61946	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:18:48.043277025 CEST	53	61946	8.8.8.8	192.168.2.3
Jun 10, 2021 18:18:52.082979918 CEST	64910	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:18:52.160955906 CEST	53	64910	8.8.8.8	192.168.2.3
Jun 10, 2021 18:19:10.428659916 CEST	52123	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:19:10.492432117 CEST	53	52123	8.8.8.8	192.168.2.3
Jun 10, 2021 18:19:30.514997005 CEST	56130	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:19:30.582031965 CEST	53	56130	8.8.8.8	192.168.2.3
Jun 10, 2021 18:20:12.583549976 CEST	56338	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:20:12.717775106 CEST	53	56338	8.8.8.8	192.168.2.3
Jun 10, 2021 18:20:13.697078943 CEST	59420	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:20:13.859507084 CEST	53	59420	8.8.8.8	192.168.2.3
Jun 10, 2021 18:20:15.519012928 CEST	58784	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:20:15.579735994 CEST	53	58784	8.8.8.8	192.168.2.3
Jun 10, 2021 18:20:16.403780937 CEST	63978	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:20:16.463815928 CEST	53	63978	8.8.8.8	192.168.2.3
Jun 10, 2021 18:20:17.594115973 CEST	62938	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:20:17.654026985 CEST	53	62938	8.8.8.8	192.168.2.3
Jun 10, 2021 18:20:18.526065111 CEST	55708	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:20:18.576539040 CEST	53	55708	8.8.8.8	192.168.2.3
Jun 10, 2021 18:20:19.317580938 CEST	56803	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:20:19.377569914 CEST	53	56803	8.8.8.8	192.168.2.3
Jun 10, 2021 18:20:20.576652050 CEST	57145	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:20:20.637319088 CEST	53	57145	8.8.8.8	192.168.2.3
Jun 10, 2021 18:20:22.421442032 CEST	55359	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:20:22.482500076 CEST	53	55359	8.8.8.8	192.168.2.3
Jun 10, 2021 18:20:23.481060028 CEST	58306	53	192.168.2.3	8.8.8.8
Jun 10, 2021 18:20:23.540621996 CEST	53	58306	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 10, 2021 18:17:29.636250973 CEST	192.168.2.3	8.8.8.8	0xbb03	Standard query (0)	maxcdn.bootstrapcdn.com	A (IP address)	IN (0x0001)
Jun 10, 2021 18:17:30.410720110 CEST	192.168.2.3	8.8.8.8	0x460a	Standard query (0)	gravitfy.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 10, 2021 18:17:29.699179888 CEST	8.8.8.8	192.168.2.3	0xbb03	No error (0)	maxcdn.bootstrapcdn.com		104.18.11.207	A (IP address)	IN (0x0001)
Jun 10, 2021 18:17:29.699179888 CEST	8.8.8.8	192.168.2.3	0xbb03	No error (0)	maxcdn.bootstrapcdn.com		104.18.10.207	A (IP address)	IN (0x0001)
Jun 10, 2021 18:17:30.486423016 CEST	8.8.8.8	192.168.2.3	0x460a	No error (0)	gravitfy.com		185.61.154.34	A (IP address)	IN (0x0001)
Jun 10, 2021 18:18:48.043277025 CEST	8.8.8.8	192.168.2.3	0xd5ce	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)

HTTP Request Dependency Graph

gravitfy.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49727	185.61.154.34	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jun 10, 2021 18:17:30.569099903 CEST	1167	OUT	GET /bground.png HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: gravitfy.com Connection: Keep-Alive
Jun 10, 2021 18:17:30.635919094 CEST	1181	IN	HTTP/1.1 200 OK date: Thu, 10 Jun 2021 16:17:30 GMT server: Apache last-modified: Thu, 18 Mar 2021 16:16:19 GMT accept-ranges: bytes content-length: 570553 content-type: image/png Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 b0 00 00 02 c5 08 06 00 00 00 d3 1e 1a 87 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 20 00 49 44 41 54 78 9c ec bd e9 93 24 49 7a 9f b7 7f 26 09 98 e1 10 49 60 29 9a 89 a2 cc 44 8a 87 64 a4 c0 6f 22 09 40 e2 21 7d 96 04 80 20 41 f0 ab 28 e2 20 41 71 77 ba 2b cf 88 c8 b8 ef fb be f3 a8 ea 99 9f 3e b8 7b 84 47 56 56 f7 ec 4e f7 2c b8 16 6e f6 d8 4c 57 65 65 7a f8 d5 e5 4f bf fe fa 0f 6e 55 89 5b 55 e2 5a e4 b8 24 31 2e 61 80 b3 ef e2 ec da 38 bb 16 ce 9e 85 4b e0 e0 12 79 b8 a6 11 ae 45 86 6b 5d e1 d6 b5 b8 0d 3d 6e e7 11 d7 cb 05 d7 eb f5 01 b7 89 db ed 19 b7 db 33 9e 9f 09 2f 2f 2f 1f 85 bd ee f9 f9 46 b8 dd 41 bf 7e bb 5d 71 bb 5d 71 bd 5d 08 d7 0b 2e 97 33 ce e7 33 46 8e f3 f9 8c cb e5 82 0b ad eb ed 76 c3 ed 76 7b 50 9f 0f 78 79 f9 80 0f 1f 18 2f df 82 0f 0f 61 cf 71 bb dd 70 bd 5e e9 e7 9f 71 b9 8c 13 57 c6 75 c4 ed 76 c6 ed 76 c6 f3 ed 82 e7 e7 2b 9e 9f af 78 79 be 51 9e f1 f2 fc 8c e7 db 1b 3c bf 2c 79 21 dc 9e 9f 71 7b 7e c6 95 d6 81 d4 83 72 be 10 2e 17 5c ae 57 5c f9 36 79 21 6d c2 9e f1 e5 e5 85 7c 3e 7d 9e db f5 8a db c7 fa fc f6 98 db 1b b0 fe 7c 79 79 a6 3c 1e 0f f3 cf 5c ef b8 ef cf 25 cf 2f 37 02 1b 37 cf 57 dc 9e af b8 32 6e 4b d8 f7 9f ef 98 3e ef 7a c5 ed 72 c1 ed 72 21 e3 ff 72 c1 f5 72 9e b9 5e e6 d7 3e cf 9f fb fc f2 4c 59 8e 61 32 6e b9 b1 3b 2e 39 9f 19 97 69 1c 5f b8 79 37 f5 e9 e5 82 f3 e5 c2 bd 7e e4 38 e3 7c 39 e3 72 a5 3f 77 bb 4d e3 83 8d 97 4f cd cb 0f 2f 1f f0 e1 e5 c3 dc 2f 8f c6 19 e5 72 bd 52 2e dc d8 27 f3 f0 7a b9 4c 63 e8 51 ff 7f b8 e3 93 eb c4 8d b5 e3 1b 7c cb 71 78 a3 63 63 ee f3 fb 71 79 37 ae 9e e7 f1 c8 d6 1e fe 39 2f 97 2b b7 06 be 5e 6f 58 7b 32 be a6 dc 7f fd c3 f3 0b 3e 3c bf e0 65 82 ac 07 73 7b bd 2c 98 be 4f d7 8f 79 dc 2f 99 da e4 ca 8f 41 0e da 87 7c 1b de b8 71 fc f2 81 e7 36 cd 33 32 7f 2e b8 3d 5f e6 b5 99 42 da 97 ad 2f 1f f0 f5 d7 5f e3 9b 6f be c6 37 f8 06 6b 59 cb 5a d6 b2 96 b5 ac 65 2d 6b 59 cb f7 59 be f9 e6 9b 05 5f 7f fd f5 43 f8 d7 7c a9 7a 7c fd f5 d7 f8 f0 e1 c3 b4 ef bd 5c 2e 18 c7 11 7d df a3 eb 3a 74 5d 87 b6 6d d1 b6 2d ba ae 43 df f7 18 47 b2 cf bb 5e c9 ef d8 f3 ef d7 9f af 9e 7c bb bc ed 39 5e ef 53 d9 fe e7 e5 e5 fe 77 ff e5 b3 8e e7 33 aa ba 86 1f 84 10 25 19 7f fa 1f ff 3f fc cb 3f f8 b7 f8 ad 7f fa 7f e0 6f ff 4f ff 10 7f e5 af fd 77 f8 c5 5f fd ab f8 c5 5f fd ab f8 c1 ad 2a 71 2b 0b 5c f3 0c 97 24 c2 25 f0 71 f6 1c 8c 8e 85 d1 31 71 76 4d 9c 7d 1b 97 d0 c3 35 09 71 cd 53 5c eb 12 d7 b6 c1 b5 ef 70 1d 07 5c cf 74 c3 76 3e cf 52 64 da 68 5f e9 26 ee ba 10 47 33 cf 77 2c bf 3f 6f 42 2f 1f e5 72 25 75 38 5f c8 66 7d 1c 07 0c e3 80 61 60 8c 53 e7 f2 1b ff fb 7a 90 0d 26 91 40 64 93 f9 78 e3 fa 96 68 b9 df 5c f3 9d 7a 3e 8f 18 cf 03 61 ec 71 e6 39 0f b8 5c 06 5c af 23 ae d7 33 6e d7 0b e5 ca 71 7b 93 8f 49 a3 49 26 5c 2e 38 9f 09 0b 39 32 52 31 32 49 8d 1b 5e 4b c6 59 14 2c 06 e9 f9 c1 a6 f7 72 5d c2 8b 8c 87 fd c7 89 a1 e7 db 52 f8 4c 92 67 39 1e a6 89 71 99 df 63 f1 3e af c6 d9 9d e8 64 b2 93 8e 9d f3 f5 8c f3 f4 67 be 6e 67 ca 5d 9d 2f 67 32 ee 99 28 1a c7 25 e7 11 97 0b f7 73 93 18 9b 25 c9 8d 0a b1 85 74 1d c7 69 cc f6 3d 81 fd 79 1c 47 ae bf 96 52 96 f4 2b 27 6d b9 f7 e1 19 b9 ba 5d 78 29 f1 89 79 38 8b d2 25 53 bf dc 49 ab 33 13 69 17 22 cd 96 22 8d ce c3 f3 79 ea 3f d6 3f cf af 58 8a 6b 5e 02 2d 84 e6 f5 b5 40 62 75 b8 97 31 f7 2c 65 d7 dc c7 b7 1b 27 21 3f 02 2f a7 c9 da 33 ce 7d 35 49 c7 e5 7a c3 b7 e7 2c 9b a8 9c ba 3d Data Ascii: PNGIHDRpHYs.#.#x?v IDATx$Iz&I`)Ddo"@!} A( Aqw+>{GVVN,nLWeezOnU[UZ$1.a8KyEk]=n3///FA~]q]q].33Fvv{Pxy/aqp^qWuvv+xyQ<,y!q{~r.\W\6y!m\|>}\|yy<\%/77W2nK>zrr!rr^>LYa2n;.9i_y7~8\|9r?wMO//rR.'zLcQ\|qxccqy79/+^oX{2><es{,Oy/A\|q632.=_B/_o7kYZe-kYY_C\|z\|\.}:t]m-CG^\|9^Sw3%??oOw__*q+\$%q1qvM}5qS\p\tv>Rdh_&G3w,?oB/r%u8_f}a`Sz&@dxh\z>aq9\\#3nq{II&\.892R12I^KY,r]RLg9qc>dgng]/g2(%s%ti=yGR+'m]x)y8%SI3i""y??Xk^-@bu1,e'!?/3}5Iz,=
Jun 10, 2021 18:17:30.636007071 CEST	1182	IN	Data Raw: 4f bc 12 d5 d7 1b 9e af 7c bf 7c 9c 79 ed 20 cf 73 2f 6a a7 76 e0 e4 e9 82 07 6d b8 1c c7 f7 50 31 7c bb e0 7a 3b e3 72 1d 39 ce b8 5c cf d3 cf 4f 12 eb eb 0f f8 9a 0a ac 55 61 ad 65 2d 6b 59 cb 5a d6 b2 96 b5 ac e5 fb 2a 1f 93 56 2c 28 e5 91 c4 Data Ascii: O\|\|y s/jvmP1\|z;r9\OUae-kYZ*V,(xyy0m[4M'A\.nxyyb-yj9Yb}.U9YK{8;Fhmgwp\2p\84"hEX~}A@0q0]Pm7Yy#_l[
Jun 10, 2021 18:17:30.636039019 CEST	1183	IN	Data Raw: 68 32 06 5d c5 68 19 18 5d 1b 63 e0 63 4c 62 8c 79 86 a1 2c d0 57 25 da aa 44 4d 37 ef 65 51 a0 c8 73 e4 59 be d8 80 f3 9b 70 b6 b9 5b 6e 30 97 1b bf 69 f3 5d 14 28 8a 1c 79 9e 23 cf 33 e4 39 11 3e 4c fa 94 65 41 c4 41 55 a2 ac 0a 14 25 79 5d 96 Data Ascii: h2]h]ccLby,W%DM7eQsYp[n0i](y#39>LeAAU%y]HIH+c-]F6S":4MQ<C&Q }a($F%E,rTe,&EYjuM*e(9,E&Hq IS$Y,/PAueP}m,C:,Y<
Jun 10, 2021 18:17:30.636065960 CEST	1185	IN	Data Raw: 49 5e 55 55 85 3c cf 17 2e 27 49 12 64 59 36 1d 6f ec fb 1e e7 33 7f bc 91 1c 23 fc a9 05 d6 35 8d 71 65 b7 0f ba 0e 46 d3 c0 a0 2a 44 5c 49 02 81 4a ac de d4 d1 3b 36 7a df 43 17 85 68 e2 08 55 1c 23 8f 23 24 61 88 30 08 e0 7b 1e 5c c7 85 63 3b Data Ascii: I^UU<.'IdY6o3#5qeFD\IJ;6zChU##$a0{\c;3l#dz;E.Z4a&,03~@:e4[dF6ta$MEW4iEI>t:$A:Lm[plqllyp\|nLr'-:4\|n0
Jun 10, 2021 18:17:30.636089087 CEST	1186	IN	Data Raw: ea 06 b7 a6 6a f3 b8 57 15 a8 0a 41 a1 6b 9c 3a 31 7f 8f ac 79 73 fd 89 94 9d 85 ac 73 f7 0f 07 4c bc 99 6c 2d 31 0c e8 3a 65 12 81 16 4c d3 82 69 da 14 0b 86 41 5e af e9 3a 14 55 83 ac ce e3 42 37 0d 58 b6 0d d7 f7 11 c5 31 f2 a2 40 dd 34 24 0a Data Ascii: jWAk:1yssLl-1:eLiA^:UB7X1@4$z^sae-kYZxyeI\.A,J @e$Z#zb)B,2/0D(m,4N+8N8$,TtuJG
Jun 10, 2021 18:17:30.636115074 CEST	1188	IN	Data Raw: a1 27 8a 47 d2 8e 87 1d 0e fb 2d f6 bb 0d 76 db 27 ec b6 4f d8 6e 9f b0 99 d8 d0 36 23 62 f1 20 08 54 62 29 90 59 b4 11 27 67 64 85 45 3a 89 f4 73 c4 49 40 9d 4e 32 89 c4 a1 e2 60 8e 10 e3 c7 13 89 1c 3a 9d 88 bc 12 04 11 82 40 de 83 b4 85 06 c3 Data Ascii: 'G-v'On6#b Tb)Y'gdE:sI@N2`:@0D)EZ0LBVN<?1!!<Qyll\v;-nO$QH$NdQx0IZHY'$%d'D0K`kY)JkDI<)^$A k@G&
Jun 10, 2021 18:17:30.636141062 CEST	1189	IN	Data Raw: 77 39 b6 58 24 e0 9c ff 88 1c 67 9c 23 f5 2c 8b 24 f5 b6 6d 87 1b 57 26 3d 02 3b 47 be dc 1f 3f 24 56 db 9b f2 ad 11 c8 ed 96 ae 4b 12 f6 1b a6 4e c7 3e 79 56 26 ec 0e 87 1d f6 bc c4 e2 60 02 71 92 51 b4 2f 16 70 fd c9 f7 33 69 1f 1a 65 23 92 68 Data Ascii: w9X$g#,$mW&=;G?$VKN>yV&`qQ/p3ie#h)GM*{X.-;N`G5UBjXBnOci^92rQ9<3D}q5IJN+6~h\|^#&Fd%NGK#[ohO~"2un=Be-kY
Jun 10, 2021 18:17:30.636163950 CEST	1191	IN	Data Raw: 84 98 23 8a c3 e9 b6 4a 5e 08 78 9e 4f 44 41 10 20 08 42 7a 83 20 b9 ad 92 dc 58 19 2d c6 15 79 3e 8f 8a 2e 32 be d8 0d 97 6c 51 c8 73 42 96 65 48 d3 04 71 12 21 8c 02 f8 81 07 cf 77 e1 b8 36 6c db 84 69 e9 30 0c 7a cc f1 55 b2 79 76 bb a7 3c df Data Ascii: #J^xODA Bz X-y>.2lQsBeHq!w6li0zUyv<:HY)`~fRrt.ww]h`("cI<v<(2qN3m^2>Hn)mXDZ&O4}~GNG1G"{e2`8kxj
Jun 10, 2021 18:17:30.636189938 CEST	1192	IN	Data Raw: f4 c8 65 d3 cc f5 64 63 91 50 4d c9 f1 f9 09 ce 4f f8 79 ec ce b0 9f 5f 8e ad d7 d4 75 85 aa 2e 51 56 05 8a 92 c8 b4 2c 9f 85 d6 6b e1 c7 09 0e 2e 12 27 a1 82 63 ea 0b 1a 49 98 72 f3 76 01 fb 1e 9d 43 79 51 a0 28 cb c5 b3 b2 76 61 6d 53 d7 f3 1c Data Ascii: edcPMOy_u.QV,k.'cIrvCyQ(vamSEco7rK>ib~\{8?}z0fYNeWR=z=+:q4(a~YdtlHb*`cu'se-ax>r//6+++++++++?{/)
Jun 10, 2021 18:17:30.636214972 CEST	1193	IN	Data Raw: 35 2e 4d 85 73 cd d1 d4 38 37 0d ce 6d 83 73 df e1 32 f4 93 bc ba 9c 07 5c ce e3 43 ae e7 33 ae e7 33 2e e3 88 0b 93 3f 1f 8b 4c aa e7 c8 9d b2 2e 29 15 2a 2a ae da ae 41 d7 b7 e8 87 9e 48 a3 f3 88 f3 85 6c 88 18 f3 f1 37 4e 20 2d 04 c6 27 36 e0 Data Ascii: 5.Ms87ms2\C33.?L.)**AHl7N -'6RTm~oi#uYDGGe=L`C~0giu\q^qp=L<X+B=Yp"MEpe_GmLYJn^?=ao[_L
Jun 10, 2021 18:17:30.696029902 CEST	1213	IN	Data Raw: f2 0f f1 03 96 78 9d c9 ab a6 2a 50 e6 29 f2 34 46 1a 87 48 a2 00 71 e8 23 0e 3d 44 81 87 28 f4 10 85 3e e2 28 40 12 87 48 d3 18 79 9e a2 28 a9 c8 ea 48 7e aa 71 1c a6 1c 32 d7 cb 19 97 f3 88 f3 38 60 e8 3b b4 6d 8d aa 2a 51 14 39 bd 79 30 46 14 Data Ascii: xP)4FHq#=D(>(@Hy(H~q28`;mQ9y0FEWQ0<GQUf!'eY4I3q#c$]GOoklnMiP%,EGu86\{Q B$q4&1$FBeWG(BQO)4Ce2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	185.61.154.34	80	192.168.2.3	49729	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jun 10, 2021 18:17:45.631371021 CEST	1920	IN	HTTP/1.1 408 Request Time-out Content-length: 110 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 69 64 6e 27 74 20 73 65 6e 64 20 61 20 63 6f 6d 70 6c 65 74 65 20 72 65 71 75 65 73 74 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>408 Request Time-out</h1>Your browser didn't send a complete request in time.</body></html>

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 10, 2021 18:17:29.909924030 CEST	104.18.11.207	443	192.168.2.3	49723	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Mar 01 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Tue Mar 01 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 10, 2021 18:17:29.909924030 CEST	104.18.11.207	443	192.168.2.3	49723	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 10, 2021 18:17:29.910120010 CEST	104.18.11.207	443	192.168.2.3	49721	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Mar 01 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Tue Mar 01 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 10, 2021 18:17:29.910120010 CEST	104.18.11.207	443	192.168.2.3	49721	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 3728 Parent PID: 792

General

Start time:	18:17:26
Start date:	10/06/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff7f0d90000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5720 Parent PID: 3728

General

Start time:	18:17:27
Start date:	10/06/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3728 CREDAT:17410 /prefetch:2
Imagebase:	0xe60000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report #Ud83d#Udce9-peter.nash.htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Initial Sample

Sigma Overview

Signature Overview

Phishing:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 3728 Parent PID: 792

General

Chronological Activities

Analysis Process: iexplore.exe PID: 5720 Parent PID: 3728

General

Chronological Activities

Disassembly